GitHub Security Advisories (GHSA) have become a central component of open-source vulnerability disclosure and are widely used by developers and security tools. A distinctive feature of GHSA is that only a fraction of advisories are reviewed by GitHub, while the mechanisms associated with this review process remain poorly understood. In this paper, we conduct a large-scale empirical study of the GHSA review processes, analyzing over 288,000 advisories spanning 2019-2025. We characterize which advisories are more likely to be reviewed, quantify review delays, and identify two distinct review-latency regimes: a fast path dominated by GitHub Repository Advisories (GRAs) and a slow path dominated by NVD-first advisories. We further develop a queueing model that accounts for this dichotomy based on the structure of the advisory processing pipeline.

Software Product Lines (SPLs) improve time-to-market, enhance software quality, and reduce maintenance costs. Current SPL reengineering practices are largely manual and require domain knowledge. Thus, adopting and, to a lesser extent, maintaining SPLs are expensive tasks, preventing many companies from enjoying their benefits. To address these challenges, we introduce Foundry , an approach utilising software transplantation to reduce the manual effort of SPL adoption and maintenance. Foundry enables integrating features across different codebases, even codebases that are unaware that they are contributing features to a software product line. Each product produced by Foundry is pure code, without variability annotation, unlike feature flags, which eases variability management and reduces code bloat. We realise Foundry in prodScalpel , a tool that transplants multiple organs (i.e., a set of interesting features) from donor systems into an emergent product line for codebases written in C. Given tests and lightweight annotations identifying features and implantation points, prodScalpel automates feature extraction and integration. To evaluate its effectiveness, our evaluation compares feature transplantation using prodScalpel to the current state of practice: on our dataset, prodScalpel ’s use speeds up feature migration by an average of 4.8 times when compared to current practice.

Computational notebooks, such as Jupyter, have been widely adopted by data scientists to write code for analyzing and visualizing data. Despite their growing adoption and popularity, few studies have been found to understand Jupyter development challenges from the practitioners’ point of view. This article presents a systematic study of bugs and challenges that Jupyter practitioners face through a large-scale empirical investigation. We mined 14,740 commits from 105 GitHub open source projects with Jupyter Notebook code. Next, we analyzed 30,416 StackOverflow posts, which gave us insights into bugs that practitioners face when developing Jupyter Notebook projects. Next, we conducted 19 interviews with data scientists to uncover more details about Jupyter bugs and to gain insight into Jupyter developers’ challenges. Finally, to validate the study results and proposed taxonomy, we conducted a survey with 91 data scientists. We highlight bug categories, their root causes, and the challenges that Jupyter practitioners face.

The COVID-19 pandemic is considered as the most crucial global health calamity of the century. It has impacted different business sectors around the world and software development is not an exception. This study investigates the impact of COVID-19 on software projects and software development professionals. We conducted a mining software repository study based on 100 GitHub projects developed in Java using ten different metrics. Next, we surveyed 279 software development professionals for better understanding the impact of COVID-19 on daily activities and wellbeing. We identified 12 observations related to productivity, code quality, and wellbeing. Our findings highlight that the impact of COVID-19 is not binary (reduce productivity versus increase productivity) but rather a spectrum. For many of our observations, substantial proportions of respondents have differing opinions from each other. We believe that more research is needed to uncover specific conditions that cause certain outcomes to be more prevalent.

Change Requests (CRs) are key elements to software maintenance and evolution. Finding the appropriate developer to a CR is crucial for obtaining the lowest, economically feasible, fixing time. Nevertheless, assigning CRs is a labor-intensive and time consuming task. In this paper, we present a semi-automated CR assignment approach which combine rule-based and information retrieval techniques. The approach emphasizes the use of contextual information, essential to effective assignments, and puts the development team in control of the assignment rules, toward making its adoption easier. Results of an empirical evaluation showed that the approach is up to 46,5% more accurate than approaches which rely solely on machine learning techniques.

ABSTRACT Software maintenance starts as soon as the first artifacts are delivered and is essential for the success of the software. However, keeping maintenance activities and their related artifacts on track comes at a high cost. In this respect, change request (CR) repositories are fundamental in software maintenance. They facilitate the management of CRs and are also the central point to coordinate activities and communication among stakeholders. However, the benefits of CR repositories do not come without issues, and commonly occurring ones should be dealt with, such as the following: duplicate CRs, the large number of CRs to assign, or poorly described CRs. Such issues have led researchers to an increased interest in investigating CR repositories, by considering different aspects of software development and CR management. In this paper, we performed a systematic mapping study to characterize this research field. We analyzed 142 studies, which we classified in two ways. First, we classified the studies into different topics and grouped them into two dimensions:challengesandopportunities. Second, the challenge topics were classified in accordance with an existing taxonomy for information retrieval models. In addition, we investigated tools and services for CR management, to understand whether and how they addressed the topics identified. Copyright © 2013 John Wiley & Sons, Ltd.

