一句话:通过大规模 Maven 生态实证研究,量化依赖升级中破坏性变更对客户端的影响及语义化版本遵守情况。
现代软件依赖库,库更新可能包含破坏性变更导致客户端失败,但缺乏大规模实证。本文对 Maven Java 项目进行实证研究,分析 18,415 个 Maven artifact 及其 142,355 个直接依赖,其中 71.60% 未更新。作者升级这些依赖,发现 11.58% 的依赖更新包含影响客户端的破坏性变更。进一步分析库端变更对客户端的影响,并检查库在引入破坏性变更时是否遵循语义化版本。结果表明,传递依赖变更是在依赖升级过程中引入破坏性变更的主要因素;近一半检测到的客户端影响破坏性变更违反语义化版本,在非 Major 更新中引入破坏性变更。
Modern software applications rely heavily on the usage of libraries, which provide reusable functionality, to accelerate the development process. As libraries evolve and release new versions, the software systems that depend on those libraries (the clients) should update their dependencies to use these new versions as the new release could, for example, include critical fixes for security vulnerabilities. However, updating is not always a smooth process, as it can result in software failures in the clients if the new version includes breaking changes. Yet, there is little research on how these breaking changes impact the client projects in the wild. To identify if changes between two library versions cause breaking changes at the client end, we perform an empirical study on Java projects built using Maven. For the analysis, we used 18,415 Maven artifacts, which declared 142,355 direct dependencies, of which 71.60% were not up-to-date. We updated these dependencies and found that 11.58% of the dependency updates contain breaking changes that impact the client. We further analyzed these changes in the library which impact the client projects and examine if libraries have adhered to the semantic versioning scheme when introducing breaking changes in their releases. Our results show that changes in transitive dependencies were a major factor in introducing breaking changes during dependency updates and almost half of the detected client impacting breaking changes violate the semantic versioning scheme by introducing breaking changes in non-Major updates.