2015 IEEE 23rd International Conference on Program Comprehension

VerXCombo: An interactive data visualization of
popular library version combinations
Yuki Yano, Raula Gaikovina Kula, Takashi Ishio, Katsuro Inoue
Osaka University, Japan{y-yano, raula-k, ishio, inoue}@ist.osaka-u.ac.jp

Abstract—In large software systems, it is common practice toadopt third-party libraries. Decisions by system maintainers toeither update or introduce new third-party libraries can range
from trivial to complex. For instance, incompatibility between
internal library dependencies may complicate adoption. Therefore, system maintainers especially need adequate assurance ofany candidate library release. Using the ‘wisdom of the crowd’,
VerXCombo aims to assist system maintainers by mining popularlibrary dependency patterns of similar systems. Through datainteractions, VerXCombo leverages parallel sets to break-downlarge and complex dataset into distinguishable patterns of 1.)
popular and 2.) latest library dependency release combinations.
Populating our tool with a maven library dependency dataset
from over 4,000 Java Open Source projects, we demonstrate
through a case scenario navigation and best ﬁt combinationsof the VerXCombo tool. A video highlighting the main featuresof the tool can be found at: http://goo.gl/wWPylLIndex Terms—Software reuse, Mining software repository,
Software Visualization

Library Dependency Dataset

Library Selection Page

Parallel Sets Visualization

Subset Dataset
D3.js JavaScript LibraryFig. 1. An architectural overview of VerXCombo

With the rise of OSS and its open access repositories, mining techniques have been employed to gather useful signiﬁcantamounts data on patterns of library usage. However, the datarelationships are often complex and too large to properly
visualize and navigate.
To this end, we propose VerXCombo (Version X Combination) as a prototype to present various combinations of libraryversions. Using the ‘wisdom of the crowd’ popularity metrics,
VerXCombo is able to depict different combination patterns
that allow the users to determine the best-ﬁt combination.

I. I NTRODUCTION
In software development, the adoption of third-party software libraries is becoming common-place. Beneﬁts include
reducing time and effort costs of ‘reinventing the wheel’, withthe added assurance of quality. With the expansion of libraryhosting sites such as the Maven 2 Central Repository1 for Javaand RubyGems2 , system maintainers now have open access toa vast range of Open Source System (OSS) libraries. OSS
third-party library adoption have become widespread. Usagein both open and industrial settings has validated OSS library
usage[1].
As a library evolves, maintenance issues arise as whether
to incorporate new bug ﬁxes and recent improvements andfeatures. As part of software maintenance, system maintainers
need to consider ‘if’ and ‘when’ existing libraries should beupdated to ‘which’ library version. Moreover, system maintainers are usually faced with introducing a new library. Inthis case, they need to consider how this new library will
best ‘ﬁt-in’ with the existing dependency environment. Studies
have expressed concerns of incompatibility when updating[2], [3], while examples such as the heartbleed bug3 illustrate
the widespread effect of when updates are disregarded. Thesetasks can be become extremely challenging when documentation of the system is poor or knowledge of the system is lost
due to project personnel changes.

II. V ER XC OMBO OVERVIEW
A. Architectural Design
VerXCombo is built as a platform independent web application, with an easy–to–use interface. It is implemented with
HTML5 and JavaScript for the front-end and Apache Tomcat4
and a Neo4j5 graph database for the server backend.
Figure 1 shows an architectural overview of VerXCombo.
The library dependency datasets are stored in the Neo4j
VerxCombo database. Through the web-interface, the user
initially selects a set of libraries that exist in the database. To
enable the data interaction, a subset dataset containing only
information speciﬁc to the query is returned.
From the returned subset dataset, VerXCombo employs thed3.js6 JavaScript engine to interact with the manageable subset
dataset. Displayed as parallel sets, users are then able to sort

1 http://search.maven.org/

4 http://tomcat.apache.org/

2 https://rubygems.org

5 http://neo4j.com

3 http://heartbleed.com/

6 http://d3js.org/

978-1-4673-8159-8/15 $31.00 © 2015 IEEE
DOI 10.1109/ICPC.2015.43

Web-Browser

291

Version and popularity
sorting

Library Versiondivisions

Vertical rearrangement

LibraryBar

Combination Links between
library bars. Thickness
indicates popularity
Horizontal rearrangement
Fig. 2. VerXCombo - Parallel Sets Visualizationand order different library combinations according to the 1.)
popularity and 2.) latest release sets.

