skip to main content
10.1109/ASE51524.2021.9678905acmconferencesArticle/Chapter ViewAbstractPublication PagesaseConference Proceedingsconference-collections
research-article

RepFinder: finding replacements for missing APIs in library update

Published: 24 June 2022 Publication History

Abstract

Libraries are widely adopted in developing software projects. Library APIs are often missing during library evolution as library developers may deprecate, remove or refactor APIs. As a result, client developers have to manually find replacement APIs for missing APIs when updating library versions in their projects, which is a difficult and expensive software maintenance task. One of the key limitations of the existing automated approaches is that they usually consider the library itself as the single source to find replacement APIs, which heavily limits their accuracy.
In this paper, we first present an empirical study to understand characteristics about missing APIs and their replacements. Specifically, we quantify the prevalence of missing APIs, and summarize the knowledge sources where the replacements are found, and the code change and mapping cardinality between missing APIs and their replacements. Then, inspired by the insights from our study, we propose a heuristic-based approach, RepFinder, to automatically find replacements for missing APIs in library update. We design and combine a set of heuristics to hierarchically search three sources (deprecation message, own library, and external library) for finding replacements. Our evaluation has demonstrated that RepFinder can find replacement APIs effectively and efficiently, and significantly outperform the state-of-the-art approaches.

