Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

Structural and Connectivity Patterns in the Maven Central Software Dependency Network

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper argues that Maven Central's dependency graph is scale-free and small-world, with a small set of infrastructural hubs whose failure would cascade through nearly all Java projects.

desk verdict Useful, reproducible Maven Central hub rankings undercut by sampling bias and a mislabeled connectivity statistic in the paper's central claims. read the letter →

arxiv 2508.13819 v1 pith:TXQ27JML submitted 2025-08-19 cs.SE

Daniel Ogenrwot , John Businge , Shaikh Arifuzzaman This is my paper · ORCID
classification cs.SE
keywords softwaredependenciesnetworkanalysisMavencentralrepositorysecurityecosystemsdatamining
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the Maven Central repository of Java libraries forms a dependency network with a specific, consequential shape: a heavy-tailed (scale-free) degree distribution, small-world short paths, and nearly all nodes in one giant connected component. The claim matters because if true, the ecosystem's resilience is uneven: random component failures are absorbed, but failures in a few infrastructural libraries (testing frameworks, core utilities, logging) propagate broadly. The authors reach this conclusion by building a sampled directed graph of 1.3 million nodes and 20.9 million edges from the top 5,000 most-depended-on artifacts and their two-hop neighborhoods, then measuring degree distributions, PageRank, betweenness centrality, and connected components. The sympathetic reading is that the hub-centric sample exposes the structural backbone of the ecosystem, even though its peripheral regions are underrepresented.

What carries the argument

The central object is a directed dependency graph whose nodes are library artifacts and release versions and whose edges point from a release to the artifacts it depends on. The load-bearing construction is hub-centric BFS sampling: the researchers take the 5,000 artifacts with the highest in-degree as seeds and expand each outward to depth two, yielding a graph of 1,397,519 nodes and 20,934,596 edges. This graph is then measured with four standard network-science instruments, degree distributions with a power-law fit, PageRank, betweenness centrality, and weakly/strongly connected components, which together carry the scale-free, small-world, and hub-dominance conclusions.

What would settle it

Compute the same degree-distribution fit, connected-component counts, and hub rankings on the full Maven Central graph (about 15 million nodes and 119 million dependency edges) or on a random sample of equal size, and check whether the power-law tail, the 99.81% giant component, and the identity of the top PageRank and betweenness hubs survive; if the giant component shrinks sharply or the degree distribution loses its power-law tail outside the hub neighborhoods, the central claim fails.

Watch

Extended reading notes

Core claim

The central discovery is that Maven Central's dependency graph exhibits scale-free and small-world topology: a power-law degree distribution in the tail, short average path lengths, and a weakly connected giant component containing 99.81% of sampled nodes. PageRank and betweenness centrality both identify a small set of infrastructural hubs, including annotation-processing and metadata artifacts, JUnit and Hamcrest for testing, micrometer-core and spring-core as integration bridges, and log4j-core for logging, so that most projects depend, directly or transitively, on a few dozen critical libraries. Because these hubs sit on many dependency paths, a vulnerability or removal in one of them would reach a large fraction of the ecosystem; the Log4Shell incident is treated as an instance of this structural fragility. The paper presents this as the first combination of global and path-sensitive centrality metrics at this scale on Maven Central.

Load-bearing premise

The load-bearing premise is that a sample built from the 5,000 most-depended-on artifacts and their two-hop neighborhoods represents the whole Maven Central graph well enough that the scale-free, small-world, and giant-component conclusions transfer to the full ecosystem.

Editorial extensions

If this is right

  • A direct corollary is that random library failures in Maven Central should rarely disconnect projects, whereas failures of high-PageRank or high-betweenness hubs should affect a disproportionate share of downstream builds and applications.
  • The hub lists provide a concrete prioritization target: security audits, maintenance funding, and dependency-management warnings could concentrate on the small set of infrastructural libraries rather than on the long tail.
  • Because 99.81% of the sampled graph lies in one weakly connected component, any patch or vulnerability in a hub can spread across the ecosystem almost without barrier, so transitive-impact analysis becomes as important as direct-dependency checks.
  • If the small-world property holds, dependency resolution should usually find short chains, so tools can exploit this by precomputing reachability or centrality-aware fallback options.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the 99.81% giant component is partly an artifact of the sampling design, since BFS expansion from hubs guarantees connectivity to everything it reaches, so the paper's cohesion claim would need confirmation on a sample that does not start from hubs.
  • My inference: the centrality rankings imply a testable prediction that targeted removal of the top PageRank hubs fragments the graph far faster than random removal, and this prediction can be checked directly on the released dataset.
  • My inference: if the hub structure is stable over time, the same methodology applied to later snapshots of Maven Central should show the same small set of libraries persisting atop both centrality rankings, offering a cheap temporal validation.
  • My inference: comparing the same hub-centric analysis on npm or PyPI would reveal whether infrastructure-hub dominance is a general property of package ecosystems or specific to Java/Maven's governance and reuse practices.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This paper analyzes the Maven Central software dependency network using a graph extracted with the Goblin framework. The authors select the top 5,000 artifacts by in-degree, perform breadth-first search expansion from each seed to depth two, and build a directed graph with 1,397,519 nodes and 20,934,596 edges. They compute degree distributions, PageRank, betweenness centrality, and weak/strong connected components, and they conclude that Maven Central is scale-free, small-world, composed of a single giant component, and dominated by a few infrastructural hubs whose failure poses systemic risk. A replication package is provided.

