Understanding When to Adapt a Library:
A Case Study on ASF Projects
Akinori Ihara
Paula Gaikovina
Kula
Kenichi MatsumotoDaiki Fujibayashi Hirohiko Suwa
http://akinori-ihara.jpn.org/
akinori-i@is.naist.jp
2
Many libraries in Github
https://psap.library.illinois.edu/advanced-help/av-film
3
Some software libraries projects
often release new version
2002 200820062004
New version
4
Which release version is
better for us?
2002 200820062004
http://www.365lessthings.com/the-answer-is-invariably-in-the-question/
5
The newest version will have
a good function … but …
Beta version
New functions
…
…
New bugs
Stable
Reliable
OLD NEW
https://ameblo.jp/mzspeed-zeus/entry-12120621233.html
http://www.autofacil.es/toyota/2016/09/14/toyota-fcv-plus-nuevo-
coche-pila-combustible-salon-paris/34416.html
http://info.methodtestprep.com/blog/old-sat-to-new-sat-to-act-
score-converter
6
The latest version is not always
better than previous version
A rapid-release software
often delay bug-fixes
[Costa et al., ICSME2015]
http://www.medicalpracticeinsider.com/best-practices/
compliance/technology/patient-care/professional-development/
cms-reminds-eps-complete
7
Not all projects use the latest
version?
Numberofclients
Ver.1.2.14
Ver.1.2.16
Ver.1.2.17Log4j
Some client users don’t adapt new version!
Time
Library usage by clients over time
8Time
Not all projects use the latest
version?
Numberofclients
Ver.1.2.14
Ver.1.2.16
Ver.1.2.17Log4j
Some client users don’t move to new version
soon after the release!
Library usage by clients over time
Ver.1.2.17
released
9
Client users may wait that
the library become stable.
Long adapting time
Some libraries are not adapted
soon after the release.
[Raula et al., SANER’17]
Numberofclientusers
Time
Trend
https://movingtowardsthelight.com/2016/09/20/waiting/
10
Client users may wait that
the library become stable.
Adapting time
Some libraries are not adapted
soon after the release.
[Raula et al., SANER’17]
Numberofclientusers
Time
TREND
Which version and when do
client users adapt a library?
11
RQ1:
When do client users
adapt a library?
RQ2:
Do client users select
the latest version?
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?
LIBRARY
Latest?Success?
12
415 projects using
MAVEN dependency tool
Target projects and libraries
POM POM
POM
POM POM
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j<artifactId>
<version>1.2</version>
</dependency>
Rank Library Num
1 junit 305
2 commons-logging 167
3 log4j 153
4 slf4j-api 145
5 commons-lang 130
6 commons-io 122
7 slf4j-log4j12 109
8 servlet-api 99
9 commons-collections 98
10 commons-codec 96
11 commons-httpclient 83
12 guava 81
13 ant 73
14 xercesImpl 69
15 jetty-server 68
Rank Library Num
16 easymock 67
17 jackson-mapper-asl 60
18 commons-cli 55
19 jackson-core-asl 53
20 mail 53
21 velocity 52
22 jcl—over-slf4j 52
23 mockito--all 52
. . .
. . .
. . .
. . .
. . .
. . .
4815 Axis2-transports 1
Trend Library List
13
Each box plot presents the distribution of
the period between releases
Release cycle of 23 libraries
months ~ years
0
500
1000
1500
2000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
releasecycle[days]
0
500
1000
1500
2000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
releasecycle[days]
14
Release cycle of 23 libraries
months ~ years
0
500
1000
1500
2000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
releasecycle[days]
0
500
1000
1500
2000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
releasecycle[days]
Observation1: Trendy libraries are
not released in one year
Late-released
libraries
Quick-release
libraries
15
Release cycle of 23 libraries
months ~ years
0
500
1000
1500
2000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
releasecycle[days]
0
500
1000
1500
2000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
releasecycle[days]
Observation 2: 

Mature projects release >= 1year
Young projects often release <= 3 months
Quick-release
libraries
Late-released
libraries
long-history projects
(more than 10 years)
short-history projects
(less than 10 years)
16
RQ1:
When do client users
adapt a library? LIBRARY
RQ2:
Do client users select
the latest version? Latest?
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
17
RQ1:
When do client users
adapt a library? LIBRARY
Adapting time
long-release library
quick-release library
Client user
18
RQ1:
When do client users
adapt a library? LIBRARY
0
1000
2000
3000
4000
5000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
adoptedtime[days]
Each box plot presents the distribution
of the adapted time
Quick-release
libraries
Late-release
libraries
Observation 3:
Adopted the quick-release libraries soon after the release
NOT adopted the long-release libraries as quickly.
19
RQ2:
Do client users select
the latest version? Latest?
RQ1:
When do client users
adapt a library? LIBRARY
Client users tend
to adapt rapid-
release library
quickly.
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
20
0
25
50
75
100
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
ail
easym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4jguava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
Previous
version
Latest
Version
Observation 3:
Client users do not always adopt
the latest library versions.
Quick-release
libraries
Late-release
libraries
RQ2:
Do client users select
the latest version? Latest?
21
0
25
50
75
100
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
ail
easym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4jguava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
Ver.1.2 is trendy version. Most client users
choose before the next release.
