Journal of Software-Evolution and Process最新文献

{"title":"Optimizing Managerial Decision-Making Through Agile Practices: A Software Engineering Management Team Perspective","authors":"Hannes Salin,&nbsp;Yves Rybarczyk,&nbsp;Roger G. Nyberg,&nbsp;Mengjie Han","doi":"10.1002/smr.70095","DOIUrl":"https://doi.org/10.1002/smr.70095","url":null,"abstract":"<p>In today's landscape of rapidly evolving software engineering, managers face a multitude of challenges and complex decision-making scenarios. Within the Swedish Transport Administration (STA), software engineering managers take on dual roles as both strategists and traditional managers, increasing the complexity of their decision-making environment. We investigate how management teams in this context can use and adopt agile practices for better decision-making. The aim is to explore if agile software development team practices can be used for software engineering management teams, with the goal of identifying agile success factors that can be mapped to management success. We employ an industrial case study with a mixed-method research approach, combining quantitative agile data using project tracking software, and qualitative data using structured interviews with the management teams. Unlike previous research that has primarily examined agile adoption within software development teams or emphasized the manager's supportive role, this work investigates management teams themselves as adopters of agile practices and metrics. To our knowledge, this is the first study to develop a mapping model that systematically connects Scrum-based practices, roles, and metrics to the context of software engineering management teams. Our study showed that Scrum-based agile practices, such as stand-ups and retrospectives, can be adapted to software engineering management teams, and that certain agile software development metrics can be transformed into a managerial setting using our proposed model.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 3","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-03-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70095","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147614842","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Exploring Neural Network Structure Code Reuse in the Open-Source Community for Improving Maintenance","authors":"Xiaoning Ren,&nbsp;Yuekun Wang,&nbsp;Chongyang Liu,&nbsp;Yueming Wu,&nbsp;Qiang Hu,&nbsp;Lijun Zhang,&nbsp;Yinxing Xue","doi":"10.1002/smr.70090","DOIUrl":"https://doi.org/10.1002/smr.70090","url":null,"abstract":"<div>\u0000 \u0000 <p>Neural networks (NNs) have rapidly advanced, demonstrating exceptional performance across various fields, leading to a surge in open-source NN projects. The complexity and rapid growth of these projects pose significant challenges for maintenance within the open-source community. Given that NN architecture code is the core asset of NN projects, understanding its reuse in the open-source community is essential for effective maintenance, such as reducing redundancy and identifying potential intellectual property violations. While prior studies have examined code reuse in open-source projects, they have two key limitations: They do not specifically address NN structure code, and they rely on manually selected small-scale datasets that do not sufficiently represent the broader open-source ecosystem. To address these limitations, this study explores reuse patterns in a large-scale dataset of 20,000 open-source projects on GitHub, focusing specifically on NN structure code. Specially, we categorize NN structure reuse into three types: (1) exact reuse with no changes; (2) shallow reuse with minor adjustments like renaming variables or adjusting parameters; and (3) conceptual reuse with significant modifications, while retaining the same layer sequence. We then propose a detection framework, <i>NNReuse</i>, to identify these reuse types and conduct an empirical evaluation of their prevalence and characteristics. As a practical application, we also assess potential license conflicts based on <i>NNReuse</i>. Extensive experiments show that 55.6% of projects and 54.17% of NN structures exhibit structural similarities that are consistent with potential NN structure reuse in open-source projects. Among these, exact reuse is particularly common and introduces significant redundancy, with an estimated storage optimization potential of up to 34.49%. Reuse primarily occurs at a high level, with 43.3% involving the reuse of overall network architecture. Additionally, in projects with license protection, as much as 64.3% may present potential license conflicts, highlighting the importance of strengthened license compliance and proactive IP risk mitigation in the open-source community.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 3","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-03-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147612881","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A State-Aware Fuzzing Method for Trusted Execution Environment Kernels","authors":"Qiang Zhang,&nbsp;Mengjun Guo,&nbsp;Yunfei Qiu,&nbsp;Qingyang Meng","doi":"10.1002/smr.70085","DOIUrl":"https://doi.org/10.1002/smr.70085","url":null,"abstract":"<div>\u0000 \u0000 <p>Trusted execution environments (TEEs) are widely used, and their kernel security has become a significant area of focus. Fuzzing, a powerful technique for detecting vulnerabilities in operating systems, has increasingly been applied to the security analysis of TEEs. However, conventional fuzzing tools cannot be directly used for TEE kernels due to their isolation. Coverage-guided fuzzers often discard