Significance. If the conclusions were valid, the paper would be a useful macro-structural contribution to software ecosystem analysis, quantifying hub concentration and connectivity in a current, large Java repository dataset. The topic is important, the use of the 2024 Goblin dataset is timely, and the authors explicitly provide a replication package, which is a concrete strength. However, the three headline claims—scale-free topology, small-world topology, and a near-universal giant component—are all derived from a hub-centric sample, so the significance of the paper currently rests on an unvalidated representativeness assumption. The connected-component defense offered in Section 5 is internally contradicted by the paper's own Table 4, and the small-world claim is not accompanied by any of the measurements that would support it.

major comments (4)
  1. [§3.2, §5, Table 4] The sampling procedure used throughout is hub-centric and cannot support ecosystem-level claims. Selecting the top 5,000 artifacts by in-degree and expanding each by BFS to depth two guarantees that the sample is concentrated near high-degree seeds; the heavy-tailed degree distribution, hub-dominated centrality rankings, and a near-universal weakly connected component are direct consequences of this construction rather than independent discoveries about Maven Central. The defense in §5 that "this bias is significantly reduced because over 99.81% of the artifacts are part of a single giant strongly connected component" is internally contradicted by Table 4, which reports the largest SCC as 208,270 nodes, about 14.9% of the 1,397,519 sampled nodes, while the 99.81% figure refers to the weakly connected LCC of the BFS-induced subgraph. The LCC coverage is therefore relative to the biased sample, not to the full 15-million-node graph, and it cannot establish that the sample represents Maven Central as a whole.
  2. [§4, RQ1] The small-world conclusion is asserted without any supporting measurement. The text states that "The graph also demonstrates small-world characteristics" and that "any two artifacts are typically connected through just a few intermediate dependencies," but no average shortest path length, diameter, clustering coefficient, or comparison against a random graph or Watts-Strogatz baseline is reported. Since small-world behavior requires both short path lengths and high clustering relative to a random graph, the claim is currently unsupported.
  3. [§4, Figure 2b] The scale-free claim rests on a power-law fit whose statistics are not reported. The paper says the powerlaw library "confirms power-law behavior in the tail," but no exponent, xmin, p-value, or alternative-model comparison is given, and the fitted line is only inspected visually. Moreover, the fit is applied to the hub-biased sample, so even a statistically valid fit would not establish a property of the full Maven Central graph.
  4. [§4, Tables 1–3] The centrality rankings that drive RQ2 are computed on the same hub-centric sample used to select seeds. Because the seeds are the highest in-degree artifacts, PageRank and betweenness scores of those nodes and their neighbors are inflated by construction; without comparison to the full graph or a degree-preserving null model, the claim that these specific libraries are ecosystem-wide infrastructural hubs is not established. Table 3 also contradicts its own label: entries described as leaf nodes with "minimal incoming dependency count" show incoming edges of order 2,700–2,900, so the criterion used to define a leaf is unclear.
minor comments (4)
  1. [Abstract, Table 1] The abstract contains grammatical errors ("reachable those seed nodes", "comprising of"), and Table 1's header reads "To 10 artifacts" instead of "Top 10 artifacts."
  2. [Figure 2] Figure 2's caption labels panel (a) as "full-graph out- and in-degree distributions" while Section 3 states that all metrics are computed on the sampled graph; please clarify which graph each panel shows.
  3. [Equation (2)] The betweenness centrality formula is unnormalized, and raw scores across a graph of this size are difficult to interpret; a normalized definition or a note on scaling would improve reproducibility.
  4. [References] Reference [38] is cited for the betweenness centrality definition but is a paper about noninvasive hemoglobin detection; please cite a standard graph-theory source instead.

Circularity Check

2 steps flagged · score 6.0 of 10

The headline hub-dominated, scale-free, and giant-component conclusions are partly forced by the hub-centric BFS sampling design, and Section 5's representativeness defense is internally contradicted by Table 4.

