PhD Oral Exam - Jasmine Latendresse, Software Engineering

When studying for a doctoral degree (PhD), candidates submit a thesis that provides a critical review of the current state of knowledge of the thesis subject as well as the student’s own contributions to the subject. The distinguishing criterion of doctoral graduate research is a significant and original contribution to knowledge.

Once accepted, the candidate presents the thesis orally. This oral exam is open to the public.

Abstract

Modern software systems rely extensively on third-party packages to accelerate development and reuse established functionality. However, this reliance makes dependency management a persistent challenge across development, production, and maintenance. Developers must determine which dependencies are relevant to deployed software, evaluate packages introduced during development, and update them reliably as projects and ecosystems evolve. These activities are further changing with the increasing use of large language models (LLMs), which can recommend packages, generate imports, and propose dependency-related changes. This thesis empirically investigates how dependencies are introduced, used, and maintained, and examines how existing and emerging development practices affect the reliability of these activities.

We first establish how dependencies introduced through conventional software-development practices are reflected in production. Through an empirical study of 100 JavaScript projects from the npm ecosystem, we determine which installed dependencies are included in production releases. We find that less than 1% of installed dependencies reach production and that conventional runtime and development classifications do not reliably reflect production use. These findings show that manifest-level information alone is insufficient for understanding and prioritizing dependencies once software is deployed. We then examine LLMs as an emerging mechanism through which dependencies are introduced during development. We evaluate six proprietary and open-source LLMs using 112 real-world Python programming problems from Stack Overflow. The models generally recommend mature, popular, and permissively licensed libraries, but some generated imports cannot be mapped automatically to installable packages, and installation guidance is rarely provided. To support the integration of these dependencies, we introduce the Software Librarian, a Visual Studio Code extension that validates package identities and provides information about licensing, dependencies, deprecation, and package health. The tool correctly classifies 99 of 100 packages in its evaluation dataset. Finally, once a dependency has been selected and integrated, it must be maintained as the project and its packages evolve. We investigate whether LLMs can support this stage by generating dependency-update patches for JavaScript projects. We mine 9,908 dependency-update pull requests from 423 repositories and construct a benchmark of 56 updates from 46 repositories. Although the models frequently identify the intended dependency change, only 50.2% of manifest patches apply to the supplied project state, and 47.1% are both applicable and semantically correct. Providing additional source and test context further reduces manifest-level success, while applicable source-code adaptations remain rare.

This thesis highlights that reliable dependency management requires context beyond manifests, import statements, and update requests. LLMs can support package selection and maintenance reasoning, but they do not eliminate the need for production-aware, ecosystem-aware, and repository-aware tooling. The findings motivate dependency-management workflows that combine LLM capabilities with structured validation, deterministic editing, and project-specific context.