Further Investigation of the Survivability of Code Technical Debt Items

TL;DR

This study empirically compares the survivability of different code technical debt items, such as bugs, smells, and vulnerabilities, in open-source and industrial systems, revealing that bugs are removed faster while other TDIs persist longer.

Contribution

It extends previous research by analyzing the survivability of various types of code TDIs across industrial and open-source contexts using large-scale empirical data.

Findings

Bugs tend to be removed faster than other TDIs.

Code smells and vulnerabilities tend to survive longer in systems.

Industrial systems remove TDIs more quickly than open-source systems.

Abstract

Context: Technical Debt (TD) discusses the negative impact of sub-optimal decisions to cope with the need-for-speed in software development. Code Technical Debt Items (TDI) are atomic elements of TD that can be observed in code artefacts. Empirical results on open-source systems demonstrated how code-smells, which are just one type of TDIs, are introduced and "survive" during release cycles. However, little is known about whether the results on the survivability of code-smells hold for other types of code TDIs (i.e., bugs and vulnerabilities) and in industrial settings. Goal: Understanding the survivability of code TDIs by conducting an empirical study analysing two industrial cases and 31 open-source systems from Apache Foundation. Method: We analysed 133,670 code TDIs (35,703 from the industrial systems) detected by SonarQube (in 193,196 commits) to assess their survivability using survivability models. Results: In general, code TDIs tend to remain and linger for long periods in open-source systems, whereas they are removed faster in industrial systems. Code TDIs that survive over a certain threshold tend to remain much longer, which confirms previous results. Our results also suggest that bugs tend to be removed faster, while code smells and vulnerabilities tend to survive longer.