GitHub Security Advisories (GHSA) have become a central component of open-source vulnerability disclosure and are widely used by developers and security tools. A distinctive feature of GHSA is that only a fraction of advisories are reviewed by GitHub, while the mechanisms associated with this review process remain poorly understood. In this paper, we conduct a large-scale empirical study of the GHSA review processes, analyzing over 288,000 advisories spanning 2019-2025. We characterize which advisories are more likely to be reviewed, quantify review delays, and identify two distinct review-latency regimes: a fast path dominated by GitHub Repository Advisories (GRAs) and a slow path dominated by NVD-first advisories. We further develop a queueing model that accounts for this dichotomy based on the structure of the advisory processing pipeline.

Abstract Video surveillance has benefited greatly from advances in artificial intelligence, particularly in computer vision, and the number of monitored environments has consequently increased, creating new challenges in extracting relevant information. When multiple cameras cover adjacent areas, overlapping fields of view can cause the same subject to be detected across cameras, introducing duplicate counts. Although the literature offers established solutions, many rely on high-quality recordings and complex, computationally intensive methods, limiting their use on resource-constrained devices. In this work, we address these challenges with a solution that leverages minimal information about target subjects and uses a transductive strategy to detect duplicates based on interactions within overlapping fields of view. Experiments in real-world settings show that our approach suppresses duplicates effectively, making it suitable for deployment on resource-limited hardware. We evaluate state-of-the-art lightweight models with high inference speed, as well as classical re-identification methods, in scenarios with low-quality video and constrained devices. The results underscore the effectiveness of the proposed approach and motivate exploration of re-ID with domain adaptation, as well as anchor-free methods with weak or semi-supervised learning.

Due to limited hardware, consumer-grade surveillance cameras usually rely on cloud-based computer vision models to detect people in video footage. However, this approach introduces a recurring cost, as users must continuously pay for cloud processing. One possible solution is to use mobile devices for person detection, as they can be found in most households. Yet, experimental evaluations on the impact of different computer vision models on mobile device resource usage are limited. This study examines the efficiency of YOLOv8 models on Android devices, assessing detection performance, inference time, memory consumption, and energy efficiency. The models were tested using two machine learning frameworks, LiteRT (formerly TensorFlow Lite) and ONNX Runtime, to determine the most suitable approach for mobile inference. Experimental results confirm that compact models, such as YOLOv8n and YOLOv8s, offer the best trade-off between computational efficiency and detection accuracy, while LiteRT outperforms ONNX in all evaluated metrics.

Smart homes are transforming domestic environments by integrating connected devices and sensors, enabling lighting, temperature, and security automation. While these systems enhance comfort and efficiency, they often rely on predefined settings or manual input due to the absence of adaptive recommendation systems. AI-driven recommendation systems personalize actions by learning from user behavior and environmental data, improving the smart home experience. However, they also introduce cybersecurity risks, particularly data poisoning attacks, where manipulated data disrupts system functionality. This paper exposes and examines vulnerabilities in smart home recommendation systems, categorizing data poisoning attacks and analyzing their impact. Through a literature review and attack vector analysis, we identify key weaknesses and propose mitigation strategies to enhance security. Our goal is to contribute to developing robust smart home technologies that protect user privacy, ensure reliability, and withstand adversarial threats.

The adoption of Large Language Models (LLMs) is reshaping software development as developers integrate these LLMs into their applications. In such applications, prompts serve as the primary means of interacting with LLMs. Despite the widespread use of LLM-integrated applications, there is limited understanding of how developers manage and evolve prompts. This study presents the first empirical analysis of prompt evolution in LLM-integrated software development. We analyzed 1,262 prompt changes across 243 GitHub repositories to investigate the patterns and frequencies of prompt changes, their relationship with code changes, documentation practices, and their impact on system behavior. Our findings show that developers primarily evolve prompts through additions and modifications, with most changes occurring during feature development. We identified key challenges in prompt engineering: only $21.9 \%$ of prompt changes are documented in commit messages, changes can introduce logical inconsistencies, and misalignment often occurs between prompt changes and LLM responses. These insights emphasize the need for specialized testing frameworks, automated validation tools, and improved documentation practices to enhance the reliability of LLM-integrated applications.