Cloud accounting refers to how cloud usage is recorded and charged. We identified four federated cloud platforms which do not include an accounting system. This work presents an accounting mechanism implemented for one of these platforms focused on IaaS. Further, we analyse our proposal in a qualitative fashion.

Context: Change Request (CR) repositories play an important role in the software maintenance and evolution process. Through a CR repository, software changes are reported and assigned to developers. Finding the appropriate developer to a CR is crucial for obtaining the lowest, economically feasible, fixing time. Nevertheless, assigning CRs is a labor-intensive and time consuming task. Although many work have proposed automated approaches for CR assignment, they have been implemented without investigating the fundamental aspects which characterize the task itself. Objective: This paper investigates the effort that is taken to assign CR to appropriate developers and identifies the fundamental aspects that characterize it, such as the strategies to perform the assignments and the complexity involved in them. Such investigation improves the current knowledge on the topic, providing researchers and practitioners with useful information towards developing effective solutions. Method: A survey was performed with software developers to understand CR assignment in the Brazilian Federal Organization for Data Processing. The questionnaire was composed of 38 questions, being them both open-ended and closed-ended. We analyzed the answers of 36 respondents. Results: We find that: there is a significant amount of time being spent on assignments (e.g., assigning 20 CRs can take up to 3.3 hours); there are many strategies used to assign CRs, which are complementary to those used in current automated solutions; and CR assignment is very complexity due to a process that requires cognitive abilities for information seeking, communication, and memorization. Conclusion: CR repositories are fundamental to software maintenance, however assigning CRs to developers is an expensive activity. Although we understand that fully and totally accurate automation of assignments is unlikely, further improvements on this direction are feasible and necessary to reduce costs. This way, this paper brings relevant findings to guide new research on automated CR assignment.

Cloud Accounting refers to how cloud usage is recorded and charged. It is present at all commercialized cloud services (SaaS, PaaS and IaaS), since they have to monitor the consumption aiming to charge the customers. In a previous research we performed a systematic mapping study regarding cloud accounting and identified a set of shortcomings in the existing accounting models for IaaS. One of these limitations was related to charging policy specification. Charging policies are mechanisms that establish rules to convert usage records into monetary information. This paper presents a Domain Specific Language (DSL) for charging policy specification: VeloZ. Such DSL enables cloud providers to write charging policies following the economic model RaaS. According to RaaS, the IaaS must be provisioned in a high granularity in terms of resource types and such granularity is profitable for both, provider and customer. We evaluated the DSL under a real cloud platform called JiTCloud. The experiment results evidences that VeloZ can be considered feasible in terms of flexibility and reliability.

Cloud Accounting refers to how cloud usage is recorded and charged. Even in the case of a single cloud provider this task is hard and there is a context which it becomes even worse, known as federated cloud. It happens when a cloud provider dynamically outsources resources to other providers in response to demand variation. In this context, we identified some research addressing this area which developed platforms for federated clouds, however without addressing the accounting requirement. This work presents the Monext, an accounting framework for Infrastructure as a Service, focused on federated clouds. It is based on a standard accounting process, follows a set of principles specified by previous research, and offers a Domain Specific Language (DSL) to define charging policies. We evaluated the framework under a federated cloud platform called JiTCloud. The results provided evidences that Monext can be considered feasible under many aspects, such as flexibility, reliability and efficiency.

Software Product Line (SPL) Engineering focuses on systematic software reuse, which has benefits such as reductions in time-to-market and effort, and improvements in the quality of products. However, establishing a SPL is not a simple matter, and can affect all aspects of the organization, since the approach is complex and involves major investment and considerable risk. These risks can have a negative impact on the expected ROI for an organization, if SPL is not sufficiently managed. This paper presents a mapping study of Risk Management (RM) in SPL Engineering. We analyzed a set of thirty studies in the field. The results points out the need for risk management practices in SPL, due to the little research on RM practices in SPL and the importance of identifying insight on RM in SPL. Most studies simply mention the importance of RM, however the steps for managing risk are not clearly specified. Our findings suggest that greater attention should be given, through the use of industrial case studies and experiments, to improve SPL productivity and ensure its success. This research is a first attempt within the SPL community to identify, classify, and manage risks, and establish mitigation strategies.

