Journal of Software-Evolution and Process最新文献

{"title":"A Goal-Driven Method for Software Selection","authors":"Abderrahmane Leshob,&nbsp;Auréanne Bisoka,&nbsp;Omar K. Hussain","doi":"10.1002/smr.70173","DOIUrl":"https://doi.org/10.1002/smr.70173","url":null,"abstract":"<p>Solutions and business architects play a fundamental role in the process of selecting software solutions that satisfy their organizations' objectives and needs to implement a change. These practitioners are often faced with the challenge of selecting the most suitable software among a set of candidate solutions. For that, they often perform a comparative study based on a set of criteria to select the software that best meets the specific needs of their organizations and customers. The software selection is a decision process that plays a crucial role in organizations' digital transformation. However, existing methods have limitations related to their usability and implementation complexity. This paper provides architecture practitioners with a novel method that automatically prioritizes software solutions in order to select the most suitable one. The prioritization process of the solutions is based on: (i) the functional requirements they implement and (ii) the desired goals (business objectives and non-functional requirements) they satisfy. The proposed method is goal-oriented. It uses the Goal-oriented Requirement Language (GRL) that links the candidate software to the requirements to be implemented and the goals to be met. The use of GRL allows the method to automatically compute satisfaction scores that measure the effectiveness of candidate software solutions in implementing requirements and satisfying the desired goals. The satisfaction score is used to rank the software solutions. An experimental study was conducted to evaluate the method's usability. Results demonstrated its effectiveness and alignment with expert expectations in solutions, business architecture, and business analysis.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 10","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-10-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70173","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149206157","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Why Would Remote and Hybrid Software Developers Want to Leave? An Investigation Into the Role of Organizational Dehumanization","authors":"Muhammet Tortumlu,&nbsp;Ahmet Tortumlu","doi":"10.1002/smr.70176","DOIUrl":"https://doi.org/10.1002/smr.70176","url":null,"abstract":"<div>\u0000 \u0000 <p>Remote and hybrid work has become a permanent feature of the technology sector. Retaining software developers, however, remains a major challenge. Managers often focus on workload, performance, or compensation. A less visible yet critical risk is organizational dehumanization, defined as employees perceiving themselves as “replaceable” or “just numbers.” In this study, we examine early emotional risk signals associated with dehumanization and their impact on turnover. We conducted surveys and case studies with 246 software developers across nine companies in Türkiye to understand how management practices affect experiences of dehumanization, loneliness, and stress. Our findings show that dehumanization operates as a hidden managerial risk. It can increase employees' feelings of loneliness, intensify work-related stress, and ultimately trigger a chain of risks that may lead to turnover intentions. Based on these insights, we propose the Humanization Model for Remote and Hybrid Teams (H-MRHT), a structured framework for diagnosing and addressing early signs of dehumanization. The model integrates practices for preventing dehumanization, identifying emerging risks, addressing employee needs, and sustaining human-centered practices. Our study offers practical recommendations for human resources and engineering managers aimed at strengthening feelings of appreciation, support, and belonging among remote and hybrid teams.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 10","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-10-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149205883","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An Empirical Study on the CI/CD Pipeline Evolution","authors":"Luka Četina,&nbsp;Luka Pavlič","doi":"10.1002/smr.70172","DOIUrl":"https://doi.org/10.1002/smr.70172","url":null,"abstract":"<p>CI/CD pipelines have become an essential part of modern software development, enabling teams to deliver software faster, more reliably, and with less effort. While prior work has examined CI/CD adoption and workflow-file changes, less is known about when higher level CI/CD activities are introduced during development, and how structural pipeline characteristics evolve across comparable development stages. This study analyzes most-starred open-source Java repositories on GitHub using GitHub Actions. We identify automated development activities and extract structural pipeline metrics from 339 repositories with CI/CD pipelines. We compare pipeline evolution across equivalent stages of development for 107 repositories. Using our activity-detection procedure, build was the most frequently identified automated activity (93.5%), followed by release (44.8%), test (37.2%), analyze (22.7%), and deploy (14.2%). Build was typically detected earliest, with test and release following later, and analyze and deploy were detected in fewer projects and generally closer to the midpoint of active development. Pipeline-modifying commits accounted for a mean of 4.15% of repository commits (median = 2.25%), suggesting that CI/CD pipelines require ongoing maintenance but that this maintenance represents a comparatively small share of overall repository commit activity in most repositories. Structural changes occur throughout development, with lines of code changing most frequently across timeline checkpoints, while secrets, comments, and conditionals show a secondary increase in later stages. Overall, the findings show that CI/CD pipelines evolve continuously and that both activity inclusion and structural pipeline changes follow recognizable lifecycle patterns.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 10","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-10-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70172","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149205838","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"What Makes a Good Model Card?","authors":"Haochen Lu,&nbsp;Junxiao Han,&nbsp;Yujie Huang,&nbsp;Jiakun Liu,&nbsp;Lingfeng Bao,&nbsp;Song Han,&nbsp;David Lo,&nbsp;Shuiguang Deng","doi":"10.1002/smr.70170","DOIUrl":"https://doi.org/10.1002/smr.70170","url":null,"abstract":"<div>\u0000 \u0000 <p>Hugging Face (HF) is an increasingly popular platform for sharing and discovering machine learning (ML) and artificial intelligence (AI) models. Model cards document these models, and good model cards serve as a vital communication bridge between model developers and users. Without good model cards, it is challenging for users to understand the models and for developers to maintain them. Prior research focused on the documentation process and automatic generation of model cards, and identified the need for high-quality datasets. Understanding the characteristics of good model cards can help improve the quality of model cards, which is essential for model developers and users. To address these gaps, we study the characteristics of high-quality model cards. We collect 758 sampled models along with their model cards and adapt a prior framework to manually identify seven categories of content (i.e., categories of “What,” “Why,” “How,” “When,” “Who,” “References,” and “Other”) and their corresponding themes (e.g., “Model Description” in the “What” category) for these model cards. Then, we conduct a survey to explore what constitutes a high-quality model card. After validation, we define a high-quality model card as one that incorporates the “Model Overview” and “Model Evaluation” content themes from the “What” category, along with the “Model Usage Guide” content theme from the “How” category, that is, a model card that provides both a brief or detailed introduction to the model and instructions for its usage. Then, we train classifiers to investigate whether high-quality model cards can be automatically identified. The random forest model achieves the best performance, with an ROC-AUC of 94.57%. We also investigate the determinants of the quality of model cards. We find that the total word count of the content of model cards, the number of tables that show the key evaluation metrics and results, external links that show the references of external resources, and code blocks that are used to show examples of how to use the model are several of the most significant features that determine the quality of model cards. Finally, we explore the relationship between model card quality and model survival, and find that models with high-quality model cards tend to remain active significantly longer than those with low-quality model cards. Our findings provide insights into high-quality model cards and practical suggestions for model developers, users, researchers, and the HF platform.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 10","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-10-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149099523","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Correction to “ERC4AI: A BERT-Based Model for Ethical Requirements Classification in AI Systems”","authors":"","doi":"10.1002/smr.70171","DOIUrl":"https://doi.org/10.1002/smr.70171","url":null,"abstract":"<p>\u0000 <span>E. de Freitas Ximenes</span>, <span>J. S. Cerqueira</span>, <span>P. Abrahamsson</span>, and <span>E. Dias Canedo</span>, “ <span>ERC4AI: A BERT-Based Model for Ethical Requirements Classification in AI Systems</span>,” <i>Journal of Software: Evolution and Process</i> <span>38</span>, no. <span>7</span> (<span>2026</span>): e70156, https://doi.org/10.1002/smr.70156.\u0000 </p><p>In the originally published article, the name of the second author has been corrected from “José Siqueira Cerqueira” to “José Siqueira de Cerqueira”.</p><p>The online version of this article has been corrected accordingly.</p><p>We apologize for this error.