17 citations · 63 across the 23 of their papers we have counts for
25 papers
DITTO: A Context-aware Pickle-based Pre-Trained Model Scanner for Effective Security Audits
Qiaolin Qin, Wanpeng Li, Benoit Baudry +3
Pre-trained models (PTMs) are widely distributed as serialized binaries, but their reuse often exposes software supply chains to deserialization attacks. Despite the emergence of s…
BreakGuard: Towards Detecting Dependency Breaking Changes with LLM-Generated Tests
Rachna Raj, Benoit Baudry, Diego Elias Costa
Open-source libraries play an important role in software development by providing reusable features that expedite the development process. As libraries evolve, they release new ver…
Art in Humanity's Code
Benoit Baudry, Yogya Gamage, Nadia Gonzalez Fernandez +4
Artist-led open-source libraries such as Processing or openFrameworks have had a major impact on artists and designers who use code as a creative medium. In this work, we conduct t…
Agentic Generation of AST Transformation Rules for Fixing Breaking Updates
Frank Reyes, Benoit Baudry, Martin Monperrus
Modern software projects depend on third-party libraries that evolve continuously, introducing breaking API changes that prevent client code from compiling after a dependency updat…
N-Version Programming with Coding Agents
Javier Ron, Benoit Baudry, Martin Monperrus
This paper revisits the classical concept on N-version programming in the setting of contemporary AI coding agents. Revisiting the seminal Knight-Leveson experiment, we study wheth…
FIKA: Expanding Dependency Reachability with Executability Guarantees
Yogya Gamage, Meriem Ben Chaaben, Martin Monperrus +1
Automated third-party library analysis tools help developers by addressing key dependency management challenges, such as automating version updates, detecting vulnerabilities, and…
Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management
Larissa Schmid, Diogo Gaspar, Raphina Liu +3
Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells…
Project Rachel: Can an AI Become a Scholarly Author?
Martin Monperrus, Benoit Baudry, Clément Vidal
This paper documents Project Rachel, an action research study that created and tracked a complete AI academic identity named Rachel So. Through careful publication of AI-generated…
Maven-Lockfile: High Integrity Rebuild of Past Java Releases
Larissa Schmid, Elias Lundell, Yogya Gamage +2
Modern software projects depend on many third-party libraries, complicating reproducible and secure builds. Several package managers address this with the generation of a lockfile…
Byam: Fixing Breaking Dependency Updates with Large Language Models
Frank Reyes, May Mahmoud, Federico Bono +3
Application Programming Interfaces (APIs) facilitate the integration of third-party dependencies within the code of client applications. However, changes to an API, such as depreca…
The Design Space of Lockfiles Across Package Managers
Yogya Gamage, Deepika Tiwari, Martin Monperrus +1
Software developers reuse third-party packages that are hosted in package registries. At build time, a package manager resolves and fetches the direct and indirect dependencies of…
Causes and Canonicalization of Unreproducible Builds in Java
Aman Sharma, Benoit Baudry, Martin Monperrus
The increasing complexity of software supply chains and the rise of supply chain attacks have elevated concerns around software integrity. Users and stakeholders face significant c…
Software Bills of Materials in Maven Central
Yogya Gamage, Nadia Gonzalez Fernandez, Martin Monperrus +1
Software Bills of Materials (SBOMs) are essential to ensure the transparency and integrity of the software supply chain. There is a growing body of work that investigates the accur…
Dirty-Waters: Detecting Software Supply Chain Smells
Raphina Liu, Sofia Bobadilla, Benoit Baudry +1
Using open-source dependencies is essential in modern software development. However, this practice implies significant trust in third-party code, while there is little support for…
Breaking-Good: Explaining Breaking Dependency Updates with Build Analysis
Frank Reyes, Benoit Baudry, Martin Monperrus
Dependency updates often cause compilation errors when new dependency versions introduce changes that are incompatible with existing client code. Fixing breaking dependency updates…
Galapagos: Automated N-Version Programming with LLMs
Javier Ron, Diogo Gaspar, Javier Cabrera-Arteaga +2
N-Version Programming is a well-known methodology for developing fault-tolerant systems. It achieves fault detection and correction at runtime by adding diverse redundancy into pro…
Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order
Frank Reyes, Federico Bono, Aman Sharma +2
Java projects frequently rely on package managers such as Maven to manage complex webs of external dependencies. While these tools streamline development, they also introduce subtl…
PROZE: Generating Parameterized Unit Tests Informed by Runtime Data
Deepika Tiwari, Yogya Gamage, Martin Monperrus +1
Typically, a conventional unit test (CUT) verifies the expected behavior of the unit under test through one specific input / output pair. In contrast, a parameterized unit test (PU…
SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java
Aman Sharma, Martin Wittlinger, Benoit Baudry +1
Software supply chain attacks have become a significant threat as software development increasingly relies on contributions from multiple, often unverified sources. The code from u…
Detecting and removing bloated dependencies in CommonJS packages
Yuxin Liu, Deepika Tiwari, Cristian Bogdan +1
JavaScript packages are notoriously prone to bloat, a factor that significantly impacts the performance and maintainability of web applications. While web bundlers and tree-shaking…
Serializing Java Objects in Plain Code
Julian Wachter, Deepika Tiwari, Martin Monperrus +1
In managed languages, serialization of objects is typically done in bespoke binary formats such as Protobuf, or markup languages such as XML or JSON. The major limitation of these…
BUMP: A Benchmark of Reproducible Breaking Dependency Updates
Frank Reyes, Yogya Gamage, Gabriel Skoglund +2
Third-party dependency updates can cause a build to fail if the new dependency version introduces a change that is incompatible with the usage: this is called a breaking dependency…
With Great Humor Comes Great Developer Engagement
Deepika Tiwari, Tim Toady, Martin Monperrus +1
The worldwide collaborative effort for the creation of software is technically and socially demanding. The more engaged developers are, the more value they impart to the software t…
Generative AI to Generate Test Data Generators
Benoit Baudry, Khashayar Etemadi, Sen Fang +7
Generating fake data is an essential dimension of modern software testing, as demonstrated by the number and significance of data faking libraries. Yet, developers of faking librar…