Popularity use. We assume that popular use by similarsystem indicates a favorable library version to adopt.
• Latest Version. We assume that system maintainers would
like to keep ‘up-to-date’ with the current bug ﬁxes andenjoy latest features of a library.
We leverage the interactive and frequency features of VerXCombo to determine popularity the latest version release ‘bestﬁt’ combinations. Visually, the thickness of a combination sets
indicates its popularity. Figure 2 shows that VerXCombo hasboth popularity and version horizontal sorting settings. Users
can interact with the visualization to determine best-ﬁt.
•B. Library Combinations as Parallel Sets
Parallel sets serve as an interaction framework and visual
metaphor to naturally map categorical variables to visualentities [4]. As an extension of the bipartite graph, parallel sets
are an interactive exploration of categorical data that shows
data frequencies instead of the individual data points.
Figure 2 depicts a simpliﬁed example of the parallel setinteractions. Each of the three parallel bars represent a library,with the target library located on the bottom bar. The bar thenis divided into each respective library versions.
A combination link between the library bars depicts thefrequency count of systems that uses both library versions. The
thickness of the link is the propositional frequency of systems
that use the corresponding libraries.The color corresponds toa version of the target library.
As seen in Figure 2 L IBRARY C1.0 has a light blue colored combination link to L IBRARY B1.0 and L IBRARY B2.0 .
Fundamental interaction is performed by either the vertical
rearrangement of the library bars or horizontal rearrangementof the versions on the bar of the library. The mouseover event
highlights a particular combination set, also providing statistics
on this combination set.
The vertical rearrangement enables users to focus on direct
links in relation to the target library. The horizontal rearrangement of the library versions can be manipulated to show theorder of popularity (most popular to least popular usage) orthe sequence of release times (oldest to newest).

III. I LLUSTRATIVE U SAGE S CENARIO
We demonstrate the usefulness of VerXCombo in a realistic
environment setting. Using our research prototype, we perform
a use case scenario in respect to library update decisions.
A. Library Dependency Dataset
For this scenario, we populated the VerXCombo databasewith systems that depend on java libraries that are managed
and hosted on the Maven 2 Super Repository. For a representative sample, we analyzed library dependency information from4,367 projects hosted on GitHub7 . We used an extension of ourPomwalker tool8 to extract to system and library dependencies
from their respective pom.xml ﬁles. Table I provides detailsof the dataset we used to populate the VerXCombo database.
B. Real-world Scenario: Introducing a new library
System Sx is part of a web-based application, thathas existing dependencies with the Apache COMMONS COLLECTIONSverX and COMMONS - HTTPCLIENTverX .

C. Best-Fit: Popularity and Latest Version ReleaseWe recognize the following assumptions as objectives todetermine the ‘best-ﬁt’ combination of library versions:7 https://github.com
8 https://github.com/raux/PomWalker

292

TABLE II
C ASE S TUDY S CENARIO - ALL LIBRARIES ARE EXTENSIONS OF THE STANDARD JAVA SDK LIBRARY.
Library
COMMONS - COLLECTIONSHTTPCLIENT
JODA - TIME

Description
Java Utilities Library (java.util extension)
Client-side HTTP protocol library (java.net extension)Date, Time and Calender library (java.time extension)

System Environment Version
3.2
3.1-Latest Version
3.2.1
3.1
2.3

TABLE IL IBRARY D EPENDENCY DATASET# of Projects# of Systems# of Libraries# of Libraries Versions