  1. fitted input called prediction [Section 3.2 (Step 2, Listing 1.1) and Section 4 (RQ1 Summary)]
    "we selected the top 5,000 most highly connected artifacts based on their incoming degree ... we applied a breadth-first search (BFS) expansion from each selected artifact as a seed node ... The degree distribution follows a power-law behavior, confirming that the ecosystem exhibits scale-free network properties."

    The graph analyzed in RQ1 is not the full 15M-node Maven Central graph but the induced subgraph built from the 5,000 highest in-degree nodes and their two-hop BFS neighborhoods. The heavy-tailed degree distribution and the 'small number of infrastructural hubs' conclusion are therefore partially guaranteed by the seed-selection rule: the seeds are, by definition, the highest-degree artifacts. Fitting a power law to this hub-centric sample and then reporting that Maven Central is scale-free presents the sampling input as an empirical discovery; the full-graph degree distribution is never used for the fit. The hub-dominance claim restates the selection criterion as a finding.

  2. other [Section 5 (Threats to Validity)]
    "Graph sampling and seed selection strategies are known to bias degree and connectivity distributions if not carefully calibrated [36]. However, given the dataset's characteristics, this bias is significantly reduced because over 99.81% of the artifacts are part of a single giant strongly connected component."

    Table 4 reports the 99.81% figure as LCC coverage of the sampled graph, while the largest SCC contains 208,270 of 1,397,519 nodes, about 14.9%. The section mislabels the weak giant component as a 'strongly connected component.' More importantly, the giant component is a property of the BFS-expanded induced graph, not of the full 15M-node repository; using the sample's own internal connectivity to argue that the sample is unbiased is circular. Since the BFS construction places every expanded node within two hops of a high-degree seed, a large weak component in the sample tells us little about peripheral regions excluded from the sample.

full rationale

The paper's central structural claims are derived from a graph constructed in Section 3.2 by selecting the top 5,000 in-degree artifacts and BFS-expanding each seed to depth two. The scale-free and hub-dominated conclusion in RQ1 is therefore partly an artifact of the sampling design: the seeds are chosen precisely because they are hubs, and the power-law fit is computed on that hub-centric induced subgraph rather than on the full 15M-node dependency graph. The giant-component claim in RQ3 similarly rests on the weak LCC of the same BFS-induced sample, and Section 5's defense mislabels that weak component as a strongly connected component despite Table 4 reporting a largest SCC of only 208,270 nodes. Using the sample's own connectivity statistics to dismiss the sampling bias is circular. The small-world assertion is separately unsupported by any reported clustering coefficient, average shortest path, or random-graph baseline, but that is a completeness issue rather than a circularity. No load-bearing self-citation chain or imported uniqueness theorem was found, so the circularity is partial rather than total: the paper does report real measurements of the induced subgraph, but the headline claims about Maven Central as a whole are partly forced by the construction of that subgraph.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper's structural conclusions rest on several hand-chosen parameters (seed count, BFS depth) and on an unproven representativeness assumption for the sampled graph. The power-law fit parameters are not reported, and the small-world inference lacks its defining measurements. No new entities are introduced.

free parameters (4)
  • seed_count = 5000
    Number of top in-degree artifacts selected as BFS seeds. Hand-chosen; determines hub-centric bias and which regions of the graph are included. No sensitivity analysis provided.
  • bfs_depth = 2
    BFS expansion depth from each seed. Hand-chosen; controls how many transitive neighbors enter the sample and therefore the size of the giant component. No justification or sensitivity analysis.
  • powerlaw_alpha = not reported
    Power-law exponent fitted by the powerlaw library on the sampled degree distribution. The paper states a power-law fit confirms scale-free behavior but does not report the exponent, xmin, or goodness-of-fit, making the conclusion unverifiable.
  • powerlaw_xmin = not reported
    Lower cutoff for the power-law fit. Chosen by the fitting routine; not reported. The choice affects whether the tail is power-law or lognormal.
assumptions (4)
  • domain assumption The Goblin 2024 dump accurately represents the Maven Central dependency graph.
    The paper treats the Neo4j dataset as ground truth for all dependency edges. Errors or omissions in the dataset would propagate into every metric. Invoked in Section 3.2 Step 1.
  • domain assumption Degree-based sampling yields a representative subgraph for global structural inference.
    The paper selects top-degree seeds and BFS-expands, then uses the sample to infer ecosystem-wide properties. This is an unproven assumption and is the core methodological threat; the paper's dismissal of the bias is flawed. Invoked in Section 3.2 Step 2 and Section 5.
  • ad hoc to paper Heavy-tailed degree distribution implies scale-free network and, together with a giant component, implies small-world behavior.
    The paper infers scale-free from the power-law tail and small-world without measuring clustering coefficient or average path length. These are unstated inferential steps, not standard definitions. Invoked in Section 4 RQ1.
  • standard math NetworkX and powerlaw library implementations are correct.
    Assumes the standard algorithms for PageRank, betweenness, connected components, and power-law fitting are correctly implemented. Reasonable background assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Structural and Connectivity Patterns in the Maven Central Software Dependency Network." pith.science (2026). https://pith.science/paper/TXQ27JML

