一句话:通过对19,652个Java项目提交级分析,揭示库迁移的普遍性、长尾与单向趋势及14类动因。
第三方库复用普遍,但库迁移(移除一库并以另一库替代)的机制与动因尚缺乏系统理解。本文对19,652个Java GitHub项目做细粒度提交级分析,构建了迄今最大的迁移数据集(1,194条迁移规则、3,163次迁移提交)。结果显示:8,065个项目(41.04%)至少移除过一个库,1,564至5,004个项目(7.96%下界至25.46%上界)至少发生过一次迁移,有迁移的项目中位数含2至4次迁移。迁移集中于日志、JSON、测试与Web服务等领域并呈长尾分布,且高度单向。对提交信息、issue与PR的主题分析归纳出14类常见迁移原因(如缺乏维护、可用性、集成等),其中7类此前未被讨论。作者给出对包托管平台、维护者与库开发者的可操作启示,并公开复现包。
With the rise of open-source software and package hosting platforms, reusing 3rd-party libraries has become a common practice. Due to various failures during software evolution, a project may remove a used library and replace it with another library, which we call library migration. Despite substantial research on dependency management, the understanding of how and why library migrations occur is still lacking. Achieving this understanding may help practitioners optimize their library selection criteria, develop automated approaches to monitor dependencies, and provide migration suggestions for their libraries or software projects. In this paper, through a fine-grained commit-level analysis of 19,652 Java GitHub projects, we extract the largest migration dataset to-date (1,194 migration rules, 3,163 migration commits). We show that 8,065 (41.04%) projects having at least one library removal, 1,564 (7.96%, lower-bound) to 5,004 (25.46%, upper-bound) projects have at least one migration, and a median project with migrations has 2 to 4 migrations in total. We discover that library migrations are dominated by several domains (logging, JSON, testing and web service) presenting a long tail distribution. Also, migrations are highly unidirectional in that libraries are either mostly abandoned or mostly chosen in our project corpus. A thematic analysis on related commit messages, issues, and pull requests identifies 14 frequently mentioned migration reasons (e.g., lack of maintenance, usability, integration, etc), 7 of which are not discussed in previous work. Our findings can be operationalized into actionable insights for package hosting platforms, project maintainers, and library developers. We provide a replication package at https://doi.org/10.5281/zenodo.4816752.