一句话：提出 Diplomatist，自动识别并分析多 guest 语言的跨语言依赖，评估其生态健康与安全风险传播。
多语言项目中的跨语言依赖会引入功能缺陷和安全漏洞等风险，但现有研究多关注宿主语言与 C/C++ 等特定 guest 语言之间的依赖，对更广泛的 guest 语言及其对软件生态的整体影响仍缺乏分析。本文提出 Diplomatist，通过分析跨语言调用 API，构建大规模知识库来标准化代码特征，识别 JavaScript、Python、Ruby、PHP、C/C++ 等 guest 语言的库版本，使 Java 等宿主语言能够追踪其调用的 guest 库。评估显示，Diplomatist 在高质量基准上平均精确率为 88.9%、召回率为 91.5%。利用该工具，作者识别出 435,258 个间接或传递依赖其他生态库的 Java 库，并列出维护软件生态长期健康的关键跨语言库。案例研究进一步表明，脆弱项目或库可通过跨语言依赖跨生态传播安全问题，影响 Maven 生态中 13,739 个下游项目；部分修复建议已被开发者确认。
In large-scale software development, multilingual projects, those involving multiple interacting programming languages, have become increasingly common in both industry and the open-source community. Research indicates that cross-language dependencies in these projects can increase the like-lihood of risks, such as functionality defects and security vulnerabilities. While most existing studies focus on cross-language dependencies between host languages and specific guest languages (e.g., C/C++), interactions between host languages and a broader range of guest languages, as well as the broader impact of such dependencies on software ecosystems, remain underexplored.To address the above limitations, in this paper, we develop a technique, Diplomatist, to identify and analyze cross-language dependencies between host languages, such as Java, and guest languages, including JavaScript, Python, Ruby, PHP, and C/C++. Diplomatist automatically analyzes cross-language invocation APIs and constructs a large-scale knowledge repository to standardize code features for identifying library versions across various guest languages, enabling host languages to trace the guest language libraries they invoke. Evaluation shows that Diplomatist achieved an average precision of 88.9% and a recall of 91.5% on a high-quality benchmark, indicating its high accuracy in detecting cross-language dependencies. Using Diplomatist, we identified 435,258 Java libraries that indirectly or transitively depend on libraries from other ecosystems. Diplomatist provides a list of cross-language pivotal libraries that contribute to preserving the long-term health and sustainability of software ecosystems. Moreover, we conduct a case study to examine the impact of the risks introduced due to cross-language dependencies on programming language ecosystems, by analyzing a full-picture of the cross-language dependency graph. Our findings show that fragile projects or libraries can propagate security issues across ecosystems via these dependencies, impacting 13,739 downstream projects in the Maven ecosystem. We utilized Diplomatist to provide remediation suggestions to relevant project developers. Issue reports of some subjects have been confirmed by developers.
DOI 原文 ·
@inproceedings{paperbot9236,
title = {Diplomatist: What Do Cross-language Dependencies Reflect Software Ecosystem Health?},
author = {Fanyi Meng and Ying Wang and Chun Yong Chong and Hai Yu and Zhiliang Zhu},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00158}
}