Hero: On the Chaos When PATH Meets Modules

Wang, Ying; Qiao, Liang; Xu, Chang; Liu, Yepang; Cheung, Shing-Chi; Meng, Na; Yu, Hai; Zhu, Zhiliang

doi:10.1109/icse43902.2021.00022

Cited by 7 publications

(3 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Researchers have conducted in-depth studies on various types of ecosystems. Wang et al [46] developed HERO to investigate dependency management in Golang, achieving a high 98.5% detection rate on DM issues. Cogo et al [30] studied same-day releases in npm, finding important changes despite the restricted time frame, with some releases being error-prone due to large quick changes.…”

Section: Related Workmentioning

confidence: 99%

Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem

Hu,

Zhang,

Liu

et al. 2024

Proceedings of the IEEE/ACM 46th International Conference on Software Engineering

View full text Add to dashboard Cite

Open-source software (OSS) greatly facilitates program development for developers. However, the high number of vulnerabilities in open-source software is a major concern, including in Golang, a relatively new programming language. In contrast to other commonly used OSS package managers, Golang presents a distinctive feature whereby commits are prevalently used as dependency versions prior to their integration into official releases. This attribute can prove advantageous to users, as patch commits can be implemented in a timely manner before the releases. However, Golang employs a decentralized mechanism for managing dependencies, whereby dependencies are upheld and distributed in separate repositories. This approach can result in delays in the dissemination of patches and unresolved vulnerabilities.To tackle the aforementioned concern, a comprehensive investigation was undertaken to examine the life cycle of vulnerability in Golang, commencing from its introduction and culminating with its rectification. To this end, a framework was established by gathering data from diverse sources and systematically amalgamating them with an algorithm to compute the lags in vulnerability patching. It turned out that 66.10% of modules in the Golang ecosystem were affected by vulnerabilities. Within the vulnerability life cycle, we found two kinds of lag impeding the propagation of vulnerability fixing. By analyzing reasons behind non-lagged and lagged vulnerabilities, timely releasing and indexing patch versions could significantly enhance ecosystem security.

show abstract

Section: Related Workmentioning

confidence: 99%

Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem

Hu,

Zhang,

Liu

et al. 2024

Proceedings of the IEEE/ACM 46th International Conference on Software Engineering

View full text Add to dashboard Cite

show abstract

“…Huang et al [19] studied inconsistent dependency versions (i.e., multiple versions of a dependency are used in a project) in Java, and proposed to harmonize inconsistent versions. Wang et al [53] analyzed missing or wrong dependencies caused by two mixed dependency management mechanisms in Go, and proposed to detect them and suggest fixes. Macho et al [34] proposed a rule-based approach to repair Maven builds that were broken due to dependency bugs.…”

Section: Dependency Bugsmentioning

confidence: 99%

“…Literature. On the one hand, a lot of advances have been made to investigate DBs in different ecosystems, e.g., Java [19,55], C/C++ [27], JavaScript [41], Python [36,54], Go [53], and Debian and Red Hat [3]. They only consider DBs at the homogeneous library layer.…”

Section: Introductionmentioning

confidence: 99%

Demystifying Dependency Bugs in Deep Learning Stack

Huang¹,

Chen²,

Wu³

et al. 2022

Preprint

View full text Add to dashboard Cite

Recent breakthroughs in deep learning (DL) techniques have stimulated significant growth in developing DL-enabled applications. These DL applications, built upon a heterogeneous and complex DL stack (e.g., Nvidia GPU, Linux, CUDA driver, Python runtime, and Tensor-Flow), are subject to software and hardware dependencies across the DL stack. A persistent challenge in dependency management across the entire engineering lifecycle is posed by the asynchronous and radical evolution as well as the complex version constraints among dependencies. Developers might introduce dependency bugs (DBs) in selecting, using and maintaining dependencies. However, the characteristics of DBs in DL stack is still under-investigated, hindering practical solutions to dependency management in DL stack.To fill this gap, this paper presents the first comprehensive study to characterize symptoms, root causes and fix patterns of DBs across the whole DL stack with 326 DBs collected from StackOverflow posts. For each DB, we first investigate the symptom as well as the lifecyle stage and dependency where the symptom is exposed. Then, we analyze the root cause as well as the lifecycle stage and dependency where the root cause is introduced. Finally, we explore the fix pattern as well as the knowledge sources that are used to fix it. Our findings from this study shed light on the implications on dependency management, e.g., constructing dependency knowledge graph for the entire DL stack, recommending dependencies, detecting, localizing and fixing dependency bugs, and upgrading and migrating dependencies.

show abstract