arXiv subjects

Syful Islam

Publications and source records attributed to Syful Islam.

8 recordsLinked to original sources

arXiv2026

On the Informativeness of Security Commit Messages: A Large-scale Replication Study

The informativeness of security-related commit messages is crucial for patch triage: when high, it enables the rapid distribution and deployment of security fixes. Prior research (Reis et al., 2023) reported, however, that commit messages are often too uninformative to support these activities. To assess the robustness of this negative result, we independently replicate the original study using only the information provided in the paper, without reusing any of the original artifacts (data, analysis pipeline, etc.). We retrieve \num{50673} security-related commits and analyze their informativeness using an independent re-implementation of the techniques introduced by Reis et al. For the same source (i.e., GitHub) and time period (from June 1999 to August 2022) as the original study, our replication confirms the original findings in a statistically significant way: security-related commit messages are, in general, not informative enough for security-focused purposes. We then extend the original study in several ways. Over a longer time period (from June 1999 to October 2025), we find that commit-message informativeness is worsening. Breaking results down by software ecosystem (Linux kernel, Ubuntu, Go, PyPI, etc.), we observe significant differences in informativeness. Finally, we examine emerging best practices for writing commit messages, such as the Conventional Commits Specification (CCS), and again find significant differences in an unexpected direction: CCS-compliant commits are less informative than non-compliant ones. Our findings highlight the need for cross-ecosystem analyses to understand platform- and community-specific commit-message practices, and to inform the development and adoption of universally applicable guidelines for writing informative security-related commit messages.

cs.SE↗

arXiv2026

On the Use of Commit Messages for Corrective Software Maintenance: A Systematic Mapping Study

Corrective maintenance is crucial to ensure the quality of software, thereby improving reliability and user experience. In a version control system (VCS), developers write commit messages to document their changes and support later maintenance. Still, to this day, no secondary study has mapped the research landscape of how commit messages have been used in corrective software maintenance. We present a systematic mapping study of 97 primary sources published between 2004 and May 2025, where we examine the goals, potential utilization of source code artifacts along with commit messages, methodologies, stakeholders, and the key findings about their influence on corrective maintenance. Our analysis reveals a growing interest in the usage of commit messages to perform corrective maintenance tasks, in particular for bug analysis and bug fix identification goals. Surprisingly few studies address other themes such as automated program repair, security development practices, etc. We find that the software artifacts most used in combination with commit messages are commit "diffs" and that repository mining, together with natural language processing (NLP) and artificial intelligence/machine learning (AI/ML) are the methodological foundations of studies in this field. Among stakeholders considered in previous studies, developers play the most important role in shaping corrective maintenance practices. Key findings in previous studies about commit messages establish their significant role in corrective maintenance, due to the fact that they carry crucial information helpful for stakeholders to understand and improve the code base through the software evolution process. Often, though, commit messages lack important information and are not enough to convey the intent of code changes to future readers.

cs.SE↗

arXiv2025

Hot Topics and Common Challenges: an Empirical Study of React Discussions on Stack Overflow

React is a JavaScript library used to build user interfaces for single-page applications. Although recent studies have shown the popularity and advantages of React in web development, the specific challenges users face remain unknown. Thus, this study aims to analyse the React-related questions shared on Stack Overflow. The study utilizes an exploratory data analysis to investigate the most frequently discussed keywords, error classification, and user reputation-based errors, which is the novelty of this work. The results show the top eight most frequently used keywords on React-related questions, namely, code, link, vir, href, connect, azure, windows, and website. The error classification of questions from the sample shows that algorithmic error is the most frequent issue faced by all groups of users, where mid-reputation users contribute the most, accounting for 55.77%. This suggests the need for the community to provide guidance materials in solving algorithm-related problems. We expect that the results of this study will provide valuable insight into future research to support the React community during the early stages of implementation, facilitating their ability to effectively overcome challenges to adoption.

cs.SE↗

arXiv2025

Exploring React Library Related Questions on Stack Overflow: Answered vs. Unanswered