test cases that trigger new states but cover the same code, which limits their effectiveness in discovering vulnerabilities. To address these challenges, we propose a state-aware fuzzing method specifically designed for TEE kernels. Initially, we develop a modeling and tracing approach to represent the program state through state-variable values, overcoming the limitations of coverage-guided fuzzers. Subsequently, we propose a new communication scheme to address the issues resulting from the isolation of TEEs. Additionally, new seed preservation and selection algorithms are put forward to better guide the fuzzer in exploring vulnerabilities. Finally, we employ the N-gram model to enhance the test case generation process and optimize the framework's performance. We have implemented a prototype called Trusty-Statefuzz and evaluated it on Fuchsia, our self-developed microkernel operating system Nebula, and the OP-TEE. The evaluation results show that Trusty-Statefuzz is effective at detecting both new code and vulnerabilities. Trusty-Statefuzz discovers nine unknown vulnerabilities and 23 known vulnerabilities. Additionally, it achieves 13% higher code coverage and 27% higher state coverage than the state-of-the-art fuzzer Syzkaller.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 2","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-02-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146217266","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Impact of Selected JavaScript Engines on the Performance of Mobile Hybrid Applications","authors":"Łukasz Kurant,&nbsp;Jarosław Bylina","doi":"10.1002/smr.70086","DOIUrl":"https://doi.org/10.1002/smr.70086","url":null,"abstract":"<div>\u0000 \u0000 <p>This study presents a comprehensive comparative analysis of the performance of different JavaScript engines in the context of React Native hybrid applications, with a particular focus on the differences between JavaScript Interface (JSI) and bridge architectures. The study conducted a series of performance tests on the most popular JavaScript engines, including Hermes, JavaScriptCore (JSC), and V8, using a set of standard benchmarks and use cases. As part of the research, a QuickJS engine communication layer was created, and necessary changes were proposed to the React Native framework and engine code. The testing methodology included measurements of application package size, interaction time, memory usage, UI rendering performance, and operation execution speed. Tests were conducted on identical components implemented in both React Native architectures, allowing a direct comparison of the impact of architecture on JavaScript engine performance. The results of the experiment indicate differences in engine performance depending on the scenario and describe the differences between their use in bridge and JSI architectures.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 2","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-02-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146224213","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Empowering Software Engineers to Design More Secure Web Applications: Guidelines and Potential of Using LLMs as a Recommender Tool","authors":"Raffaela Groner,&nbsp;Klara Svensson,&nbsp;Drake Axelrod,&nbsp;Ranim Khojah,&nbsp;Mazen Mohamad,&nbsp;Rebekka Wohlrab","doi":"10.1002/smr.70083","DOIUrl":"https://doi.org/10.1002/smr.70083","url":null,"abstract":"<p>As software applications get increasingly connected and complex, cybersecurity becomes more and more important to consider during development and evaluation. Software engineers need to be aware of various security threats and the countermeasures that can be taken to mitigate them. Currently, there is a lack of guidance for software engineers aiming to develop secure web applications. We conducted a design science research study, resulting in a set of guidelines to aid software engineers in developing secure web applications. The set of guidelines was constructed based on interview data with 10 industry practitioners. These guidelines were then evaluated using a survey with 28 respondents. Additionally, we conducted experiments in which we provided a large language model with our guidelines and vulnerability reports as input. The large language model should extend the given vulnerability reports by recommending which of our guidelines can help prevent the given vulnerability in the future. The extended reports were evaluated by two external researchers experienced in cyber security and one author. Our results indicate that developers consider using these proposed guidelines for the development and assessment of secure web applications in different stages of the software development lifecycle. Our results also show that it is possible to automatically enhance vulnerability reports to support developers meaningfully and that the guidelines recommended by the large language model are useful to prevent the respective vulnerabilities in the future.