Traditionally, energy efficiency research has focused on reducing energy consumption at the hardware level and, more recently, in the design and coding phases of the software development life cycle. However, software testing’s impact on energy consumption did not receive attention from the research community. Specifically, how test code design quality and test smell (e.g., sub-optimal design and bad practices in test code) impact energy consumption has not been investigated yet. This study aims to examine open-source software projects to analyze the association between test smell and its effects on energy consumption in software testing. We conducted a mixed-method empirical analysis from two perspectives; software (data mining in 12 Apache projects) and developers’ views (a survey of 62 software practitioners). Our findings show that: (1) test smell is associated with energy consumption in software testing. Specifically, the smelly part of a test case consumes more energy compared to the non-smelly part. (2) certain test smells are more energy-hungry than others, (3) refactored test cases tend to consume less energy than their smelly counterparts, and (4) most developers (45 % of the survey respondents) lack knowledge about test smells’ impact on energy consumption. Based on the results, we emphasize raising developers awareness regarding the impact of test smells on energy consumption. Additionally we present several observations that can direct future research and developments.

ABSTRACT Context Smart home devices have become increasingly popular in modern households, powered by the Internet of Things (IoT) advances. The data generated by smart devices can provide valuable insights into users' behavior and preferences. By analyzing the data, one can understand how people interact with their homes, thus creating a “smart home profile”. To comprehend the complete IoT ecosystem dynamics of an intelligent environment, it is necessary to learn from each IoT device to predict its status in the future time. Nevertheless, dealing with real‐world IoT data structure requires considerable preprocessing tasks and the employment of classifiers that can learn multiple IoT inputs from a single IoT message. Objective Aware of these challenges, this paper proposes a novel methodology to process multi‐label IoT data and provide a comprehensive comparison of multi‐label classifiers for forecasting the status of smart devices, considering their efficiency and accuracy. Method We propose a data transformation method to preprocess the IoT data to be used by multi‐label classifiers. This method is based on real data structure. Results We evaluate our proposal in two real‐world scenarios and various multi‐label classifiers. The promising findings indicate that efficient classifiers can generate many correct predictions for a comprehensive IoT ecosystem in a small fraction of a second. Conclusions Our proposed data transformation can fit the context of prediction to smart homes and work with multi‐label classifiers to understand user behavior.

Software Product Lines (SPLs) improve time-to-market, enhance software quality, and reduce maintenance costs. Current SPL reengineering practices are largely manual and require domain knowledge. Thus, adopting and, to a lesser extent, maintaining SPLs are expensive tasks, preventing many companies from enjoying their benefits. To address these challenges, we introduce Foundry , an approach utilising software transplantation to reduce the manual effort of SPL adoption and maintenance. Foundry enables integrating features across different codebases, even codebases that are unaware that they are contributing features to a software product line. Each product produced by Foundry is pure code, without variability annotation, unlike feature flags, which eases variability management and reduces code bloat. We realise Foundry in prodScalpel , a tool that transplants multiple organs (i.e., a set of interesting features) from donor systems into an emergent product line for codebases written in C. Given tests and lightweight annotations identifying features and implantation points, prodScalpel automates feature extraction and integration. To evaluate its effectiveness, our evaluation compares feature transplantation using prodScalpel to the current state of practice: on our dataset, prodScalpel ’s use speeds up feature migration by an average of 4.8 times when compared to current practice.

Software Quality Assurance (SQA) Engineers play a critical role in evaluating products throughout the software development lifecycle to ensure that the outcomes of each phase and the final product possess the desired quality standards. In general, a great SQA engineer requires a different set of abilities from development engineers to effectively oversee the entire product development process. While recent empirical studies have explored the attributes of software engineers and managers, the quality assurance role is overlooked. As software quality gains increasing priority in the development cycles, both employers seeking skilled professionals and new graduates aspiring to excel in Software Quality Assurance (SQA) roles face a critical question: What makes a great SQA Engineer? To address this gap, we conducted 25 semi-structured interviews and surveyed 363 SQA engineers from diverse companies worldwide. We use the data collected from these activities to derive a comprehensive set of attributes for great SQA Engineers, categorized into five key areas: personal, social, technical, management, and decision-making attributes. Among these, curiosity, effective communication, and critical thinking emerged as defining characteristics of great SQA engineers. These findings offer valuable insights for future research with SQA practitioners, contextual considerations, and practical implications for research and practice.

