Towards increasing the reliability of Maven's dependency resolution

Master thesis (2024)

Authors

C.R. Paulsen Electrical Engineering, Mathematics and Computer Science

Contributors

S. Proksch Software Engineering - EEMCS (mentor)
A. van Deursen Software Engineering - EEMCS (graduation committee member)
C. Lofi Web Information Systems - EEMCS (graduation committee member)
Faculty
Electrical Engineering, Mathematics and Computer Science
Dependency management Dependency resolution Dependency-specific compatibility Compatible range generation Cross-version testing
More Info
expand_more

Published Date

09-07-2024

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Abstract

A reliable dependency resolution process should minimize dependency-related issues. We identify transparency, stability, and flexibility as the three core properties that define a reliable resolution process and discuss how different dependency declaration strategies affect them. To increase the reliability of Maven's dependency resolution we identify two patterns of misuse, or smells, that commonly occur in Maven projects: the presence of used undeclared dependencies and conflicting soft version constraints. We introduce and evaluate a proof-of-concept method, MaRCo, designed to address these smells. MaRCo increases transparency by injecting used undeclared dependencies and balances stability and flexibility by replacing soft version constraints with compatible version ranges. The version ranges are generated through a dependency-specific approach to compatibility using bytecode differencing and cross-version testing. The empirical evaluation of MaRCo shows that while the ranges generated by the dependency-specific approach may be stricter than necessary, they are unlikely to contain breaking changes. Overall, we see that MaRCo is able to make the resolution process slightly more reliable, affecting 13% of dependencies in 71% of projects, in a way that is more stable than a soft constraint-only approach, and more flexible than a hard constraint-only approach.