References

[1]
M. Allamanis, E. T. Barr, P. Devanbu, and C. Sutton, "A survey of machine learning for big code and naturalness," ACM Computing Surveys, vol. 51, no. 4, p. 81, 2018.
[2]
I. Balaban, F. Tip, and R. Fuhrer, "Refactoring support for class library migration," in OOPSLA, 2005, pp. 265--279.
[3]
G. Bavota, M. Linares-Vasquez, C. E. Bernal-Cardenas, M. Di Penta, R. Oliveto, and D. Poshyvanyk, "The impact of api change-and fault-proneness on the user ratings of android apps," IEEE Transactions on Software Engineering, vol. 41, no. 4, pp. 384--407, 2014.
[4]
C. Bogart, C. Kästner, J. Herbsleb, and F. Thung, "How to break an api: Cost negotiation and community values in three software ecosystems," in FSE, 2016, pp. 109--120.
[5]
A. Brito, M. T. Valente, L. Xavier, and A. Hora, "You broke my code: understanding the motivations for breaking changes in apis," Empirical Software Engineering, vol. 25, no. 2, pp. 1458--1492, 2020.
[6]
A. Brito, L. Xavier, A. Hora, and M. T. Valente, "Apidiff: Detecting api breaking changes," in SANER, 2018, pp. 507--511.
[7]
A. Brito, L. Xavier, A. Hora, and M. T. Valente, "Why and how java developers break apis," in SANER, 2018, pp. 255--265.
[8]
G. Brito, A. Hora, M. T. Valente, and R. Robbes, "Do developers deprecate apis with replacement messages? a large-scale analysis on java systems," in SANER, 2016, pp. 360--369.
[9]
G. Brito, A. Hora, M. T. Valente, and R. Robbes, "On the use of replacement messages in api deprecation: An empirical study," Journal of Systems and Software, vol. 137, pp. 306--321, 2018.
[10]
N. D. Bui, Y. Yu, and L. Jiang, "Sar: learning cross-language api mappings with little knowledge," in ESEC/FSE, 2019, pp. 796--806.
[11]
M. Cadariu, E. Bouwers, J. Visser, and A. van Deursen, "Tracking known security vulnerabilities in proprietary software systems," in SANER, 2015, pp. 516--519.
[12]
L. Chen, F. Hassan, X. Wang, and L. Zhang, "Taming behavioral backward incompatibilities via cross-project testing and analysis," in ICSE, 2020, pp. 112--124.
[13]
K. Chow and D. Notkin, "Semi-automatic update of applications in response to library changes," in ICSM, 1996, pp. 359--368.
[14]
F. R. Cogo, G. A. Oliva, and A. E. Hassan, "Deprecation of packages and releases in software ecosystems: A case study on npm," IEEE Transactions on Software Engineering, 2021.
[15]
B. E. Cossette and R. J. Walker, "Seeking the ground truth: a retroactive study on the evolution and migration of software libraries," in FSE, 2012, p. 55.
[16]
J. Cox, E. Bouwers, M. van Eekelen, and J. Visser, "Measuring dependency freshness in software systems," in ICSE, vol. 2, 2015, pp. 109--118.
[17]
B. Dagenais and M. P. Robillard, "Semdiff: Analysis and recommendation support for api evolution," in ICSE, 2009, pp. 599--602.
[18]
B. Dagenais and M. P. Robillard, "Recommending adaptive changes for framework evolution," ACM Transactions on Software Engineering and Methodology, vol. 20, no. 4, p. 19, 2011.
[19]
A. Decan, T. Mens, and M. Claes, "An empirical comparison of dependency issues in oss packaging ecosystems," in SANER, 2017, pp. 2--12.
[20]
A. Decan, T. Mens, and E. Constantinou, "On the impact of security vulnerabilities in the npm package dependency network," in MSR, 2018, pp. 181--191.
[21]
E. Derr, S. Bugiel, S. Fahl, Y. Acar, and M. Backes, "Keep me updated: An empirical study of third-party library updatability on android," in CCS, 2017, pp. 2187--2200.
[22]
D. Dig and R. Johnson, "The role of refactorings in api evolution," in ICSM, 2005, pp. 389--398.
[23]
D. Dig and R. Johnson, "How do apis evolve? a story of refactoring," J. Softw. Maint. Evol., vol. 18, no. 2, pp. 83--107, 2006.
[24]
M. Fazzini, Q. Xin, and A. Orso, "Automated api-usage update for android apps," in ISSTA, 2019, pp. 204--215.
[25]
D. Felsing, S. Grebing, V. Klebanov, P. Rümmer, and M. Ulbrich, "Automating regression verification," in ASE, 2014, pp. 349--360.
[26]
M. W. Godfrey and L. Zou, "Using origin analysis to detect merging and splitting of source code entities," IEEE Transactions on Software Engineering, vol. 31, no. 2, pp. 166--181, 2005.
[27]
B. Godlin and O. Strichman, "Regression verification: proving the equivalence of similar programs," Software Testing, Verification and Reliability, vol. 23, no. 3, pp. 241--258, 2013.
[28]
A. Gyori, O. Legunsen, F. Hariri, and D. Marinov, "Evaluating regression test selection opportunities in a very large open-source ecosystem," in ISSRE, 2018, pp. 112--122.
[29]
J. Henkel and A. Diwan, "Catchup! capturing and replaying refactorings to support api evolution," in ICSE, 2005, pp. 274--283.
[30]
A. Hora, R. Robbes, N. Anquetil, A. Etien, S. Ducasse, and M. T. Valente, "How do developers react to api evolution? the pharo ecosystem case," in ICSME, 2015, pp. 251--260.
[31]
A. Hora, R. Robbes, M. T. Valente, N. Anquetil, A. Etien, and S. Ducasse, "How do developers react to api evolution? a large-scale empirical study," Software Quality Journal, vol. 26, no. 1, pp. 161--191, 2018.
[32]
D. Hou and X. Yao, "Exploring the intent behind api evolution: A case study," in WCRE, 2011, pp. 131--140.
[33]
K. Huang, B. Chen, X. Peng, D. Zhou, Y. Wang, Y. Liu, and W. Zhao, "Cldiff: Generating concise linked code differences," in Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, 2018, p. 679--690.
[34]