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 2","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-02-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70083","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147275085","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Interest in Working Remotely: What Factors Are at Play?","authors":"Eriks Klotins,&nbsp;Darja Smite,&nbsp;Panagiota Chatzipetrou,&nbsp;Anastasiia Tkalich,&nbsp;Nils Brede Moe","doi":"10.1002/smr.70084","DOIUrl":"https://doi.org/10.1002/smr.70084","url":null,"abstract":"<p>In the postpandemic era, attitudes toward remote work appeared to undergo a lasting transformation, with a high degree of location flexibility becoming increasingly common. Yet, in recent years, many organizations have introduced return-to-office (RTO) initiatives aimed at re-establishing traditional workplace dynamics and prioritizing in-person collaboration. These mandates have drawn significant attention and criticism for limiting software developers flexibility, diminishing well-being, and potentially impacting women disproportionally. This study seeks to understand software developers preferences and actual work behaviors in companies that promote in-office presence. Specifically, we investigate whether certain demographic groups, including women, are differentially affected by RTO initiatives. We also explore a range of factors that may influence individual preferences for remote or on-site work, beyond gender-based assumptions. We report findings from a survey conducted in two large Scandinavian companies engaged in the development of software-intensive systems and services. Data analysis includes descriptive statistics, contingency tables along with post hoc tests, chi-square test of association, and Cramér's <span></span><math>\u0000 <semantics>\u0000 <mrow>\u0000 <mi>V</mi>\u0000 </mrow>\u0000 <annotation>$$ V $$</annotation>\u0000 </semantics></math> for effect sizes. Our findings reveal that gender differences among software developers in both industrial cases are minimal and statistically insignificant. Instead, other variables—such as the degree of collaborative work, commute time, and responsibility to support teammates—demonstrate a stronger association with both actual and preferred office attendance. Our results challenge common narratives around gendered responses to RTO mandates, suggesting that other contextual and task-related factors may play a more decisive role. While the impact of RTO initiatives should not be dismissed, our findings indicate that a deeper understanding of work dynamics—particularly around collaboration intensity and commuting burden—is essential to designing equitable and effective work policies. Finally, our findings imply that organizational recommendations for work location must go hand in hand with task design.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 2","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-02-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70084","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146136104","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Formal Verification of Partitioned Scheduling in Real-Time Operating Systems Using Timed Automata","authors":"Jiaqi Yin,&nbsp;XinLong Chen,&nbsp;Jixun Yan,&nbsp;Shaolong Song,&nbsp;Yushen Han","doi":"10.1002/smr.70077","DOIUrl":"https://doi.org/10.1002/smr.70077","url":null,"abstract":"<div>\u0000 \u0000 <p>Partition scheduling plays a crucial role in ensuring temporal determinism and fault isolation in real-time operating systems. However, its correctness is difficult to guarantee through traditional testing due to the complexity of timing interactions and the need for exhaustive state exploration. Therefore, a rigorous and systematic verification approach is essential to ensure system design correctness under all execution scenarios.This paper presents a formal modeling and verification methodology for partition scheduling in operating systems, based on timed automata. The proposed model is developed and systematically verified using UPPAAL. It comprises four key components–Partition, Scheduler, TimeSynchronizer, and ErrorHandler–which collectively capture task execution flows, scheduling policies, clock synchronization, and fault-handling mechanisms. A comprehensive set of verification properties is defined using Linear Temporal Logic (LTL) to formally specify the system's temporal behaviors and safety requirements. The verification results confirm that the proposed approach effectively verifies partition switching correctness, time consistency enforcement, and exception recovery. This method provides a rigorous and practical formal foundation for modeling and analyzing real-time scheduling systems.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 1","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-01-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146148255","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"ECLYPSE: A Python Framework for Simulation and Emulation of the Cloud-Edge Continuum","authors":"Jacopo Massa,&nbsp;Valerio De Caro,&nbsp;Stefano Forti,&nbsp;Patrizio Dazzi,&nbsp;Davide Bacciu,&nbsp;Antonio Brogi","doi":"10.1002/smr.70081","DOIUrl":"https://doi.org/10.1002/smr.70081","url":null,"abstract":"<p>The Cloud-Edge continuum enhances application performance by bringing computation closer to data sources. However, it presents considerable challenges in managing resources and determining application service placement, as these tasks require analyzing diverse, dynamic environments characterized by fluctuating network conditions. Addressing these challenges calls for tools combining simulation and emulation of Cloud-Edge systems to rigorously assess novel application and resource management strategies. In this paper, we introduce <span>ECLYPSE</span>, a Python-based framework that enables the simulation and emulation of the Cloud-Edge continuum via adaptable resource allocation and service placement models. <span>ECLYPSE</span> features an event-driven architecture for dynamically adapting network configurations and resources. It also supports seamless transitions between simulated and emulated setups, thus enabling the execution of experiments in simulated, emulated, and hybrid settings. In this work, we illustrate and assess <span>ECLYPSE</span> capabilities over three use cases, demonstrating the framework's effectiveness in rapid prototyping across diverse scenarios.