C OMMONS - COLLECTIONS is an expansion of the JDKutility, with newer interfaces, implementations and utilities9 .
H TTPCLIENT extends on the java.net library by providing an
efﬁcient, up-to-date, and feature-rich package implementing
the client side of the most recent HTTP standards and recommendations10 .
In the next system release (i.e. Sx+1 ), the system maintainer
would like to implement a new functionality that requiresreplacing the standard Java date and time classes. The system
maintainer would like to adopt the more powerful JODA TIME11 library as a target candidate. Using VerXCombo, thesystem maintainer can now explore the most suitable library
combinations between these three libraries.
Table II depicts the version information for the respectivelibraries. The latest library version is also included. Basedon the scenario and the library dependency dataset provided,
VerXCombo can be used to evaluate the following questions:
Q1: What set of the target library version combinations‘ﬁt-in’ the current system dependency environment?
Q2a: What is the most popular combination set of libraries?
Q2b: What combination satisﬁes the closest to the latest
version combination?
Q3: Which combination is recommended to enable useof the latest target library version?

Joda-time versions {1.4, 1.6, 2.0, 2.2}

Fig. 3. Joda-time - Possible Combinations. .

→ℎ. →−

4,210
36,91029,535
151,647.

Fig. 4. Joda-time - Popular Combination

C. Findings. .

→ℎ. →−

Table III provides a brief summary of the visual ﬁndings
from the case scenario. In response to Q1, as shown in Figure
3, we ﬁnd that J ODA - TIME versions {[[1.4], 1.6], [2.0], [2.2]}
have been used by similar systems that match the current environment settings of COMMONS - COLLECTIONS3.2 ,COMMONS HTTPCLIENT3.1 . Using the mouseover event, we are able tohighlight these versions. Figure 4 depicts the most popular
combination set. Therefore to answer Q2a, the combination{COMMONS - COLLECTIONS3.2.1 , COMMONS - HTTPCLIENT3.1 ,.

9 http://commons.apache.org/proper/commons-collections/
10 http://hc.apache.org/httpcomponents-client-ga/index.html

Fig. 5. Joda-time - Latest Version Combinations

11 http://www.joda.org/joda-time/293

TABLE III
S CENARIO FINDINGS FROM V ER XC OMBO
Q1
Q2a
Q2b
Q3

Popular Target Versions
Popular Fit
Latest Fit
Latest Target

VerXCombo Recommendation[J ODA - TIME[1.4,1.6,2.0,2.2] ][ COMMONS - COLLECTIONS3.2.1 , COMMONS - HTTPCLIENT3.1 , J ODA - TIME1.6 ][ COMMONS - COLLECTIONS3.2.1 , COMMONS - HTTPCLIENT3.1 , J ODA - TIME2.2 ][ COMMONS - COLLECTIONS3.2.1 , COMMONS - HTTPCLIENT3.0.1 , J ODA - TIME2.3 ]J ODA - TIME1.6 ]} is the popular ﬁt. Do note however, thatJ ODA - TIME1.6 is a much older version so may not be thebest option.
Finding the ﬁt with respect to the latest versions(Q2b) includes the combination of the most recent releases of all libraries. In this case, the combination{COMMONS - COLLECTIONS3.2.1 , COMMONS - HTTPCLIENT3.1 ,J ODA - TIME2.2 } is recommended as the best-ﬁt. J ODA TIME 2.2 although not the latest closest to the latest version. This combination also recommends the update toCOMMONS - COLLECTIONS 3.2.1 . It is interesting to note thatthe latest version J ODA - TIME2.3 is used as a combination with an older version of COMMONS - HTTPCLIENT3.0.1 ,suggesting a downgrade one of the current libraries. Finally for Q3, COMMONS - COLLECTIONS3.2.1 , COMMONS HTTPCLIENT3.0.1 , J ODA - TIME2.3 combination is recommended for the latest version J ODA - TIME2.3 .
Ultimately, the system maintainer can use the VerXCombo
tool to make an informed decisions by exploring the different
library version combinations. Our ﬁnal recommendation iseither J ODA - TIME2.2 or J ODA - TIME2.3 with the option toupdate COMMONS - COLLECTIONS3.2.1 without compromising
any library version downgrades. Using the recommendation asa guide, system maintainers can proceed to look at documentation of the speciﬁcations to validate adoption.

