With the accelerated development of software, developers face the continuous challenge of fixing vulnerabilities but vulnerability-fixing commits often disassociated from the vulnerabilities, and the structural and semantic differences between code changes and natural language present significant challenges in identifying these commits. Existing approaches utilize machine learning and deep learning techniques to address this problem, but they often do not fully leverage the information about code changes. In this paper, we propose VFProber, a method based on a code change pretrained model, aiming to provide a comprehensive and unified framework for identifying vulnerability-fixing commits. VFProber uses semantic adjustment to distinguish between context-sensitive and context-insensitive code units in code changes, thereby enhancing the model’s understanding of code changes during the training process. Secondly, VFProber employs a novel code change pretrained model as a feature extractor. Compared with ordinary code pretrained models, it can better meet the requirements of the vulnerability-fixing identification task. Moreover, we constructed a vulnerability-fixing dataset containing two common programming languages, Java and JavaScript, from industrial projects. In the experimental section, we designed three tasks to evaluate the method. The results show that, compared with the best baseline, VFProber performs better in the vulnerability-fixing identification task and can effectively reduce false positives and false negatives.

This study investigates the relationship between code similarity and open-source license compatibility in Java projects. While the extensive use of open-source projects promotes code reuse, it also poses challenges concerning license compatibility. Current license detection methods often overlook code similarities and the degree of sharing among projects. To address these issues, we pave a new research path in the field of license compatibility, with a particular focus on the correlation between code similarity and license compatibility. Unlike traditional methods that focus on individual projects, this research offers a comprehensive approach that identifies potential license compatibility issues both within and across multiple projects. Our analysis employs the BigCloneBench (BCB) dataset and conducts a large-scale empirical study on 746,048 Java open-source projects, which we collected and labeled as OJW. Findings indicate that 11.9% of multi-license projects face compatibility issues, while 23.7% of project pairs with over 70% code similarity demonstrate license incompatibility. This innovative approach not only overcomes the limitations of existing research but also provides developers with a practical tool to reduce legal risks during code reuse, ensuring compliance in open-source software.

To promptly identify software defects and prevent defective code changes from being integrated into the repository, Just-In-Time Software Defect Prediction (JIT-SDP) has demonstrated promising research findings. Recent studies have begun to utilize Pre-trained Models (PTMs) for training and prediction, yet these models inherently impose input length limitations, leading to forced truncation of inputs. However, previous work has largely overlooked the impact of forced truncation, even though it may inadvertently discard critical input information, leading to degraded model performance. Moreover, some existing methods fail to maintain consistency in truncation during each model construction process, leading to unexplainable truncations and unstable model performance. In addition, previous datasets suffer from limitations and incompleteness. To this end, we construct a large-scale and comprehensive dataset, MC4Defect. Moreover, we propose JIT-Align, which prioritizes code changes within a commit using a semantic alignment algorithm to make full use of the limited input space of PTMs. To evaluate the feasibility of JIT-Align, we first assess the classification capability of our method by comparing it against four baselines across five datasets. Then, we conduct ablation studies on the proposed semantic alignment framework to validate its effectiveness. Experimental results show that JIT-Align, along with its semantic alignment framework, outperforms all baselines in JIT-SDP tasks, with average F1 score improvements of 3.1%-9.6% and MCC increases of 3.1%-9.7% across all projects, exhibiting higher stability and better interpretability compared to alternative approaches.

ABSTRACT Automatic code summarization refers to generating concise natural language descriptions for code snippets. It is vital for improving the efficiency of program understanding among software developers and maintainers. Despite the impressive strides made by deep learning‐based methods, limitations still exist in their ability to understand and model semantic information due to the unique nature of programming languages. We propose two methods to boost code summarization models: context‐based abbreviation expansion and unigram language model‐based subword segmentation. We use heuristics to expand abbreviations within identifiers, reducing semantic ambiguity and improving the language alignment of code summarization models. Furthermore, we leverage subword segmentation to tokenize code into finer subword sequences, providing more semantic information during training and inference, thereby enhancing program understanding. These methods are model‐agnostic and can be readily integrated into existing automatic code summarization approaches. Experiments conducted on two widely used Java code summarization datasets demonstrated the effectiveness of our approach. Specifically, by fusing original and modified code representations into the Transformer model, our Semantic Enhanced Transformer for Code Summarizsation (SETCS) serves as a robust semantic‐level baseline. By simply modifying the datasets, our methods achieved performance improvements of up to 7.3%, 10.0%, 6.7%, and 3.2% for representative code summarization models in terms of BLEU‐4 , METEOR , ROUGE‐L and SIDE , respectively.