@misc{pith2026250813819,
  author       = {Pith},
  title        = {Pith review of: Structural and Connectivity Patterns in the Maven Central Software Dependency Network},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TXQ27JML}},
  note         = {Machine review of arXiv:2508.13819}
}
read the original abstract

Understanding the structural characteristics and connectivity patterns of large-scale software ecosystems is critical for enhancing software reuse, improving ecosystem resilience, and mitigating security risks. In this paper, we investigate the Maven Central ecosystem, one of the largest repositories of Java libraries, by applying network science techniques to its dependency graph. Leveraging the Goblin framework, we extracted a sample consisting of the top 5,000 highly connected artifacts based on their degree centrality and then performed breadth-first search (BFS) expansion from each selected artifact as a seed node, traversing the graph outward to capture all libraries and releases reachable those seed nodes. This sampling strategy captured the immediate structural context surrounding these libraries resulted in a curated graph comprising of 1.3 million nodes and 20.9 million edges. We conducted a comprehensive analysis of this graph, computing degree distributions, betweenness centrality, PageRank centrality, and connected components graph-theoretic metrics. Our results reveal that Maven Central exhibits a highly interconnected, scale-free, and small-world topology, characterized by a small number of infrastructural hubs that support the majority of projects. Further analysis using PageRank and betweenness centrality shows that these hubs predominantly consist of core ecosystem infrastructure, including testing frameworks and general-purpose utility libraries. While these hubs facilitate efficient software reuse and integration, they also pose systemic risks; failures or vulnerabilities affecting these critical nodes can have widespread and cascading impacts throughout the ecosystem.

Figures

Figures reproduced from arXiv: 2508.13819 by the authors.

Figure 1
Figure 1. Overview of the methodology pipeline. consists of two primary node types: Artifact nodes, which represent software components such as libraries, frameworks, or tools, and Release nodes, which denote specific published versions of these artifacts. Each release node includes metadata such as the version identifier and its publication timestamp (in Unix format). Artifacts are linked to their respective releases via a o… view at source ↗
Figure 2
Figure 2. Comparison of degree distributions in the Maven dependency graphs. (a) shows full-graph out- and [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Degree distributions in the Maven dependency graphs, plotted in log-log scale. (a) In-degree distribu [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Network visualization of the top 10 artifacts by PageRank in the Maven Central dependency graph. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Revisiting RAG Ensemble: A Theoretical and Mechanistic Analysis of Multi-RAG System Collaboration

    cs.AI 2025-08 unverdicted novelty 5.0 of 10

    Combining multiple RAG systems across four pipeline types and three modules is claimed to be robust and generalizable, backed by a new information-entropy account.

Reference graph

Works this paper leans on

63 extracted references · 50 canonical work pages · cited by 1 Pith paper

  1. [1]

    In: 2009 3rd International Symposium on Empirical Software Engineering and Measurement

    Abate, P., Di Cosmo, R., Boender, J., Zacchiroli, S.: Strong dependencies between software components. In: 2009 3rd International Symposium on Empirical Software Engineering and Measurement. pp. 89–99 (2009)

    work page 2009

  2. [2]

    In: Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering

    Abdalkareem, R., Nourry, O., Wehaibi, S., Mujahid, S., Shihab, E.: Why do developers use trivial packages? an empirical case study on npm. In: Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering. p. 385–395. ESEC/FSE 2017, Association for Computing Machinery, New York, NY, USA (2017), https://doi.org/10.1145/3106237.3106267

    arXiv 2017

  3. [3]

    In: 2014 IEEE 10th International Conference on e-Science

    Abdelhamid, S., Alam, M., Alo, R., Arifuzzaman, S., Beckman, P., Bhattacharjee, T., Bhuiyan, H., Bisset, K., Eubank, S., Esterline, A.C., et al.: Cinet 2.0: A cyberinfrastructure for network science. In: 2014 IEEE 10th International Conference on e-Science. vol. 1, pp. 324–331. IEEE (2014)

    work page 2014

  4. [4]

    ACM Trans

    Arifuzzaman, S., Khan, M., Marathe, M.: Fast parallel algorithms for counting and listing triangles in big graphs. ACM Trans. Knowl. Discov. Data (TKDD) 14(1), 5:1–5:34 (2019), https://doi.org/10.1145/3365676

    work page doi:10.1145/3365676 2019

  5. [5]

    Technical Report (2012)

    Arifuzzaman, S.M., Khan, M., Marathe, M.: Patric: A parallel algorithm for counting triangles and computing clustering coefficients in massive networks. Technical Report (2012)

    work page 2012

  6. [6]

