TL;DR
Pr"azi enhances dependency network analysis by combining package manifests with call graphs to reveal actual usage patterns at the function level, providing more accurate insights into package dependencies.
Contribution
This paper introduces Pr"azi, a novel approach that constructs function-level dependency networks by integrating manifests and call graphs, improving dependency usage understanding.
Findings
Packages call only 40% of their resolved dependencies
Metadata-based networks overgeneralize dependency usage
Manual analysis shows dependency use varies significantly
Abstract
Modern programming languages such as Java, JavaScript, and Rust encourage software reuse by hosting diverse and fast-growing repositories of highly interdependent packages (i.e., reusable libraries) for their users. The standard way to study the interdependence between software packages is to infer a package dependency network by parsing manifest data. Such networks help answer questions such as "How many packages have dependencies to packages with known security issues?" or "What are the most used packages?". However, an overlooked aspect in existing studies is that manifest-inferred relationships do not necessarily examine the actual usage of these dependencies in source code. To better model dependencies between packages, we developed Pr\"azi, an approach combining manifests and call graphs of packages. Pr\"azi constructs a dependency network at the more fine-grained function-level,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