React is a popular JavaScript framework in modern web application development. Due to its high performance and efficiency, many developers use this framework. Although React library offers many advantages, it is not without its challenges. When using React library, developers often face problems where they often seek solutions through question-and-answer forums, such as Stack Overflow (SO). However, despite its high popularity, many React-related questions on SO remain unanswered. Thus, this study aims to analyze the factors associated with question answerability and difficulty levels of React-related questions on SO. To facilitate our study, Exploratory Data Analysis was applied to 534,820 questions, where they are filtered based on 23 React-related tags. We implemented a quantitative approach through text mining and statistical analysis. A logistic regression model was used to identify attributes associated with question answerability, while a simple linear regression model was employed to examine the correlation between user reputations and performance difficulty scores (PD Score). The results show that some attributes, such as number of views, code snippet inclusion, number of lines of code, and user reputation, positively affect the likelihood of question answerability. In contrast, the number of comments, question lengths, and presence of images in React-related questions reduce the probability of a question receiving responses from users. Further investigation indicates a negative correlation between user reputations and PD Score, where reputation increase corresponds to -0.092 reduction in PD score, signaling experienced users tend to propose more complex technical inquiries. This study provides insights into the characteristics of technical question-and-answer platforms, such as SO, that users need to consider the answerability factors when posting questions related to React.

cs.SE↗

arXiv2022

An Empirical Study of Package Management Issues via Stack Overflow

The package manager (PM) is crucial to most technology stacks, acting as a broker to ensure that a verified dependency package is correctly installed, configured, or removed from an application. Diversity in technology stacks has led to dozens of PMs with various features. While our recent study indicates that package management features of PM are related to end-user experiences, it is unclear what those issues are and what information is required to resolve them. In this paper, we have investigated PM issues faced by end-users through an empirical study of content on Stack Overflow (SO). We carried out a qualitative analysis of 1,131 questions and their accepted answer posts for three popular PMs (i.e., Maven, npm, and NuGet) to identify issue types, underlying causes, and their resolutions. Our results confirm that end-users struggle with PM tool usage (approximately 64-72%). We observe that most issues are raised by end-users due to lack of instructions and errors messages from PM tools. In terms of issue resolution, we find that external link sharing is the most common practice to resolve PM issues. Additionally, we observe that links pointing to useful resources (i.e., official documentation websites, tutorials, etc.) are most frequently shared, indicating the potential for tool support and the ability to provide relevant information for PM end-users.

cs.SE↗

arXiv2021

An Exploration of npm Package Co-Usage Examples from Stack Overflow: A Case Study

Third-party package usage has become a common practice in contemporary software development. Developers often face different challenges, including choosing the right libraries, installing errors, discrepancies, setting up the environment, and building failures during software development. The risks of maintaining a third-party package are well known, but it is unclear how information from Stack Overflow (SO) can be useful. This paper performed an empirical study to explore npm co-usage in SO. From over 30,000 SO posts, we extracted 2,100 SO posts related to npm and matched them to 217,934 npm library packages. We find that, popular and highly used libraries are not discussed as often in SO. However, we can see that the accepted answers may prove useful, as we believe that the usage examples and executable commands could be reused for tool support.

cs.SE↗

arXiv2021

Contrasting Third-Party Package Management User Experience

The management of third-party package dependencies is crucial to most technology stacks, with package managers acting as brokers to ensure that a verified package is correctly installed, configured, or removed from an application. Diversity in technology stacks has led to dozens of package ecosystems with their own management features. While recent studies have shown that developers struggle to migrate their dependencies, the common assumption is that package ecosystems are used without any issue. In this study, we explore 13 package ecosystems to understand whether their features correlate with the experience of their users. By studying experience through the questions that developers ask on the question-and-answer site Stack Overflow, we find that developer questions are grouped into three themes (i.e., Package management, Input-Output, and Package Usage). Our preliminary analysis indicates that specific features are correlated with the user experience. Our work lays out future directions to investigate the trade-offs involved in designing the ideal package ecosystem.

cs.SE↗

arXiv2020

How are Project-Specific Forums Utilized? A Study of Participation, Content, and Sentiment in the Eclipse Ecosystem

Although many software development projects have moved their developer discussion forums to generic platforms such as Stack Overflow, Eclipse has been steadfast in hosting their self-supported community forums. While recent studies show forums share similarities to generic communication channels, it is unknown how project-specific forums are utilized. In this paper, we analyze 832,058 forum threads and their linkages to four systems with 2,170 connected contributors to understand the participation, content and sentiment. Results show that Seniors are the most active participants to respond bug and non-bug-related threads in the forums (i.e., 66.1% and 45.5%), and sentiment among developers are inconsistent while knowledge sharing within Eclipse. We recommend the users to identify appropriate topics and ask in a positive procedural way when joining forums. For developers, preparing project-specific forums could be an option to bridge the communication between members. Irrespective of the popularity of Stack Overflow, we argue the benefits of using project-specific forum initiatives, such as GitHub Discussions, are needed to cultivate a community and its ecosystem.

cs.SE↗