    In: 2024 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW)

    Arifuzzaman, S., Arikan, H.S., Faysal, M., Bremer, M., Shalf, J., Popovici, D.: Unlocking the potential: Perfor- mance portability of graph algorithms on kokkos framework. In: 2024 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW). pp. 526–529 (2024)

    work page 2024

  7. [7]

    International Journal of Big Data Intelligence 6(3-4), 176–187 (2019)

    Arifuzzaman, S., Pandey, B.: Scalable mining, analysis and visualisation of protein-protein interaction networks. International Journal of Big Data Intelligence 6(3-4), 176–187 (2019)

    work page 2019

  8. [8]

    Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences 371(1987), 20120375 (2013)

    Barab´ asi, A.L.: Network science. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences 371(1987), 20120375 (2013)

    work page 1987

Show all 63 references
  1. [9]

    Science 286(5439), 509–512 (1999), https: //www.science.org/doi/abs/10.1126/science.286.5439.509

    Barab´ asi, A.L., Albert, R.: Emergence of scaling in random networks. Science 286(5439), 509–512 (1999), https: //www.science.org/doi/abs/10.1126/science.286.5439.509

    1999 doi

  2. [10]

    Empirical Software Engineering 20(5), 1275–1317 (2015), https://doi.org/10

    Bavota, G., Canfora, G., Di Penta, M., Oliveto, R., Panichella, S.: How the apache community upgrades de- pendencies: an evolutionary study. Empirical Software Engineering 20(5), 1275–1317 (2015), https://doi.org/10. 1007/s10664-014-9325-9 Structural and Connectivity Patterns 15

    2015

  3. [11]

    In: Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering

    Bogart, C., K¨ astner, C., Herbsleb, J., Thung, F.: How to break an api: cost negotiation and community values in three software ecosystems. In: Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering. p. 109–120. FSE 2016, Assoc...

    2016

  4. [12]

    In: SPLC

    Bosch, J.: From software product lines to software ecosystems. In: SPLC. vol. 9, pp. 111–119 (2009)

    2009

  5. [13]

    Businge, J., Abdi, M., Demeyer, S.: Analyzing Variant Forks of Software Repositories from Social Coding Plat- forms, pp. 131–152. Springer International Publishing, Cham (2023), https://doi.org/10.1007/978-3-031-36060-2 6

    2023 doi

  6. [14]

    Empirical Software Engineering 27(2), 54 (2022), https://doi.org/10.1007/s10664-021-10078-2

    Businge, J., Openja, M., Nadi, S., Berger, T.: Reuse and maintenance practices among divergent forks in three soft- ware ecosystems. Empirical Software Engineering 27(2), 54 (2022), https://doi.org/10.1007/s10664-021-10078-2

    2022 doi

  7. [15]

    In: 2013 17th European Conference on Software Maintenance and Reengineering

    Businge, J., Serebrenik, A., van den Brand, M.: Analyzing the eclipse api usage: Putting the developer in the loop. In: 2013 17th European Conference on Software Maintenance and Reengineering. pp. 37–46 (2013)

    2013

  8. [16]

    Software Quality Journal 23(1), 107–141 (2015), https://doi.org/10.1007/s11219-013-9221-3

    Businge, J., Serebrenik, A., van den Brand, M.G.J.: Eclipse api usage: the good and the bad. Software Quality Journal 23(1), 107–141 (2015), https://doi.org/10.1007/s11219-013-9221-3

    2015 doi

  9. [17]

    In: 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)

    Businge, J., Zerouali, A., Decan, A., Mens, T., Demeyer, S., De Roover, C.: Variant forks - motivations and imped- iments. In: 2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER). pp. 867–877 (2022)

    2022

  10. [18]

    IEEE Software 32(2), 50–54 (2015)

    Chen, L.: Continuous delivery: Huge benefits, but challenges too. IEEE Software 32(2), 50–54 (2015)

    2015

  11. [19]

    arXiv preprint arXiv:2503.22902 (2025)

    Chowdhury, B., Rabbi, M.F., Hasan, S., Zibran, M.F.: Insights into dependency maintenance trends in the maven ecosystem. arXiv preprint arXiv:2503.22902 (2025)

    2025 arXiv

  12. [20]

    In: 2015 IEEE 22nd International Conference on Software Analysis, Evolution, and Reengineering (SANER)

    Cosentino, V., Izquierdo, J.L.C., Cabot, J.: Assessing the bus factor of git repositories. In: 2015 IEEE 22nd International Conference on Software Analysis, Evolution, and Reengineering (SANER). pp. 499–503 (2015)

    2015

  13. [21]

    Decan, A., Mens, T.: What do package dependencies tell us about semantic versioning? IEEE Transactions on Software Engineering 47(6), 1226–1240 (2021)

    2021

  14. [22]

    In: Proccedings of the 10th European Conference on Software Architec- ture Workshops

    Decan, A., Mens, T., Claes, M.: On the topology of package dependency networks: a comparison of three programming language ecosystems. In: Proccedings of the 10th European Conference on Software Architec- ture Workshops. ECSAW ’16, Association for Computing Machinery, New York...