Computational notebooks, such as Jupyter, have been widely adopted by data scientists to write code for analyzing and visualizing data. Despite their growing adoption and popularity, few studies have been found to understand Jupyter development challenges from the practitioners’ point of view. This article presents a systematic study of bugs and challenges that Jupyter practitioners face through a large-scale empirical investigation. We mined 14,740 commits from 105 GitHub open source projects with Jupyter Notebook code. Next, we analyzed 30,416 StackOverflow posts, which gave us insights into bugs that practitioners face when developing Jupyter Notebook projects. Next, we conducted 19 interviews with data scientists to uncover more details about Jupyter bugs and to gain insight into Jupyter developers’ challenges. Finally, to validate the study results and proposed taxonomy, we conducted a survey with 91 data scientists. We highlight bug categories, their root causes, and the challenges that Jupyter practitioners face.

The whiteboard plays a crucial role in the day-to-day lives of software architects, as they frequently will organize meetings at the whiteboard to discuss a new architecture, some proposed changes to an existing architecture, a mismatch between a prescribed architecture and its code, and more. While much has been studied about software architects, the architectures they produce, and how they produce them, a detailed understanding of these whiteboards meetings is still lacking. In this paper, we contribute a mixed-methods study involving semi-structured interviews and a subsequent survey to understand the perceptions of software architects on whiteboard architecture meetings. We focus on four aspects: (1) why do they hold these meetings, (2) what is the impact of the experience levels of the participants in these meetings, (3) how do the architects document the meetings, and (4) what kinds of changes are made in downstream activities to the work produced after the meetings have concluded? In studying these aspects, we identify eleven observations related to both technical aspects and social aspects of the meetings. These insights have implications for further research, offer concrete advice to practitioners, and suggest ways of educating future software architects.

The COVID-19 pandemic is considered as the most crucial global health calamity of the century. It has impacted different business sectors around the world and software development is not an exception. This study investigates the impact of COVID-19 on software projects and software development professionals. We conducted a mining software repository study based on 100 GitHub projects developed in Java using ten different metrics. Next, we surveyed 279 software development professionals for better understanding the impact of COVID-19 on daily activities and wellbeing. We identified 12 observations related to productivity, code quality, and wellbeing. Our findings highlight that the impact of COVID-19 is not binary (reduce productivity versus increase productivity) but rather a spectrum. For many of our observations, substantial proportions of respondents have differing opinions from each other. We believe that more research is needed to uncover specific conditions that cause certain outcomes to be more prevalent.

Source code quality plays a key role in software quality mainly due to its impact on software maintainability. Software engineers have been using source code metrics to support them to assess source code quality. Source code metrics quantify different source code characteristics. However, source code metric analysis still involves subjectivity. For instance, it is not trivial to decide whether a metric value is high or low. To reduce the eventual subjectivity of source code metrics analysis, several researchers are using Machine Learning algorithms. Therefore, in this paper, we designed a Fuzzy-based approach to extract characteristics and patterns present in source code versioning repositories in order to: i) assist the specialist in the interpretation of releases, especially when working with large volumes of source code; ii) from the release interpretation, specialists can improve the quality of the source code; and iii) monitor the evolution of the software as new releases are submitted to the repositories. We evaluated the proposed approach with the Linux Test Project repository, emphasizing the interpretability of large source code versioning repositories.

Bugs that persist into releases of video games can have negative impacts on both developers and users, but particular aspects of testing in game development can lead to difficulties in effectively catching these missed bugs. It has become common practice for developers to apply updates to games in order to fix missed bugs. These updates are often accompanied by notes that describe the changes to the game included in the update. However, some bugs reappear even after an update attempts to fix them. In this paper, we develop a taxonomy for bug types in games that is based on prior work. We examine 12,122 bug fixes from 723 updates for 30 popular games on the Steam platform. We label the bug fixes included in these updates to identify the frequency of these different bug types, the rate at which bug types recur over multiple updates, and which bug types are treated as more severe. Additionally, we survey game developers regarding their experience with different bug types and what aspects of game development they most strongly associate with bug appearance. We find that Information bugs appear the most frequently in updates, while Crash bugs recur the most frequently and are often treated as more severe than other bug types. Finally, we find that challenges in testing, code quality, and bug reproduction have a close association with bug persistence. These findings should help developers identify which aspects of game development could benefit from greater attention in order to prevent bugs. Researchers can use our results in devising tools and methods to better identify and address certain bug types.

