一句话：提出一种静态分析，自动且高效地检测库升级是否引入 API 不兼容。
现代应用常复用大量开源库，第三方库独立演化且可能因修复缺陷或漏洞而改变接口，导致下游应用出现 API 不兼容；若未及时发现，会在测试或运行时暴露为失败甚至崩溃。本文针对这一问题提出一种静态分析，用于在库升级时自动、高效地检查其是否引入 API 不兼容。方法上通过对库更新前后的接口及下游调用关系进行静态检查，避免依赖人工排查；目标是让开发者能在升级过程中尽早发现并处理兼容性问题。摘要未给出具体实现细节、实验设置或量化结果。
Software engineering practices have evolved to the point where a developer writing a new application today doesn’t start from scratch, but reuses a number of open source libraries and components. These third-party libraries evolve independently of the applications in which they are used, and may not maintain stable interfaces as bugs and vulnerabilities in them are fixed. This in turn causes API incompatibilities in downstream applications which must be manually resolved. Oversight here may manifest in many ways, from test failures to crashes at runtime. To address this problem, we present a static analysis for automatically and efficiently checking if a library upgrade introduces an API incompatibility.
DOI 原文 ·
@inproceedings{paperbot4677,
title = {Efficient static checking of library updates},
author = {Darius Foo and Hendy Chua and Jason Yeo and Ming Yi Ang and Asankhaya Sharma},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3275535}
}