    2016

  15. [23]

    Empirical Software Engineering 24(1), 381–416 (2019), https://doi.org/10.1007/ s10664-017-9589-y

    Decan, A., Mens, T., Grosjean, P.: An empirical comparison of dependency network evolution in seven soft- ware packaging ecosystems. Empirical Software Engineering 24(1), 381–416 (2019), https://doi.org/10.1007/ s10664-017-9589-y

    2019

  16. [24]

    Digital Threats 3(4) (Feb 2022), https://doi.org/10.1145/3472811

    D¨ using, J., Hermann, B.: Analyzing the direct and transitive impact of vulnerabilities onto different artifact repositories. Digital Threats 3(4) (Feb 2022), https://doi.org/10.1145/3472811

    2022 doi

  17. [25]

    In: 2021 IEEE High Performance Extreme Computing Conference (HPEC)

    Faysal, M.A.M., Arifuzzaman, S., Chan, C., Bremer, M., Popovici, D., Shalf, J.: Hypc-map: A hybrid parallel community detection algorithm using information-theoretic approach. In: 2021 IEEE High Performance Extreme Computing Conference (HPEC). pp. 1–8. IEEE (2021)

    2021

  18. [26]

    In: Proceedings of the 52nd International Conference on Parallel Processing

    Faysal, M.A.M., Bremer, M., Chan, C., Shalf, J., Arifuzzaman, S.: Fast parallel index construction for efficient k-truss-based local community detection in large graphs. In: Proceedings of the 52nd International Conference on Parallel Processing. pp. 132–141 (2023)

    2023

  19. [27]

    Empirical Software Engineering 14(3), 262–285 (2009), https://doi

    Gonzalez-Barahona, J.M., Robles, G., Michlmayr, M., Amor, J.J., German, D.M.: Macro-level software evolution: a case study of a large software compilation. Empirical Software Engineering 14(3), 262–285 (2009), https://doi. org/10.1007/s10664-008-9100-x

    2009 doi

  20. [28]

    IEEE Transactions on Software Engineering 49(8), 4004–4022 (2023)

    He, R., He, H., Zhang, Y., Zhou, M.: Automating dependency updates in practice: An exploratory study on github dependabot. IEEE Transactions on Software Engineering 49(8), 4004–4022 (2023)

    2023

  21. [29]

    IEEE Transactions on Network and Service Management 21(6), 5921–5934 (2024)

    Hiesgen, R., Nawrocki, M., Schmidt, T.C., W¨ ahlisch, M.: The log4j incident: A comprehensive measurement study of a critical vulnerability. IEEE Transactions on Network and Service Management 21(6), 5921–5934 (2024)

    2024

  22. [30]

    Jaime, D.: Goblin: Neo4j maven central dependency graph (Aug 2024), https://doi.org/10.5281/zenodo.13734581

    2024 doi

  23. [31]

    In: 2009 31st International Conference on Software Engineering - Companion Volume

    Jansen, S., Finkelstein, A., Brinkkemper, S.: A sense of community: A research agenda for software ecosystems. In: 2009 31st International Conference on Software Engineering - Companion Volume. pp. 187–190 (2009)

    2009

  24. [32]

    Journal of Systems and Software 225, 112382 (2025), https://www.sciencedirect.com/science/ article/pii/S0164121225000500

    Jolak, R., Karlsson, S., Dobslaw, F.: An empirical investigation of the impact of architectural smells on software maintainability. Journal of Systems and Software 225, 112382 (2025), https://www.sciencedirect.com/science/ article/pii/S0164121225000500

    2025

  25. [33]

    In: 2017 IEEE/ACM 14th International Conference on Mining Software Repositories (MSR)

    Kikas, R., Gousios, G., Dumas, M., Pfahl, D.: Structure and evolution of package dependency networks. In: 2017 IEEE/ACM 14th International Conference on Mining Software Repositories (MSR). pp. 102–112 (2017)

    2017

  26. [34]

    Kula, R.G., German, D.M., Ouni, A., Ishio, T., Inoue, K.: Do developers update their library dependencies? Empirical Software Engineering 23(1), 384–417 (2018), https://doi.org/10.1007/s10664-017-9521-5

    2018 doi

  27. [35]

    In: 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE)

    Kumar, S.H.B.I., Sampaio, L.R., Martin, A., Brito, A., Fetzer, C.: A comprehensive study on the impact of vulnerable dependencies on open-source software. In: 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE). pp. 96–107 (2024) 16 D. Ogenrwot et al

    2024

  28. [36]

    In: Proceedings of the 12th ACM SIGKDD Interna- tional Conference on Knowledge Discovery and Data Mining

    Leskovec, J., Faloutsos, C.: Sampling from large graphs. In: Proceedings of the 12th ACM SIGKDD Interna- tional Conference on Knowledge Discovery and Data Mining. p. 631–636. KDD ’06, Association for Computing Machinery, New York, NY, USA (2006), https://doi.org/10.1145/115040...