In highly configurable systems, features may interact unexpectedly and produce faulty behavior. Those faults are not easily identified from the analysis of each feature separately, especially when feature specifications are missing. We propose VarXplorer, a dynamic and iterative approach to detect suspicious interactions. It provides information on how features impact the control and data flow of the program. VarXplorer supports developers with a graph that visualizes this information, mainly showing suppress and require relations between features. To evaluate whether VarXplorer helps improve the performance of identifying suspicious interactions, we perform a controlled study with 24 subjects. We find that with our proposed feature-interaction graphs, participants are able to identify suspicious interactions more than 3 times faster compared to the state-of-the-art tool.

Software Product Line (SPL) engineering is a paradigm for the development of a family of products based on the systematic reuse of artifacts. Although its increasing adoption, organizations often start with a single system and use ad-hoc techniques such as clone-and-own to create new systems by performing small changes and adaptations to meet customers' needs. However, as the number of clones raises over time, it becomes a hard task to maintain and support all the systems. This scenario happened in the Apo-Games projects and adopting SPL Engineering can address these issues. Product Line Architecture (PLA) is one of the key assets to allow the success of SPL development. In this paper, we apply our approach to recover the PLA of the Apo-Games projects by using the source code of a set of Android and Java clones. We provide a set of information to support the development of the Apo-Games SPL. We identified that the Android and Java projects have similar PLAs.

Context. Software Product Lines (SPL) engineering is increasingly being applied to handle variability in industrial software systems. Problem. The research community has pointed out a series of benefits which modularity brings to software composition, a key aspect in SPL engineering. However, in practice, the reuse in Javascript-based systems relies on the use of package managers (e.g., npm, jam, bower, requireJS), but these approaches do not allow the management of project features. Method. This paper presents the RiPLE-HC, a strategy aimed at blending compositional and annotative approaches to implement variability in Javascript-based systems. Results. We applied the approach in an industrial environment and conducted an academic case study with six open-source systems to evaluate its robustness and scalability. Additionally, we carried a controlled experiment to analyze the impact of the RiPLE-HC code organization on the feature location maintenance tasks. Conclusion. The empirical evaluations yielded evidence of reduced effort in feature location, and positive benefits when introducing systematic reuse aspects in Javascript-based systems.

With the ever increasing popularity of JavaScript in different domains to build bigger and more complex software systems, variability management may be deemed as an affordable strategy. In this sense, Software Product Lines (SPL) engineering is one of the most successful paradigms to accomplish the necessary modularity and systematic reuse of code artifacts for that purpose. In previous work, we present tool support to hybrid composition of JavaScript-based product lines, called RiPLE-HC, which we now extend to incorporate a means to deal with feature interactions and feature annotation scattering in a more smooth way. The proposed tool support may provide practitioners with an easy-to-use approach to implement crosscutting features by increasing the awareness of the developers about the features implementation.

Context. Software Product Lines (SPL) has become one of the most prominents way to promote the systematic reuse of software artifacts. Like any other piece of software, with the SPL aging, it becomes necessary to manage their evolution. However, in this process, engineers might introduce divergences among the SPL artifacts. Thus, a number of initiatives address the management of such inconsistencies. Objective. In this paper, we mapped the existing approaches to inconsistency management within SPL. Method. We used the systematic mapping study methodology. Results. We classified and performed a characterization of the approaches found, which we mangaged to arrange in three main categories. Most papers selected proposed new methods as solution research. Besides, there is still a need for validation and evaluation studies. Conclusion. We identified a lack of support for a number of activities of consistency assurance. For instance, no paper addressed the tracking of findings, decisions, and actions, as well as, few papers describing either the handling or a management policy for identified inconsistencies.

In the Brazilian software development scenario, most software development companies focus on building products in the same business domain.However, they tend to perform adhoc reuse practices and show interest on the adoption of agile methods.However, the combination of systematic reuse activities and agile practices is not trivial.In this paper, we present a lightweight domain analysis process called RiSE-DA by describing its activities, tasks, roles, and artifacts of the process.This process is evaluated through two case studies performed in companies with different sizes, constraints, and business knowledge.As results, we can conclude the proposed process provides a set of comprehensive domain assets and addresses management problems such as poor feedback, adaptability, and iterativeness.

