commit history analysis

This study presents the first large-scale empirical analysis of Git history rewriting and its threats to software supply chain integrity and reproducibility. Addressing risks—including push conflicts, broken provenance, and malicious code injection—arising from history-altering operations (e.g., rebase, filter-branch) in public repositories, the authors analyze 111 million open-source projects archived by Software Heritage. Leveraging static analysis and two in-depth case studies, they propose the first evidence-driven taxonomy of Git history rewriting and develop GitHistorian, an automated detection tool. Applied at scale, the methodology identifies 1.22 million projects exhibiting history rewriting (8.7 million operations total), revealing prevalent legitimate use cases such as license updates and sensitive information removal. The work establishes a novel, scalable methodology for supply chain security assessment and delivers an open, extensible infrastructure for detecting and characterizing historical tampering.

This study investigates how upstream semantic changes and package maintenance frequency influence developers’ adoption behavior toward dependency updates in the Maven ecosystem. Methodologically, we leverage the Goblin Weaver framework, integrating static analysis, semantic change identification, statistical distribution fitting, and correlation modeling. Our key contributions are threefold: (1) we empirically discover that adoption latency follows a log-normal distribution and adoption breadth decays exponentially; (2) we propose the first adoption modeling framework jointly quantifying semantic change severity and maintenance rate—revealing that high-severity semantic changes significantly prolong adoption latency, while low-maintenance-rate packages exhibit over 60% reduction in adoption breadth; and (3) our model achieves 89.3% prediction accuracy for adoption breadth. These findings provide both theoretical foundations and empirical evidence for understanding open-source dependency evolution and enhancing ecosystem health.

In open-source projects, traceability links between release notes and development artifacts (e.g., pull requests, commits, issues) are frequently missing or erroneous due to remote, asynchronous collaboration—exacerbating technical debt and undermining maintainability. To address this, we propose an automated traceability linking method that jointly leverages a large language model (Gemini 1.5 Pro), semantic text alignment, and temporal proximity features. We further construct the first high-quality, open-source benchmark dataset for release-note traceability, comprising 3,500 manually annotated instances. Experimental evaluation shows our approach achieves a Precision@1 of 0.73 on the pull-request tracing task. A survey with 33 practitioners reveals that 84% strongly endorse its necessity. This work bridges a critical gap in both the research and practice of automated traceability linking in open-source software development.

Accurately distinguishing between semantics-preserving and semantics-altering code commits remains an open challenge in software evolution, as existing approaches struggle to identify refactorings entangled with behavioral changes. This work proposes a behavior-comparison-based detection method that leverages large language models to automatically generate both invocation code and test cases for pre- and post-commit versions. By executing these artifacts and comparing cross-version behavioral consistency, the approach determines whether semantic changes have occurred. Notably, it is the first to employ large language models for the joint generation of invocations and tests, effectively disentangling refactoring from functional modifications. Evaluated on 183 manually annotated Java commits, the method achieves an overall accuracy of 76% and perfect precision (100%) in detecting semantic-altering changes.

Industrial applications heavily rely on open-source libraries, yet stalled community maintenance frequently leaves vulnerabilities unpatched for extended periods, posing critical software supply chain security risks. Existing approaches suffer from label scarcity, sparse feature representations, and incomplete modeling of transitive dependency relationships, hindering practical deployment in industrial settings. This paper proposes the first maintenance-activity monitoring framework that jointly models direct and transitive dependencies. It constructs fine-grained maintenance metrics from multi-source repository metadata—including commits, releases, issues, and pull requests—and introduces a graph propagation model to quantify the cross-dependency transmission of maintenance decay. Crucially, the method operates without manual labeling. Evaluated across multiple enterprise projects, it achieves early warning of high-risk stagnant libraries 3–6 months in advance, substantially reducing manual auditing effort and significantly enhancing the security and maintainability of open-source dependency ecosystems.

Although Git tags are commonly regarded as immutable references, they can in fact be altered or deleted via force pushes, thereby jeopardizing build reproducibility and software supply chain security. This study presents the first large-scale empirical analysis of tag mutability across more than 300 million public repositories, leveraging the Software Heritage dataset to identify 10.2 million tag modification events spanning 189,000 repositories. Through cross-validation with the Nixpkgs package management system, the research confirms that seven packages experienced build failures directly attributable to tag changes. The work systematically exposes the non-immutability of Git tags, quantifies their real-world impact, and offers actionable recommendations for improving software integrity and secure development practices.

This study addresses growing industry concerns about the practicality and naturalness of code generated by large language models (LLMs) by systematically examining the usage patterns and defect associations of LLM-generated code and comments in active enterprise and community repositories from 2021 to 2025. For the first time, it contrasts the distribution of LLM-generated content between these two repository types through an empirical analysis integrating multiple detection tools, code clone detection, syntactic quality assessment, and manually labeled defect data. The findings reveal that the proportion of LLM-generated code has steadily declined over time and is predominantly confined to test cases, while comment generation remains stable yet exhibits low syntactic correctness. Enterprise repositories incorporate more LLM-generated content overall, which shows virtually no direct association with known defects, suggesting that such content is characterized by low risk but high functional limitations in real-world practice.

This work addresses the critical impact of unresolved issue artifacts—such as bugs and missing documentation—on software quality in open-source projects. To overcome the limitations of existing tools, which lack systematic analysis of issue lifecycles and evolutionary patterns, we propose G-Issue, the first mining tool that integrates issue lifecycle modeling with evolution tracking. Built on a Python API, G-Issue efficiently collects and analyzes issue data from open-source repositories, achieving faster mining performance than mainstream tools while uncovering key patterns in issue evolution. The tool further enables issue prioritization and developer assignment based on evolutionary characteristics, offering both a novel methodology and empirical evidence to support quality management in open-source software development.

Current approaches to software evolution analysis and continuous integration rely heavily on test pass/fail outcomes, often overlooking fine-grained runtime behavior, which limits their ability to detect partial oracles, flaky failures, and silent performance or output drifts. This work proposes a novel paradigm—behavioral co-versioning—that jointly manages Git code history with queryable archives of runtime behavior. During test execution, method-level inputs, outputs, and performance signals are captured and stored append-only, indexed by commit and test context. By treating runtime behavior as a first-class artifact, the approach enables semantic-level differencing, behavior-aware regression localization, and historical auditing. A Python-based prototype demonstrates feasibility, successfully uncovering behavioral evolutions invisible to conventional textual diffing techniques.

This work addresses the limitations of traditional approaches in determining whether library versions are affected by vulnerabilities, which often suffer from mislabeling or missed detections and rely heavily on costly manual analysis. The authors propose a novel method that, for the first time, integrates execution trace differences from exploit attempts with the tool-calling capabilities of large language models (LLMs). Through a three-module architecture—comprising trace construction, difference exploration, and impact assessment—the approach guides the model to automatically analyze cross-version code changes and reason about vulnerability impact. It effectively handles challenges such as failed exploits and ambiguous commit messages, achieving an F1 score of 93.24% on a dataset of 224 CVEs and 25,943 library versions, significantly outperforming baseline methods like V-SZZ and LLM4SZZ.