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 1","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-01-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70081","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146099380","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"The Impact of COVID-19 on Open Source Development Activities: A Multi-Method Study","authors":"Márcio Vinicius Okimoto,&nbsp;Edna Dias Canedo,&nbsp;Rodrigo Bonifácio,&nbsp;Uirá Kulesza","doi":"10.1002/smr.70082","DOIUrl":"https://doi.org/10.1002/smr.70082","url":null,"abstract":"<p>The social isolation measures resulting from the COVID-19 outbreak changed work practices in various sectors, especially with the shift to working from home. However, the implications of the pandemic on the maintenance and evolution of open-source software (OSS) still deserve further studies. In this paper, we analyze the effects of COVID-19 on the development activity of OSS and how social isolation changed the productivity of OSS contributors. We conducted a mixed-method study composed of (i) a mining software repositories analysis of 155 popular and active OSS projects on GitHub, selected from an initial dataset of 1500 repositories based on activity thresholds (commits, pull requests, and size), and (ii) a survey with 57 core developers identified using an established literature-based heuristic. The mining study analyzed commits, code churn, pull requests, and pull request latency to assess changes before and after the pandemic, applying statistical tests and a mixed-effects Regression Discontinuity Design. The survey collected self-reported perceptions of productivity and engagement during the pandemic, enabling triangulation with repository activity trends. Our results show that while core developers' productivity remained stable, there was a sustained decline in newcomer participation and a temporary increase in core developer turnover. In the early days of the outbreak, we observed an increase in accepted pull requests, followed by a stabilization of most activity metrics. Some findings are supported by our survey study, whose results indicate that most of our survey respondents consider that COVID-19 did not change their productivity substantially. These findings offer insights into OSS resilience and sustainability in the face of large-scale disruptions, contributing to a broader understanding of the outbreak's impact and providing actionable lessons for managing distributed development in crisis scenarios.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 1","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-01-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.70082","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146002164","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Function-Guided Extended Latent Dirichlet Allocation Model for Complementary Cloud API Recommendation in Mashup Development","authors":"Zhen Chen,&nbsp;Xiaolong Wang,&nbsp;Denghui Xie,&nbsp;Haonan Liao,&nbsp;Dianlong You,&nbsp;Limin Shen","doi":"10.1002/smr.70078","DOIUrl":"https://doi.org/10.1002/smr.70078","url":null,"abstract":"<div>\u0000 \u0000 <p>In the cloud era, cloud application programming interface (API), as the best carrier for service delivery, capability replication, and data output, has become the core element of service-oriented software development. The existing cloud API recommendation methods adhere to a common paradigm: leveraging perceived quality of service and keyword matching to generate high-quality, single-function results, while overlooking the objective needs for function-guided complementary cloud APIs in service-oriented software development. Function-guided complementary cloud API recommendation aims to generate cloud APIs that are frequently co-invoked in conjunction with those API having given function, thereby satisfying the joint interests of developers. To this end, we proposed a function-guided extended latent Dirichlet allocation (ELDA) model for complementary cloud API recommendation. Specifically, we first conduct an analysis of real-world data from the cloud API ecosystems to illustrate both the necessity for complementary cloud API recommendations and the objective existence of a head effect within these APIs. Then we conceptualize the complementary relationship between a function and cloud APIs by treating the function as a document, with the corresponding cloud APIs represented as words within that document. Furthermore, we extend the classic latent Dirichlet allocation model by introducing two additional factors: (1) cloud API popularity and (2) functional sensitivity. These factors are designed to capture head effects within complementary cloud APIs. Additionally, we train both a positive and a negative ELDA model using the respective positive and negative corpus sets obtained. Furthermore, complementary cloud APIs relevant to the targeted function are generated by integrating the results from both the positive and negative ELDA models. Finally, experiments were conducted on two real-world cloud API datasets. The results demonstrate that the performance of ELDA surpasses that of the comparative methods. Sensitivity analysis of hyperparameters and case study findings further validate the effectiveness and practicality of ELDA.</p>\u0000 </div>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 1","pages":""},"PeriodicalIF":1.8,"publicationDate":"2026-01-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145963768","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}