Change Requests (CRs) are key elements to software maintenance and evolution. Finding the appropriate developer to a CR is crucial for obtaining the lowest, economically feasible, fixing time. Nevertheless, assigning CRs is a labor-intensive and time consuming task. In this paper, we present a semi-automated CR assignment approach which combine rule-based and information retrieval techniques. The approach emphasizes the use of contextual information, essential to effective assignments, and puts the development team in control of the assignment rules, toward making its adoption easier. Results of an empirical evaluation showed that the approach is up to 46,5% more accurate than approaches which rely solely on machine learning techniques.

Variability Management (VM) is a key practice in the development of variant-rich systems. Over the years, attention has been paid to VM approaches adopted by traditional software product lines. The increasing demand for dynamic and highly configurable systems, however, calls for a closer look at the approaches used to develop these systems. We therefore conducted a survey with practitioners from organizations developing variant-rich systems in order to characterize the state of the practice. We also wanted to identify factors that might influence the adoption of specific VM approaches as well as the perception of problems/difficulties posed by those. We analyzed the answers of 31 respondents from thirteen countries and found that there is a correlation between the business domain and the adopted VM approaches. With regard to the problems/difficulties, the difficulty of assuring the quality of maintenance due to the explosion of dependencies was a major issue. This paper reports on relevant findings that could help companies to better understand their problems and researchers to design new/improved solutions.

The goal of this research is to understand the various dimensions along which the architectures in an ecosystem should scale to support successful software-intensive products. We used a case study approach in which we first identified characteristics of scalability from the research literature and then examined ecosystems to determine the extent to which their primary architectures possessed these characteristics. We also examined the architectures of the platform extensions. We found that each architecture exhibited those characteristics although through different mechanisms and to different degrees.

ABSTRACT Software maintenance starts as soon as the first artifacts are delivered and is essential for the success of the software. However, keeping maintenance activities and their related artifacts on track comes at a high cost. In this respect, change request (CR) repositories are fundamental in software maintenance. They facilitate the management of CRs and are also the central point to coordinate activities and communication among stakeholders. However, the benefits of CR repositories do not come without issues, and commonly occurring ones should be dealt with, such as the following: duplicate CRs, the large number of CRs to assign, or poorly described CRs. Such issues have led researchers to an increased interest in investigating CR repositories, by considering different aspects of software development and CR management. In this paper, we performed a systematic mapping study to characterize this research field. We analyzed 142 studies, which we classified in two ways. First, we classified the studies into different topics and grouped them into two dimensions:challengesandopportunities. Second, the challenge topics were classified in accordance with an existing taxonomy for information retrieval models. In addition, we investigated tools and services for CR management, to understand whether and how they addressed the topics identified. Copyright © 2013 John Wiley & Sons, Ltd.

Context: Change Request (CR) repositories play an important role in the software maintenance and evolution process. Through a CR repository, software changes are reported and assigned to developers. Finding the appropriate developer to a CR is crucial for obtaining the lowest, economically feasible, fixing time. Nevertheless, assigning CRs is a labor-intensive and time consuming task. Although many work have proposed automated approaches for CR assignment, they have been implemented without investigating the fundamental aspects which characterize the task itself. Objective: This paper investigates the effort that is taken to assign CR to appropriate developers and identifies the fundamental aspects that characterize it, such as the strategies to perform the assignments and the complexity involved in them. Such investigation improves the current knowledge on the topic, providing researchers and practitioners with useful information towards developing effective solutions. Method: A survey was performed with software developers to understand CR assignment in the Brazilian Federal Organization for Data Processing. The questionnaire was composed of 38 questions, being them both open-ended and closed-ended. We analyzed the answers of 36 respondents. Results: We find that: there is a significant amount of time being spent on assignments (e.g., assigning 20 CRs can take up to 3.3 hours); there are many strategies used to assign CRs, which are complementary to those used in current automated solutions; and CR assignment is very complexity due to a process that requires cognitive abilities for information seeking, communication, and memorization. Conclusion: CR repositories are fundamental to software maintenance, however assigning CRs to developers is an expensive activity. Although we understand that fully and totally accurate automation of assignments is unlikely, further improvements on this direction are feasible and necessary to reduce costs. This way, this paper brings relevant findings to guide new research on automated CR assignment.