K. Huang, B. Chen, B. Shi, Y. Wang, C. Xu, and X. Peng, "Interactive, effort-aware library version harmonization," in ESEC/FSE, 2020, pp. 518--529.
[35]
K. Jezek, J. Dietrich, and P. Brada, "How java apis break-an empirical study," Information and Software Technology, vol. 65, pp. 129--146, 2015.
[36]
M. Kim, D. Cai, and S. Kim, "An empirical investigation into the role of api-level refactorings during software evolution," in ICSE, 2011, pp. 151--160.
[37]
S. Kim, K. Pan, and E. J. Whitehead, "When functions change their names: Automatic detection of origin relationships," in WCRE, 2005, pp. 10-pp.
[38]
D. Ko, K. Ma, S. Park, S. Kim, D. Kim, and Y. Le Traon, "Api document quality for resolving deprecated apis," in APSEC, vol. 2, 2014, pp. 27--30.
[39]
R. G. Kula, D. M. German, A. Ouni, T. Ishio, and K. Inoue, "Do developers update their library dependencies?" Empirical Software Engineering, vol. 23, no. 1, pp. 384--417, 2018.
[40]
R. G. Kula, A. Ouni, D. M. German, and K. Inoue, "An empirical study on the impact of refactoring activities on evolving client-used apis," Information and Software Technology, vol. 93, pp. 186--199, 2018.
[41]
S. K. Lahiri, C. Hawblitzel, M. Kawaguchi, and H. Rebêlo, "Symdiff: A language-agnostic semantic diff tool for imperative programs," in CAV, 2012, pp. 712--717.
[42]
M. Lamothe and W. Shang, "Exploring the use of automated api migrating techniques in practice: An experience report on android," in MSR, 2018, pp. 503--514.
[43]
M. Lamothe, W. Shang, and T.-H. P. Chen, "A3: Assisting android api migrations using code examples," IEEE Transactions on Software Engineering, 2020.
[44]
T. Lauinger, A. Chaabane, S. Arshad, W. Robertson, C. Wilson, and E. Kirda, "Thou shalt not depend on me: Analysing the use of outdated javascript libraries on the web," in NDSS, 2017.
[45]
L. Li, J. Gao, T. F. Bissyandé, L. Ma, X. Xia, and J. Klein, "Cda: Characterising deprecated android apis," Empirical Software Engineering, vol. 25, no. 3, pp. 2058--2098, 2020.
[46]
M. Linares-Vásquez, G. Bavota, M. Di Penta, R. Oliveto, and D. Poshyvanyk, "How do api changes trigger stack overflow discussions? a study on the android sdk," in ICPC, 2014, pp. 83--94.
[47]
S. McCamant and M. D. Ernst, "Predicting problems caused by component upgrades," in ESEC/FSE, 2003, pp. 287--296.
[48]
S. McCamant and M. D. Ernst, "Early identification of incompatibilities in multi-component upgrades," in ECOOP, 2004, pp. 440--464.
[49]
T. McDonnell, B. Ray, and M. Kim, "An empirical study of api stability and adoption in the android ecosystem," in ICSM, 2013, pp. 70--79.
[50]
S. Meng, X. Wang, L. Zhang, and H. Mei, "A history-based matching approach to identification of framework evolution," in ICSE, 2012, pp. 353--363.
[51]
G. Mezzetti, A. Møller, and M. T. Torp, "Type regression testing to detect breaking changes in node. js libraries," in ECOOP, 2018.
[52]
F. P. Miller, A. F. Vandome, and J. McBrewster, Levenshtein Distance: Information Theory, Computer Science, String (Computer Science), String Metric, Damerau?Levenshtein Distance, Spell Checker, Hamming Distance. Alpha Press, 2009.
[53]
A. Mirian, N. Bhagat, C. Sadowski, A. P. Felt, S. Savage, and G. M. Voelker, "Web feature deprecation: a case study for chrome," in ICSE- SEIP, 2019, pp. 302--311.
[54]
A. Møller, B. B. Nielsen, and M. T. Torp, "Detecting locations in javascript programs affected by breaking library changes," in OOPSLA, 2020, pp. 1--25.
[55]
A. Møller and M. T. Torp, "Model-based testing of breaking changes in node. js libraries," in ESEC/FSE, 2019, pp. 409--419.
[56]
F. Mora, Y. Li, J. Rubin, and M. Chechik, "Client-specific equivalence checking," in ASE, 2018, pp. 441--451.
[57]
S. Mujahid, R. Abdalkareem, E. Shihab, and S. McIntosh, "Using others' tests to identify breaking updates," in MSR, 2020, pp. 466--476.
[58]
R. Nascimento, A. Brito, A. Hora, and E. Figueiredo, "Javascript api deprecation in the wild: A first assessment," in SANER, 2020, pp. 567--571.
[59]
H. A. Nguyen, T. T. Nguyen, G. Wilson Jr, A. T. Nguyen, M. Kim, and T. N. Nguyen, "A graph-based approach to api usage adaptation," in OOPSLA, 2010, pp. 302--321.
[60]
M. Nita and D. Notkin, "Using twinning to adapt programs to alternative apis," in ICSE, 2010, pp. 205--214.
[61]
J. H. Perkins, "Automatically generating refactorings to support api evolution," in PASTE, 2005, pp. 111--114.
[62]
H. Plate, S. E. Ponta, and A. Sabetta, "Impact assessment for vulnerabilities in open-source software libraries," in ICSME, 2015, pp. 411--420.
[63]
S. E. Ponta, H. Plate, and A. Sabetta, "Beyond metadata: Code-centric and usage-based analysis of known vulnerabilities in open-source software," in ICSME, 2018, pp. 449--460.
[64]
T. Preston-Werner, "Semantic versioning 2.0. 0," http://semver.org, 2013.
[65]
K. Prete, N. Rachatasumrit, N. Sudan, and M. Kim, "Template-based reconstruction of complex refactorings," in ICSM, 2010, pp. 1--10.
[66]
S. Raemaekers, A. Van Deursen, and J. Visser, "Measuring software library stability through historical version analysis," in ICSM, 2012, pp. 378--387.
[67]
S. Raemaekers, A. van Deursen, and J. Visser, "Semantic versioning and impact of breaking changes in the maven repository," Journal of Systems and Software, vol. 129, pp. 140--158, 2017.
[68]
R. Robbes, M. Lungu, and D. Röthlisberger, "How do developers react to api deprecation? the case of a smalltalk ecosystem," in FSE, 2012, pp. 1--11.