Quick-release
libraries
Late-release
libraries
RQ2:
Do client users select
the latest version? Latest?
Previous
version
Latest
Version
22
0
25
50
75
100
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
ail
easym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4jguava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
Quick-release
libraries
Late-release
libraries
Ver. 2.4 and Ver.2.5 are still trendy version
after releasing next version.
RQ2:
Do client users select
the latest version? Latest?
Previous
version
Latest
Version
23
0
25
50
75
100
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
ail
easym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4jguava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
Quick-release
libraries
Late-release
libraries
Ver.6.1.26 is trendy version after releasing
next many versions.
RQ2:
Do client users select
the latest version? Latest?
Previous
version
Latest
Version
24
RQ2:
Do client users select
the latest version? Latest?
Client users are
l e s s l i k e l y t o
adopt the latest
library versions.
RQ1:
When do client users
adapt a library? LIBRARY
Client users are
m o r e l i k e l y t o
adapt the quick-
release libraries.
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
25
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
Downgrade the version
26
Latest?
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
Automatic clustering for grouping of libraries
using Scott-Knott approach based on their release cycles
Latest?
0
500
1000
1500
2000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
releasecycle[days]
C2C1 C3 C4 C5 C6
Quick-release
libraries
Late-release
libraries
27
0
1000
2000
3000
4000
5000
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
aileasym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4j
guava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
adoptedtime[days]
0
25
50
75
100
com
m
ons−cli
servlet−api
com
m
ons−logging
com
m
ons−collections
com
m
ons−codec
com
m
ons−io
m
ail
easym
ock
com
m
ons−lang
junit
xercesIm
plvelocity
ant
log4jguava
com
m
ons−httpclientslf4j−api
slf4j−log4j12
jcl−over−slf4j
m
ockito−all
jackson−core−asl
jackson−m
apper−asl
jetty−server
Graph is from RQ2.
Latest
Previous
Quick-release
libraries
Late-release
libraries
C2C1 C3 C4 C5 C6
26.1%
72.5% 41.0%
33.7% 37.1% 34.4%
32.7% 28.8% 26.9%
24.6% 28.5%
0%
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
Percentage of downgrade
Late-release libraries tend to go downgrade to the
previous version after adapting the latest version!
28
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
C l i e n t u s e r s
s e l e c t i n g t h e
latest version are
less likely to be
successful.
RQ2:
Do client users select
the latest version? Latest?
RQ1:
When do client users
adapt a library? LIBRARY
Client users are
l e s s l i k e l y t o
adopt the latest
library versions.
Client users are
m o r e l i k e l y t o
adapt the quick-
release libraries.
29
Key suggestion
OLD NEW
We should be careful to adapt the latest version!
Especially, if we use a library with long-release.
http://akinori-ihara.jpn.org/
akinori-i@is.naist.jp
Akinori Ihara 30
31Time
Not all projects use the latest
version?
Numberofclients
Ver.1.2.14
Ver.1.2.16
Ver.1.2.17Log4j
Some client users don’t move to new version
soon after the release!
Library usage by clients over time
Ver.1.2.17
released
http://akinori-ihara.jpn.org/
akinori-i@is.naist.jp
Akinori Ihara 32
33
415 projects using
MAVEN dependency tool
Target projects and libraries
POM POM
POM
POM POM
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j<artifactId>
<version>1.2</version>
</dependency>
Rank Library Num
1 junit 305
2 commons-logging 167
3 log4j 153
4 slf4j-api 145
5 commons-lang 130
6 commons-io 122
7 slf4j-log4j12 109
8 servlet-api 99
9 commons-collections 98
10 commons-codec 96
11 commons-httpclient 83
12 guava 81
13 ant 73
14 xercesImpl 69
15 jetty-server 68
Rank Library Num
16 easymock 67
17 jackson-mapper-asl 60
18 commons-cli 55
19 jackson-core-asl 53
20 mail 53
21 velocity 52
22 jcl—over-slf4j 52
23 mockito--all 52
. . .
. . .
. . .
. . .
. . .
. . .
4815 Axis2-transports 1
Trend Library List
http://akinori-ihara.jpn.org/
akinori-i@is.naist.jp
Akinori Ihara 34
35
Add-RQ:
Was selecting the
l a t e s t v e r s i o n
successful?
Latest?Success?
C l i e n t u s e r s
s e l e c t i n g t h e
latest version are
less likely to be
successful.
RQ2:
Do client users select
the latest version? Latest?
RQ1:
When do client users
adapt a library? LIBRARY
Client users are
l e s s l i k e l y t o
adopt the latest
library versions.
Client users are
m o r e l i k e l y t o
adapt the quick-
release libraries.
http://akinori-ihara.jpn.org/
akinori-i@is.naist.jp
Akinori Ihara 36
37
Key suggestion
OLD NEW
We should be careful to adapt the latest version!
Especially, if we use a library with long-release.
38
http://akinori-ihara.jpn.org/
akinori-i@is.naist.jp
Akinori Ihara
39
http://akinori-ihara.jpn.org/
akinori-i@is.naist.jp
Akinori Ihara
Future Work
Which client users perform downgrade?
Why do they perform downgrade from
the latest version?

Understanding When to Adapt a Library: A Case Study on ASF Projects