Software Product Line (SPL) Engineering focuses on systematic software reuse, which has benefits such as reductions in time-to-market and effort, and improvements in the quality of products. However, establishing a SPL is not a simple matter, and can affect all aspects of the organization, since the approach is complex and involves major investment and considerable risk. These risks can have a negative impact on the expected ROI for an organization, if SPL is not sufficiently managed. This paper presents a mapping study of Risk Management (RM) in SPL Engineering. We analyzed a set of thirty studies in the field. The results points out the need for risk management practices in SPL, due to the little research on RM practices in SPL and the importance of identifying insight on RM in SPL. Most studies simply mention the importance of RM, however the steps for managing risk are not clearly specified. Our findings suggest that greater attention should be given, through the use of industrial case studies and experiments, to improve SPL productivity and ensure its success. This research is a first attempt within the SPL community to identify, classify, and manage risks, and establish mitigation strategies.

Companies around the world routinely distribute their software development across different sites. Students, however, rarely get a chance to learn the potential problems that arise, and the potential solutions to those problems, when conducting distributed development. It is especially difficult to simulate the situation for students when development is distributed across time zones and cultures. We have developed a course that requires teams of students at widely separated universities to collaborate with each other to complete a software development project. Instances of the course have been presented four times using combinations of five different universities, and we are seeking to create a larger pool of universities interested in and capable of presenting it. This paper discusses our goals, the characteristics of the course and the results of teaching it, with a primary result that all the universities want to and will offer the course again.

Background - Risk Management (RM) practices are usually established towards avoiding or minimizing problems, likely to occur during software development. It can be stated as the task of analyzing and managing the impact of every important action to be performed in the project. Aim - In the context of RM practices, we developed a scoping study, aiming at analyzing the current scenario of RM practices in software development. Method - We analyzed 74 studies published by the most important venues published up to the year 2011. Based on the analyzed dataset, we sketched a set of useful practices for applying RM in software projects. Results - The analysis indicate that most of the studies subjectively describe ways to evaluate risks, instead of providing readers with details on how RM is to be performed. Conclusions - Such findings points out to the need of further research in the field of RM, specially due to its importance for software development projects.

Software Product Lines (SPL) adoption can affect several aspects of an organization and it involves significant investment and risk. This way, SPL risk management is a crucial activity of SPL adoption. This study aims to identify SPL risks during the scoping and requirement disciplines to provide information to better understand risk management in SPL. In order to achieve the previous stated goal, a case study research was applied in an industrial project in the medical information management domain. Using the captured risks, a classification scheme was built and risk mitigation strategies were identified. We spent five months, totaling 79 hours, performing risk management (RM) in the scoping discipline and twelve months, totaling 148 hours, performing RM on the requirements discipline. We identified 32 risks during the scoping discipline and 20 risks during the requirements discipline, 14 risks occurred in both disciplines. Some identified risks are not particular to SPL development, however, they have their impact increased due to the SPL characteristic. All the study results and lessons learned are useful for all project managers and researchers who are considering the introduction of SPL risk management in industry or academia.

The combination of service-orientation and software product line engineering, called Service-Oriented Product Line Engineering (SOPLE) have received attention by researchers and practitioners in the last years, and these areas can address issues of each other. One service-orientation issue is service identification. It consists of determining candidate services to a service-oriented environment based on pre-existing software artifacts, e.g., business process, source code, and so on. In order to provide a systematic identification of services, there are many available service identification methods in the literature, regarding different understanding of services, goals, and techniques. Due to this heterogeneity, this paper presents an in-depth comparison of service identification methods as well as a recommendation of the most suitable ones in the SOPLE context. This work can help the decision making of the most suitable method according to stakeholders' needs.

Context: The benefits of taking a product line approach in order to achieve significant reductions in cost and time to market and, at the same time, increasing the quality has encouraged product line adoption. Objective: In this context, this study focuses on some SPL adoption aspects and has the following goals: investigate state-of-the-art SPL adoption, synthesize available evidence, and identify gaps between required strategies, organizational structures, maturity level and existing adoption barriers, available in the literature. Method: A systematic mapping study was undertaken to analyze the important aspects that should be considered when adopting SPL approaches. A set of four questions were defined in which 34 primary studies were evaluated. Results: A total of 34 primary studies were considered. They reported four different strategies (Incremental, Big Bang, Tactical and Pilot project), however there is insufficient information about how such strategies link to factors as organizational structure and process maturity. By investigating all primary studies we found 23 barriers to adoption. Conclusions: Researchers need to consider the relationships between SPL adoption and factors such as company maturity and organization structure in more detail. There is also a need for patterns to assist in SPL adoption and overcoming SPL adoption barriers.