    2006

  29. [37]

    In: 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE)

    Li, W., Wu, F., Fu, C., Zhou, F.: A large-scale empirical study on semantic versioning in golang ecosystem. In: 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE). pp. 1604–1614 (2023)

    2023

  30. [38]

    Algorithms 18(2) (2025), https://www.mdpi.com/1999-4893/18/2/75

    Liu, L., Wang, Z., Zhang, X., Zhuang, Y., Liang, Y.: A novel model for noninvasive haemoglobin detection based on visibility network and clustering network for multi-wavelength ppg signals. Algorithms 18(2) (2025), https://www.mdpi.com/1999-4893/18/2/75

    2025

  31. [39]

    Empirical Software Engineering 29(4), 83 (2024), https://doi.org/10.1007/ s10664-024-10448-6

    Ma, Z., Mondal, S., Chen, T.H.P., Zhang, H., Hassan, A.E.: Vulnet: Towards improving vulnerability man- agement in the maven ecosystem. Empirical Software Engineering 29(4), 83 (2024), https://doi.org/10.1007/ s10664-024-10448-6

    2024

  32. [40]

    Journal of Systems and Software 117, 84–103 (2016), https://www.sciencedirect.com/science/article/pii/S0164121216000406

    Manikas, K.: Revisiting software ecosystems research: A longitudinal literature study. Journal of Systems and Software 117, 84–103 (2016), https://www.sciencedirect.com/science/article/pii/S0164121216000406

    2016

  33. [41]

    Mens, T., Claes, M., Grosjean, P., Serebrenik, A.: Studying Evolving Software Ecosystems based on Eco- logical Models, pp. 297–326. Springer Berlin Heidelberg, Berlin, Heidelberg (2014), https://doi.org/10.1007/ 978-3-642-45398-4 10

    2014

  34. [42]

    In: 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR)

    Nachuma, C., Hossan, M.M., Turzo, A.K., Zibran, M.F.: Decoding dependency risks: A quantitative study of vulnerabilities in the maven ecosystem. In: 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR). pp. 270–274 (2025)

    2025

  35. [43]

    Proceedings of the National Academy of Sciences 98(2), 404–409 (2001), https://www.pnas.org/doi/abs/10.1073/pnas.98.2.404

    Newman, M.E.J.: The structure of scientific collaboration networks. Proceedings of the National Academy of Sciences 98(2), 404–409 (2001), https://www.pnas.org/doi/abs/10.1073/pnas.98.2.404

    2001 doi

  36. [44]

    arXiv preprint arXiv:2508.06718 (2025)

    Ogenrwot, D., Businge, J.: Refactoring-aware patch integration across structurally divergent java forks. arXiv preprint arXiv:2508.06718 (2025)

    2025 arXiv

  37. [45]

    Ogenrwot, D., Businge, J., Arifuzzaman, S.M.: Replication package: Structural and connectivity patterns in the maven central software dependency network (Jun 2025), https://doi.org/10.5281/zenodo.15691891

    2025 doi

  38. [46]

    Packt Publishing Ltd (2019)

    Platt, E.L.: Network science with Python and NetworkX quick start guide: explore and visualize network data effectively. Packt Publishing Ltd (2019)

    2019

  39. [47]

    Rabbi, M.F., Champa, A.I., Paul, R., Zibran, M.F.: Chasing the clock: How fast are vulnerabilities fixed in the maven ecosystem? In: 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR). pp. 265–269 (2025)

    2025

  40. [48]

    In: 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR)

    Rabbi, M.F., Paul, R., Champa, A.I., Zibran, M.F.: Understanding software vulnerabilities in the maven ecosys- tem: Patterns, timelines, and risks. In: 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR). pp. 290–294 (2025)

    2025

  41. [49]

    Journal of Systems and Software 129, 140–158 (2017), https://www.sciencedirect.com/science/article/ pii/S0164121216300243

    Raemaekers, S., van Deursen, A., Visser, J.: Semantic versioning and impact of breaking changes in the maven repository. Journal of Systems and Software 129, 140–158 (2017), https://www.sciencedirect.com/science/article/ pii/S0164121216300243

    2017

  42. [50]

    In: Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering

    Ramkisoen, P.K., Businge, J., van Bladel, B., Decan, A., Demeyer, S., De Roover, C., Khomh, F.: Pareco: patched clones and missed patches among the divergent variants of a software family. In: Proceedings of the 30th ACM Joint European Software Engineering Conference and Sympo...