[69]
P. Salza, F. Palomba, D. Di Nucci, C. D'Uva, A. De Lucia, and F. Ferrucci, "Do developers update third-party libraries in mobile apps?" in ICPC, 2018, pp. 255--265.
[70]
A. A. Sawant, M. Aniche, A. van Deursen, and A. Bacchelli, "Understanding developers' needs on deprecation as a language feature," in ICSE, 2018, pp. 561--571.
[71]
A. A. Sawant, G. Huang, G. Vilen, S. Stojkovski, and A. Bacchelli, "Why are features deprecated? an investigation into the motivation behind deprecation," in ICSME, 2018, pp. 13--24.
[72]
A. A. Sawant, R. Robbes, and A. Bacchelli, "On the reaction to deprecation of 25,357 clients of 4+ 1 popular java apis," in ICSME, 2016, pp. 400--410.
[73]
A. A. Sawant, R. Robbes, and A. Bacchelli, "To react, or not to react: Patterns of reaction to api deprecation," Empirical Software Engineering, vol. 24, no. 6, pp. 3824--3870, 2019.
[74]
T. Schäfer, J. Jonas, and M. Mezini, "Mining framework usage changes from instantiation code," in ICSE, 2008, pp. 471--480.
[75]
D. Silva, J. Silva, G. J. D. S. Santos, R. Terra, and M. T. O. Valente, "Refdiff 2.0: A multi-language refactoring detection tool," IEEE Transactions on Software Engineering, 2020.
[76]
N. Smith, D. van Bruggen, and F. Tomassetti, "Javaparser: Visited," Leanpub, oct. de, 2017.
[77]
G. Soares, R. Gheyi, D. Serey, and T. Massoni, "Making program refactoring safer," IEEE software, vol. 27, no. 4, pp. 52--57, 2010.
[78]
C. Teyton, J.-R. Falleri, and X. Blanc, "Mining library migration graphs," in WCRE, 2012, pp. 289--298.
[79]
C. Teyton, J.-R. Falleri, and X. Blanc, "Automatic discovery of function mappings between similar libraries," in WCRE, 2013, pp. 192--201.
[80]
F. Thung, S. A. Haryono, L. Serrano, G. Muller, J. Lawall, D. Lo, and L. Jiang, "Automated deprecated-api usage update for android apps: How far are we?" in SANER, 2020, pp. 602--611.
[81]
F. Thung, H. J. Kang, L. Jiang, and D. Lo, "Towards generating transformation rules without examples for android api replacement," in ICSME, 2019, pp. 213--217.
[82]
A. Trostanetski, O. Grumberg, and D. Kroening, "Modular demand-driven analysis of semantic difference for program versions," in SAS, 2017, pp. 405--427.
[83]
N. Tsantalis, M. Mansouri, L. Eshkevari, D. Mazinanian, and D. Dig, "Accurate and efficient refactoring detection in commit history," in ICSE, 2018, pp. 483--494.
[84]
J. Wang, L. Li, K. Liu, and H. Cai, "Exploring how deprecated python library apis are (not) handled," in ESEC/FSE, 2020, pp. 233--244.
[85]
S. Wang, I. Keivanloo, and Y. Zou, "How do developers react to restful api evolution?" in ICSOC, 2014, pp. 245--259.
[86]
Y. Wang, B. Chen, K. Huang, B. Shi, C. Xu, X. Peng, Y. Wu, and Y. Liu, "An empirical study of usages, updates and risks of third-party libraries in java projects," in ICSME, 2020, pp. 35--45.
[87]
Y. Wang, M. Wen, Y. Liu, Y. Wang, Z. Li, C. Wang, H. Yu, S.-C. Cheung, C. Xu, and Z. Zhu, "Watchman: monitoring dependency conflicts for python library ecosystem," in ICSE, 2020, pp. 125--135.
[88]
Y. Wang, M. Wen, Z. Liu, R. Wu, R. Wang, B. Yang, H. Yu, Z. Zhu, and S.-C. Cheung, "Do the dependency conflicts in my project matter?" in ESEC/FSE, 2018, pp. 319--330.
[89]
W. Wu, Y.-G. Guéhéneuc, G. Antoniol, and M. Kim, "Aura: a hybrid approach to identify framework evolution," in ICSE, 2010, pp. 325--334.
[90]
W. Wu, F. Khomh, B. Adams, Y.-G. Guéhéneuc, and G. Antoniol, "An exploratory study of api changes and usages based on apache and eclipse ecosystems," Empirical Software Engineering, vol. 21, no. 6, pp. 2366--2412, 2016.
[91]
W. Wu, A. Serveaux, Y.-G. Guéhéneuc, and G. Antoniol, "The impact of imperfect change rules on framework api evolution identification: an empirical study," Empirical Software Engineering, vol. 20, no. 4, pp. 1126--1158, 2015.
[92]
L. Xavier, A. Brito, A. Hora, and M. T. Valente, "Historical and impact analysis of api breaking changes: A large-scale study," in SANER, 2017, pp. 138--147.
[93]
L. Xavier, A. Hora, and M. T. Valente, "Why do we break apis? first answers from developers," in SANER, 2017, pp. 392--396.
[94]
Y. Xi, L. Shen, Y. Gui, and W. Zhao, "Migrating deprecated api to documented replacement: Patterns and tool," in Internetware, 2019, pp. 1--10.
[95]
Z. Xing and E. Stroulia, "Api-evolution support with diff-catchup," IEEE Transactions on Software Engineering, vol. 33, no. 12, pp. 818--836, 2007.
[96]
S. Xu, Z. Dong, and N. Meng, "Meditor: inference and application of api migration edits," in ICPC, 2019, pp. 335--346.
[97]
A. Zerouali, E. Constantinou, T. Mens, G. Robles, and J. González-Barahona, "An empirical analysis of technical lag in npm package dependencies," in ICSR, 2018, pp. 95--110.
[98]
F. Zhang, B. Chen, R. Li, and X. Peng, "A hybrid code representation learning approach for predicting method names," Journal of Systems and Software, vol. 180, 2021.
[99]
W. Zheng, Q. Zhang, and M. Lyu, "Cross-library api recommendation using web search engines," in ESEC/FSE, 2011, pp. 480--483.
[100]
J. Zhou and R. J. Walker, "Api deprecation: a retrospective analysis and detection method for code examples on the web," in FSE, 2016, pp. 266--277.
[101]
M. Zimmermann, C. Staicu, C. Tenny, and M. Pradel, "Small world with high risks: A study of security threats in the npm ecosystem," in USENIX Security, 2019.