Usage [7], [8]. Work by Mileva and colleagues [9] visualized
popularity trends of a single OSS library. A similar applicationof bi-partite sets has been proposed for Code Flows [10].
In our previous work [3], our results suggest that maintainers are more inclined to adopt the latest version releases.
Complementary, our other visualizations [11] includes systems
and their dependent libraries. In this work, we compare andexplore different combinations of libraries.
V. S UMMARY & F UTURE W ORK
We present VerXCombo as a tool to assist system maintainers make library maintenance decisions. We show througha real-world scenario some ‘best-ﬁt’ result combination setsof libraries. Future work includes feedback and prototype usewith real-world system maintainers.
ACKNOWLEDGMENT
This work is supported by ‘SARF’ Project, Japan Society for
the Promotion of Science, Grant-in-Aid for Scientiﬁc Research(No.25220003) and ‘Software License Evolution Analysis’,
Osaka University Program for Promoting International Joint
Research.
R EFERENCES[1] C. Ebert, “Open source software in industry,” vol. 25, no. 3, May 2008,
pp. 52–53.
[2] S. Raemaekers, A. van Deursen, and J. Visser, “Semantic versioning
versus breaking changes: A study of the maven repository,” in Proc. ofSCAM, Sept 2014, pp. 215–224.
[3] R. G. Kula, D. M. German, T. Ishio, and K. Inoue, “Trusting a library: A
study of the latency to adopt the latest maven release,” in 22nd IEEE Int.
Conf. on Soft. Ana., Evo., and Reeng., SANER 2015, Montreal, Canada,
March 2-6, 2015, 2015.
[4] F. Bendix, R. Kosara, and H. Hauser, “Parallel sets: Visual analysis ofcategorical data,” in Information Visualization, 2005. INFOVIS 2005.
IEEE Symposium on. IEEE, 2005, pp. 133–140.
[5] C. Teyton, J.-R. Falleri, M. Palyart, and X. Blanc, “A study of librarymigrations in java,” Journl of Soft.: Evo. and Pro., vol. 26, no. 11, 2014.
[6] V. Bauer, L. Heinemann, and F. Deissenboeck, “A structured approachto assess third-party library usage,” in Software Maintenance (ICSM),
2012 28th IEEE Int. Conf. on, Sept 2012, pp. 483–492.
[7] C. De Roover, R. Lämmel, and E. Pek, “Multi-dimensional explorationof api usage,” in Proc. of Int. Conf. on Prog. Comp.(ICPC), 2013.
[8] R. Holmes and R. J. Walker, “Informing Eclipse API production andconsumption,” in OOPSLA2007, 2007, pp. 70–74.
[9] Y. M. Mileva, V. Dallmeier, and A. Zeller, “Mining API popularity,” inTAIC PART, 2010, pp. 173–180.
[10] A. Telea and D. Auber, “Code ﬂows: Visualizing structural evolution ofsource code,” Computer Graphics Forum, vol. 27, no. 3, pp. 831–838,2008.
[11] R. G. Kula, C. De Roover, D. M. Germán, T. Ishio, and K. Inoue,“Visualizing the evolution of systems and their library dependencies,”
in Second IEEE Work. Conf. on Soft. Vis., 2014, Victoria, BC, Canada,Sept. 29-30, 2014, 2014, pp. 127–136.

D. Threats and Considerations
An ambitious system maintainer may decide to pioneer a
new combination set of libraries. However, most developers
may care about untested and early bugs or new releases. There
are many other factors such as the compiler, development
environment and programming language that may inﬂuence asystem maintainers decision to update a library. In this work,
we speciﬁcally target existing system dependency libraries toreduce the change of library incompatibility issues.
We demonstrate with a case scenario of maven libraries,
however, we believe that the visualization can be extended toother programming languages and their library dependencies.
Due to the large size of the dataset, we consider the data as afair representation of typical OSS projects. The case scenario
demonstrates that the tool is scalable to handle large datasets.
IV. R ELATED W ORK
There exists a large body of research that have studied
library migrations and updates such as [5], [6]. All thesestudies highlight the challenges associated with library upgrades. Our tool provide developers with more information on
speciﬁc libraries. Popularity measures have been used for API

294