    2022

  43. [51]

    In: 2018 9th International Workshop on Empirical Software Engineering in Practice (IWESEP)

    Ruohonen, J.: An empirical analysis of vulnerabilities in python packages for web applications. In: 2018 9th International Workshop on Empirical Software Engineering in Practice (IWESEP). pp. 25–30 (2018)

    2018

  44. [52]

    Journal of Systems and Software 145, 164–179 (2018), https://www.sciencedirect

    Saied, M.A., Ouni, A., Sahraoui, H., Kula, R.G., Inoue, K., Lo, D.: Improving reusability of software libraries through usage pattern mining. Journal of Systems and Software 145, 164–179 (2018), https://www.sciencedirect. com/science/article/pii/S0164121218301699

    2018

  45. [53]

    In: 2020 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW)

    Sattar, N.S., Anfuzzaman, S.: Data parallel large sparse deep neural network on gpu. In: 2020 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW). pp. 1–9. IEEE (2020)

    2020

  46. [54]

    In: 2019 IEEE International Conference on Big Data (Big Data)

    Sattar, N.S., Arifuzzaman, S., Zibran, M.F., Sakib, M.M.: Detecting web spam in webgraphs with predictive model analysis. In: 2019 IEEE International Conference on Big Data (Big Data). pp. 4299–4308 (2019)

    2019

  47. [55]

    Applied Network Science 8(1), 64 (2023)

    Sattar, N.S., Buluc, A., Ibrahim, K.Z., Arifuzzaman, S.: Exploring temporal community evolution: algorithmic approaches and parallel optimization for dynamic community detection. Applied Network Science 8(1), 64 (2023)

    2023

  48. [56]

    International Journal of Parallel Programming 53(1), 4 (2025)

    Sattar, N.S., Ibrahim, K.Z., Buluc, A., Arifuzzaman, S.: DyG-DPCD: a distributed parallel community detection algorithm for large-scale dynamic graphs. International Journal of Parallel Programming 53(1), 4 (2025)

    2025

  49. [57]

    arXiv preprint arXiv:2503.24349 (2025)

    Shafin, M.S., Rabbi, M.F., Hasan, S., Zibran, M.F.: Faster releases, fewer risks: A study on maven artifact vulnerabilities and lifecycle management. arXiv preprint arXiv:2503.24349 (2025)

    2025 arXiv

  50. [58]

    arXiv preprint arXiv:2504.12261 (2025) Structural and Connectivity Patterns 17

    Shanto, M.H., Asaduzzaman, M., Mondal, M., Chowdhury, S.: Dependency dilemmas: A comparative study of independent and dependent artifacts in maven central ecosystem. arXiv preprint arXiv:2504.12261 (2025) Structural and Connectivity Patterns 17

    2025 arXiv

  51. [59]

    arXiv preprint cond-mat/0307278 (2003)

    Valverde, S., Sol´ e, R.V.: Hierarchical small worlds in software architecture. arXiv preprint cond-mat/0307278 (2003)

    2003 arXiv

  52. [60]

    Wang, Y., Wen, M., Liu, Z., Wu, R., Wang, R., Yang, B., Yu, H., Zhu, Z., Cheung, S.C.: Do the dependency conflicts in my project matter? In: Proceedings of the 2018 26th ACM Joint Meeting on European Software En- gineering Conference and Symposium on the Foundations of Softwar...

    2018

  53. [61]

    In: 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR)

    Yang-Smith, C., Abdellatif, A.: Tracing vulnerabilities in maven: A study of cve lifecycles and dependency networks. In: 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR). pp. 349– 353 (2025)

    2025

  54. [62]

    In: 2025 IEEE/ACM 22nd Inter- national Conference on Mining Software Repositories (MSR)

    Yoshioka, H., Lertbanjongngam, S., Inaba, M., Fan, Y., Nakano, T., Shimari, K., Kula, R.G., Matsumoto, K.: Do developers depend on deprecated library versions? a mining study of log4j. In: 2025 IEEE/ACM 22nd Inter- national Conference on Mining Software Repositories (MSR). pp....

    2025

  55. [63]

    In: Capilla, R., Gallina, B., Cetina, C

    Zerouali, A., Constantinou, E., Mens, T., Robles, G., Gonz´ alez-Barahona, J.: An empirical analysis of technical lag in npm package dependencies. In: Capilla, R., Gallina, B., Cetina, C. (eds.) New Opportunities for Software Reuse. pp. 95–110. Springer International Publishin...

    2018

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.