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 10","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-10-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70171","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149099712","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Architectural Vulnerability Mapping and Ethical Risk Taxonomy in Vision-Language Models","authors":"Cigdem Bakir,&nbsp;Ayberk Gezer","doi":"10.1002/smr.70169","DOIUrl":"https://doi.org/10.1002/smr.70169","url":null,"abstract":"<div>\u0000 \u0000 <p>Vision-language models (VLMs) have demonstrated remarkable capabilities in integrating visual and textual data. However, their increasing deployment in real-world applications highlights critical safety and trustworthiness concerns that necessitate a comprehensive evaluation. This study presents a systematic analysis of the ethical risks and technical vulnerabilities associated with VLM architectures, categorizing them into social biases, security threats, and privacy concerns. We propose a dual-layered framework: first, a comprehensive taxonomy to classify ethical risks, and second, an architectural vulnerability map designed to contextualize potential risk origins within the VLM pipeline (vision encoder, connector, and LLM). Our synthesis suggests that while social biases (e.g., gender and racial stereotypes) often manifest predominantly through the LLM and alignment layers, security threats such as adversarial attacks frequently exploit vulnerabilities within the vision encoder. Furthermore, we evaluate current mitigation strategies, including Reinforcement Learning from Human Feedback (RLHF) and adversarial training, highlighting their effectiveness and limitations. The analysis indicates that achieving ethical VLMs requires a holistic approach that combines data-centric debiasing with robust architectural defenses. This paper provides a roadmap for researchers and developers to build safer and more equitable multimodal artificial intelligence (AI) systems.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 9","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-09-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148994518","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Improving Quality of elicited Requirements through Crowdsourcing: An Empirical Study","authors":"Shazia Yousaf,&nbsp;Salma Imtiaz,&nbsp;Muhammad Yasir Shabir,&nbsp;Sundas Iftikhar,&nbsp;Arshad Ahmad","doi":"10.1002/smr.70167","DOIUrl":"https://doi.org/10.1002/smr.70167","url":null,"abstract":"<div>\u0000 \u0000 <p>The success of a software system mainly depends on the quality of its requirements. For general-purpose software systems, traditional techniques of requirement elicitation often struggle to capture clear, complete, unambiguous and verifiable requirements, particularly when users are diverse and globally distributed. The traditional elicitation techniques do not guarantee high quality requirements. To address this limitation, this study investigates the use of crowdsourcing as a mechanism for requirements elicitation. Crowdsourcing uses a large group of online users and stakeholders who participate for scalable data collection, diverse user input and continuous feedback. This research work uses an exploratory mixed method approach conducted in two phases. In the first phase crowdsourcing is used for requirements elicitation and during the second phase, the quality of gathered requirements is assessed and improved through an online focus group. The result indicates an improvement in the quality of requirements elicited via crowdsouricng and improved via focus group i.e., the requirements have improved clarity, correctness, completeness, consistency, verifiability, traceability, and modifiability. The research work provides an empirical evidence of the improved quality of elicited requirements via crowdsourcing for general purpose software systems. It also offers practical insights to researchers and practitioners who are seeking to enhance requirement engineering practices.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 9","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-09-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148942189","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"From Parallel Paths to Crossroads: A Study of DevOps and Low-Code Development Platforms Through Practitioner Insights","authors":"Saima Rafi,&nbsp;Muhammad Azeem Akbar","doi":"10.1002/smr.70163","DOIUrl":"https://doi.org/10.1002/smr.70163","url":null,"abstract":"<p>Low-Code Development Platforms (LCDPs) and DevOps share a common motive to increase agility during the software development process. DevOps focuses on automation, continuous delivery, and rapid response, whereas LCDPs support these practices by simplifying automation through visual programming and rapid prototyping, enabling teams to focus their expertise on decision-making and other strategic tasks. To investigate how the crossroads of LCDPs and DevOps are valuable in achieving better agility and efficiency, we have conducted interviews with 12 IT project team members who deal with LCDPs and the DevOps environment. The objective of this study is to understand the concept of DevOps with LCDPs and to explore how their integration can contribute to the software development process and organizational agility from practitioners' perspectives. To analyze the interview data, we employed a Grounded Theory (GT) approach to systematically code the data and identify emerging categories and themes. The findings suggested that the crossroads of DevOps and LCDPs serve as an effective channel to operationalize the concept of continuous everything in a more efficient manner. However, to achieve this integration successfully, organizations must consider factors such as bridging gaps between talent needs and the available employment pool, governance, scalability, and a collaborative culture. Finally, we discussed the implications of our findings for practitioners and researchers, as well as opportunities for future research.