Abstract Background : Software product lines and Agile methods have been an effective solution for dealing with the growing complexity of software and handling competitive needs of software organizations. They also share common goals, such as improving productivity, reducing time‐to‐market, decreasing development costs and increasing customer satisfaction. There has been growing interest in whether the integration of Agile and SPL could provide further benefits and solve many of the outstanding issues surrounding software development. Objective : This study investigates the state‐of‐the‐art in Agile SPL approaches, while identifying gaps in current research and synthesizing available evidence. It also provides a basis for a deeper understanding of the issues involved in the integration of Agile and SPL. Method : A mapping study was undertaken to analyze the relation between Agile and SPL methods. A set of four research questions were defined in which the 32 primary studies were evaluated. Results : This study provides insights into the integration of Agile and SPL approaches, it identifies the current gaps in the research, synthesize the available evidence and propose specific Agile methods and practices for integration in SPL. Conclusions : In general, few studies describe the underlying Agile principles being adopted by proposed Agile SPL solutions. The most common Agile practices proposed by the studies came from the XP and Scrum methods, particularly in the pro‐active SPL strategy. We identify certain Agile methods that are being overlooked by the Agile SPL community, and propose specific SPL practices areas suitable for adoption of Agile practices. Copyright © 2011 John Wiley & Sons, Ltd.

In order to attend the industry needs, it is necessary to provide more practical issues of real software development in the academic curricula. This paper describes an educational experience in a post-graduation course at Federal University of Pernambuco, Brazil, involving software reuse. The course's goals were to provide the state-of-the-art of software development with reuse, and the state-of-the-practice developing the Software Product Line (SPL) approach based on a real project. Moreover, we describe the SPL process steps and the educational methodology applied, as well as the projectpsilas difficulties and lessons learned, along with possible improvements for the course extracted from studentspsila feedback during the course and the project. We also expect that this work can be used as a reference material for other universities planning on teaching software reuse or SPL courses.

A repository is a necessary prerequisite to support software engineers and other users in the process of developing software for and with reuse. In the literature, there are several works that explore reuse repositories, however their focus is mostly on reusable component search and retrieval issues, while important aspects of reuse repositories have not been properly explored. On the other hand, some questions raised by companies that desire to adopt or build a reuse repository remain unanswered. Motivated by these questions, this paper presents the specification, design and implementation of a reuse repository that was successfully constructed and deployed in real Brazilian software factories.

Since the first works involving software reuse, domain engineering is considered a key process to develop reusable and flexible software. However, the results have shown that there is still much to do before the vision of domain engineering is completely achieved. Among the reasons for this problem, we may highlight the lack of a process to support the design of domain-specific software architectures. This paper presents such an approach, based on a well defined set of principles, guidelines and metrics.

Software engineering and reuse-oriented tools have been studied along the last years, aiming to provide help in the software development. With the importance of reuse growing significantly, effective software reuse tools and environments started to be needed. This paper presents and discusses some works that comprise many issues related to source code search tools, covered by university and industry since 90's until today. In the end of the paper, a set of requirements is presented, integrating the features that can be found in most works of the area, serving as a basis for future work toward an effective source code search tool.

A fundamental premise for any type of reuse is the knowledge about the existence of the object to be reused. Such knowledge may already be available, for example, due to the past experience of the subject of the reuse action or may be obtained through knowledge dissemination. Information retrieval is a key mechanism for allowing a uniform dissemination of the knowledge about available reusable objects.The instantiation of this problem to the software reuse field is the subject of this work. The synergy among the software reuse and information retrieval fields is exploited in the formulation, implementation and evaluation of an integrated environment that aims at promoting a greater reuse activity level on the quest for developing software with better quality while consuming fewer resources.

In spite of recent and constant researches in the component-based development (CBD) area, there is still a lack of patterns, approaches and methodologies that effectively support the development "for reuse" as much as "with reuse". Considering the accelerated growth of the Internet over the last decade, where distribution has become an essential non-functional requirement of most applications, the problem becomes bigger. This paper proposes an incremental approach that integrates the concepts of component-based software engineering (CBSE), frameworks, patterns, and distribution. An experimental study evaluates the viability of using the approach and the impact of applying it in development projects