When It Breaks, It Breaks: How Ecosystem Developers Reason about the Stability of Dependencies

TLDR

Dependencies among software projects reveal implicit collaboration, yet changes to one module can ripple through many others, making negotiation difficult and costly if only backward‑compatible updates are allowed. The authors aim to show that stability‑based awareness mechanisms can help developers make independent yet wise decisions and to outline a vision for a change‑based awareness system. They propose awareness tools grounded in various notions of stability, combining state‑of‑the‑art analysis with current information needs to build a change‑centric awareness framework. Interviews with CRAN and Node.js developers show that they struggle with change, rely on ad‑hoc negotiation, and rarely use existing awareness tools like GitHub notifications because of information overload.

Abstract

Dependencies among software projects and libraries are an indicator of the often implicit collaboration among many developers in software ecosystems. Negotiating change can be tricky: changes to one module may cause ripple effects to many other modules that depend on it, yet insisting on only backward-compatible changes may incur significant opportunity cost and stifle change. We argue that awareness mechanisms based on various notions of stability can enable developers to make decisions that are independent yet wise and provide stewardship rather than disruption to the ecosystem. In ongoing interviews with developers in two software ecosystems (CRAN and Node.js), we are finding that developers in fact struggle with change, that they often use adhoc mechanisms to negotiate change, and that existing awareness mechanisms like Github notification feeds are rarely used due to information overload. We study the state of the art and current information needs and outline a vision toward a change-based awareness system.