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 9","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-08-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70163","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148816598","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Learning Developer-Code Contribution Relationship to Improve Code Readability Assessment","authors":"Qing Mi,&nbsp;Yinghui Wang,&nbsp;Jingyan Li","doi":"10.1002/smr.70168","DOIUrl":"https://doi.org/10.1002/smr.70168","url":null,"abstract":"<div>\u0000 \u0000 <p>Automated code readability assessment is essential for software maintenance and evolution. Current approaches mainly rely on structural, syntactic, and semantic features of individual code files to perform assessment, yet they ignore repository-level relational information. A critical missing dimension is the contribution relationships between developers and the code files they modify within a repository, which reflect individualized coding style consistency across files. To mitigate this research gap, we formally define and model the developer-code contribution relationships (DCR) for code readability assessment. We first build a heterogeneous graph, where nodes represent developers and code files, and weighted edges quantify developers' contribution ratios. On top of this graph, we adopt a heterogeneous graph attention network (HAN) to learn relational embeddings, which capture cross-file readability similarities caused by common developers. We then combine the learned relational embeddings with high-quality features from state-of-the-art pretrained code readability models to complete the readability assessment. Evaluated on a real GitHub repository dataset, our method delivers stable performance improvements over existing baselines. Extensive experiments also verify that the DCR feature maintains strong generalizability across various graph neural network architectures. This study demonstrates that exploiting repository-level developer-code relations is a promising direction to further boost the performance of automated code readability assessment.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 9","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-08-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148816676","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Toward a Persona-Driven Approach in Cybersecurity: Insights From a Systematic Literature Review","authors":"Daria Levaniuk,&nbsp;Bilal Naqvi,&nbsp;Antti Knutas,&nbsp;Muhammad Azeem Akbar","doi":"10.1002/smr.70165","DOIUrl":"https://doi.org/10.1002/smr.70165","url":null,"abstract":"<p>In recent years, developing secure yet usable systems has been one of the top concerns in cybersecurity research and practice. Research indicates that many data breaches and other cybercrimes directed toward exploiting human factors could be prevented by an inclusive and human-centered cybersecurity design. When it comes to human-centered design, the use of the persona approach can assist in considering the users' needs and aspirations while designing and developing cybersecurity systems and services. In addition, personas can be useful to mitigate the risks of several attacks, increase security awareness, and also enable a better understanding of hacker behavior by modeling different threat scenarios. We conducted a systematic literature review (SLR) of 63 research articles from 2013 to 2024 across three digital databases (ACM, Scopus, and Web of Science). The study focuses on (1) key persona types proposed in the cybersecurity domain; (2) the areas of cybersecurity in which these personas have been proposed; and (3) opportunities and future directions for utilizing the persona approach to address cybersecurity issues. The findings identified the following four types of security personas: attackers, end-users, security workers, and others. Further analysis revealed a distribution matrix and a taxonomy presenting security awareness and threat modeling and mitigation as future research directions and opportunities that exist for improvement of the state of the art of social-media security and privacy, and integrating AI to Cybersec areas. The findings also have implications for practice, including improvements in developmental approaches, training and awareness programs, and increased resilience to cyber-attacks.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 8","pages":""},"PeriodicalIF":1.6,"publicationDate":"2026-08-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70165","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148784898","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}