Background - Risk Management (RM) practices are usually established towards avoiding or minimizing problems, likely to occur during software development. It can be stated as the task of analyzing and managing the impact of every important action to be performed in the project. Aim - In the context of RM practices, we developed a scoping study, aiming at analyzing the current scenario of RM practices in software development. Method - We analyzed 74 studies published by the most important venues published up to the year 2011. Based on the analyzed dataset, we sketched a set of useful practices for applying RM in software projects. Results - The analysis indicate that most of the studies subjectively describe ways to evaluate risks, instead of providing readers with details on how RM is to be performed. Conclusions - Such findings points out to the need of further research in the field of RM, specially due to its importance for software development projects.

Explicit Risk Management (RM) in Software Product Lines Engineering (SPL) is considered an open question, as posed in literature, and confirmed by industrial practices, unlike Single System Development (SSD), which contains a large set of evidence. The goal of this research is to synthesize the available evidence gathered in previous research, in a form of two scoping studies, which considered RM in SPL and SSD, using the narrative synthesis method. Through the synthesis we could identify common risks to both development paradigm, as well as RM activities and practices most commonly used to apply RM in projects. In addition, was observed that RM to SPL is still an open question if compared to SSD.

Software Product Lines (SPL) adoption can affect several aspects of an organization and it involves significant investment and risk. This way, SPL risk management is a crucial activity of SPL adoption. This study aims to identify SPL risks during the scoping and requirement disciplines to provide information to better understand risk management in SPL. In order to achieve the previous stated goal, a case study research was applied in an industrial project in the medical information management domain. Using the captured risks, a classification scheme was built and risk mitigation strategies were identified. We spent five months, totaling 79 hours, performing risk management (RM) in the scoping discipline and twelve months, totaling 148 hours, performing RM on the requirements discipline. We identified 32 risks during the scoping discipline and 20 risks during the requirements discipline, 14 risks occurred in both disciplines. Some identified risks are not particular to SPL development, however, they have their impact increased due to the SPL characteristic. All the study results and lessons learned are useful for all project managers and researchers who are considering the introduction of SPL risk management in industry or academia.

Context: The benefits of taking a product line approach in order to achieve significant reductions in cost and time to market and, at the same time, increasing the quality has encouraged product line adoption. Objective: In this context, this study focuses on some SPL adoption aspects and has the following goals: investigate state-of-the-art SPL adoption, synthesize available evidence, and identify gaps between required strategies, organizational structures, maturity level and existing adoption barriers, available in the literature. Method: A systematic mapping study was undertaken to analyze the important aspects that should be considered when adopting SPL approaches. A set of four questions were defined in which 34 primary studies were evaluated. Results: A total of 34 primary studies were considered. They reported four different strategies (Incremental, Big Bang, Tactical and Pilot project), however there is insufficient information about how such strategies link to factors as organizational structure and process maturity. By investigating all primary studies we found 23 barriers to adoption. Conclusions: Researchers need to consider the relationships between SPL adoption and factors such as company maturity and organization structure in more detail. There is also a need for patterns to assist in SPL adoption and overcoming SPL adoption barriers.

Abstract Background : Software product lines and Agile methods have been an effective solution for dealing with the growing complexity of software and handling competitive needs of software organizations. They also share common goals, such as improving productivity, reducing time‐to‐market, decreasing development costs and increasing customer satisfaction. There has been growing interest in whether the integration of Agile and SPL could provide further benefits and solve many of the outstanding issues surrounding software development. Objective : This study investigates the state‐of‐the‐art in Agile SPL approaches, while identifying gaps in current research and synthesizing available evidence. It also provides a basis for a deeper understanding of the issues involved in the integration of Agile and SPL. Method : A mapping study was undertaken to analyze the relation between Agile and SPL methods. A set of four research questions were defined in which the 32 primary studies were evaluated. Results : This study provides insights into the integration of Agile and SPL approaches, it identifies the current gaps in the research, synthesize the available evidence and propose specific Agile methods and practices for integration in SPL. Conclusions : In general, few studies describe the underlying Agile principles being adopted by proposed Agile SPL solutions. The most common Agile practices proposed by the studies came from the XP and Scrum methods, particularly in the pro‐active SPL strategy. We identify certain Agile methods that are being overlooked by the Agile SPL community, and propose specific SPL practices areas suitable for adoption of Agile practices. Copyright © 2011 John Wiley & Sons, Ltd.