Cited By

View all
  • (2024)Magneto: A Step-Wise Approach to Exploit Vulnerabilities in Dependent Libraries via LLM-Empowered Directed FuzzingProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695531(1633-1644)Online publication date: 27-Oct-2024
  • (2024)Effective Vulnerable Function Identification based on CVE Description Empowered by Large Language ModelsProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695013(393-405)Online publication date: 27-Oct-2024
  • (2024)Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be?ACM Transactions on Software Engineering and Methodology10.1145/365444333:6(1-41)Online publication date: 27-Jun-2024
  • Show More Cited By

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
ASE '21: Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering
November 2021
1446 pages
ISBN:9781665403375

Sponsors

In-Cooperation

  • IEEE CS

Publisher

IEEE Press

Publication History

Published: 24 June 2022

Check for updates

Qualifiers

  • Research-article

Conference

ASE '21
Sponsor:

Acceptance Rates

Overall Acceptance Rate 82 of 337 submissions, 24%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)6
  • Downloads (Last 6 weeks)3
Reflects downloads up to 06 Jan 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Magneto: A Step-Wise Approach to Exploit Vulnerabilities in Dependent Libraries via LLM-Empowered Directed FuzzingProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695531(1633-1644)Online publication date: 27-Oct-2024
  • (2024)Effective Vulnerable Function Identification based on CVE Description Empowered by Large Language ModelsProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering10.1145/3691620.3695013(393-405)Online publication date: 27-Oct-2024
  • (2024)Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be?ACM Transactions on Software Engineering and Methodology10.1145/365444333:6(1-41)Online publication date: 27-Jun-2024
  • (2023)Understanding the Threats of Upstream Vulnerabilities to Downstream Projects in the Maven EcosystemProceedings of the 45th International Conference on Software Engineering10.1109/ICSE48619.2023.00095(1046-1058)Online publication date: 14-May-2023

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media