Print Email Facebook Twitter Software Ecosystem Call Graph for Dependency Management Title Software Ecosystem Call Graph for Dependency Management Author Hejderup, J.I. (TU Delft Software Engineering) van Deursen, A. (TU Delft Software Technology) Gousios, G. (TU Delft Software Engineering) Department Software Technology Date 2018 Abstract A popular form of software reuse is the use of open source software libraries hosted on centralized code repositories, such as Maven or npm. Developers only need to declare dependencies to external libraries, and automated tools make them available to the workspace of the project. Recent incidents, such as the Equifax data breach and the leftpad package removal, demonstrate the difficulty in assessing the severity, impact and spread of bugs in dependency networks. While dependency checkers are being adapted as a counter measure, they only provide indicative information. To remedy this situation, we propose a fine-grained dependency network that goes beyond packages and into call graphs. The result is a versioned ecosystem-level call graph. In this paper, we outline the process to construct the proposed graph and present a preliminary evaluation of a security issue from a core package to an affected client application. Subject dependency managementsoftware ecosystemdependenciescall graphprogram analysis To reference this document use: http://resolver.tudelft.nl/uuid:6f088b70-bccb-476e-b092-395078dec39b DOI https://doi.org/10.1145/3183399.3183417 Publisher Association for Computing Machinery (ACM), New York, NY ISBN 978-1-4503-5662-6 Source ICSE-NIER'18 Proceedings of 40th International Conference on Software Engineering: New Ideas and Emerging Results Track Event ICSE 2018, 2018-05-27 → 2018-06-03, Gothenburg, Sweden Bibliographical note R2 - Software Engineering in Other Domains Accepted author manuscript Part of collection Institutional Repository Document type conference paper Rights © 2018 J.I. Hejderup, A. van Deursen, G. Gousios Files PDF jhejderup_icse18_nier.pdf 812.11 KB Close viewer /islandora/object/uuid:6f088b70-bccb-476e-b092-395078dec39b/datastream/OBJ/view