API beauty is in the eye of the clients: 2.2 million Maven dependencies reveal the spectrum of client–API usages

Harrand, Nicolas; Benelallam, Amine; Soto-Valero, César; Bettega, François; Barais, Olivier; Baudry, Benoît

doi:10.1016/j.jss.2021.111134

Cited by 13 publications

(6 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Science gateways are domain-based, integrated components that help overcome those problems by providing a configurable interface and by utilizing cutting-edge technologies to save users from low-level technological issues and provide them with an easily customizable graphical interface for their scientific research [11]. Most of them decouple frontend and backend layers via API-based interfaces [12], allowing the gateway communities to focus their effort on designing community-specific Graphical User Interfaces (GUI) [3]. However, developing backend and frontend solutions can be challenging for non-IT experts [6].…”

Section: Motivation and Significancementioning

confidence: 99%

NEFBDAA — .NET Environment for Building Dynamic Angular Applications

Frąszczak

2022

SoftwareX

View full text Add to dashboard Cite

Section: Motivation and Significancementioning

confidence: 99%

NEFBDAA — .NET Environment for Building Dynamic Angular Applications

Frąszczak

2022

SoftwareX

View full text Add to dashboard Cite

“…We leverage one key observation to limit the development effort for adapters: the distributions of usages among libraries in a reservoir [26], among versions [27] and among the API members [28], are skewed towards a handful of popular elements. If the designers of a Library Substitution Framework accept to build a solution that is effective for a majority of client applications in a given domain, instead of all of them, then, the complexity of the framework can be significantly reduced.…”

Section: Library Substitution Framework Architecturementioning

confidence: 99%

“…Size of APIs: The number of elements exposed by a library's API can be large. For example, among the 100 most popular libraries of Maven Central, the median number of public types is 202, the median number of methods 1, 815 and the median number of public fields 148 [28]. There might be some client applications that depend on these elements.…”

Section: Library Substitution Framework Architecturementioning

confidence: 99%

“…Consequently, a Library Substitution Framework shall support all these API elements to provide diversity to all applications. However, the vast majority of clients rely on a small subset of the original APIs [28]. Consequently, framework designers can provide adapters that focus on the most popular subset of the original libraries' API.…”

Section: Library Substitution Framework Architecturementioning

confidence: 99%

“…We assess the popularity of API elements by static analysis of the clients' dataset described in Section 4.2.2. To perform this static analysis, we reuse the tool develop for a previous study [28].…”

Section: Client Of Json Librariesmentioning

confidence: 99%

See 2 more Smart Citations

Automatic Diversity in the Software Supply Chain

Harrand¹,

Durieux²,

Broman³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Despite its obvious benefits, the increased adoption of package managers to automate the reuse of libraries has opened the door to a new class of hazards: supply chain attacks. By injecting malicious code in one library, an attacker may compromise all instances of all applications that depend on the library. To mitigate the impact of supply chain attacks, we propose the concept of Library Substitution Framework. This novel concept leverages one key observation: when an application depends on a library, it is very likely that there exists other libraries that provide similar features. The key objective of Library Substitution Framework is to enable the developers of an application to harness this diversity of libraries in their supply chain. The framework lets them generate a population of application variants, each depending on a different alternative library that provides similar functionalities. To investigate the relevance of this concept, we develop ARGO, a proof-of-concept implementation of this framework that harnesses the diversity of JSON suppliers. We study the feasibility of library substitution and its impact on a set of 368 clients. Our empirical results show that for 195 of the 368 java applications tested, we can substitute the original JSON library used by the client by at least 15 other JSON libraries without modifying the client's code. These results show the capacity of a Library Substitution Framework to diversify the supply chain of the client applications of the libraries it targets.

show abstract

Breaking bad? Semantic versioning and impact of breaking changes in Maven Central

et al. 2022

View full text Add to dashboard Cite

Just like any software, libraries evolve to incorporate new features, bug fixes, security patches, and refactorings. However, when a library evolves, it may break the contract previously established with its clients by introducing Breaking Changes (BCs) in its API. These changes might trigger compile-time, link-time, or run-time errors in client code. As a result, clients may hesitate to upgrade their dependencies, raising security concerns and making future upgrades even more difficult.Understanding how libraries evolve helps client developers to know which changes to expect and where to expect them, and library developers to understand how they might impact their clients. In the most extensive study to date, Raemaekers et al. investigate to what extent developers of Java libraries hosted on the Maven Central Repository (MCR) follow semantic versioning conventions to signal the introduction of BCs and how these changes impact

show abstract

API beauty is in the eye of the clients: 2.2 million Maven dependencies reveal the spectrum of client–API usages

Cited by 13 publications

References 12 publications

NEFBDAA — .NET Environment for Building Dynamic Angular Applications

NEFBDAA — .NET Environment for Building Dynamic Angular Applications

Automatic Diversity in the Software Supply Chain

Breaking bad? Semantic versioning and impact of breaking changes in Maven Central

Contact Info

Product

Resources

About