Searcharxiv⌕ Search

arXiv subjects

Wesley K. G. Assunção

Publications and source records attributed to Wesley K. G. Assunção.

At least 19 recordsLinked to original sources

Evaluating Language Models on Cross-Language Code Functional Equivalence

Background: Large Language Models (LLMs) have demonstrated strong performance across a variety of code-understanding tasks, leading many to believe that they can reason about program semantics. However, existing evaluations primarily focus on single-language settings or rely on synthetically generated code, raising concerns about whether current results reflect true semantic understanding. Aims: We investigate whether LLMs can accurately judge functional equivalence across different programming languages in human-written code, a setting that requires deeper reasoning beyond superficial similarity. Method: We introduce PolyHuman, a dataset of human-written programs in CPP, Java, and Python. Using this dataset, we evaluate intra- and inter-language equivalence detection across open-weight and proprietary LLMs, selecting GPT-o4-mini as a representative model to assess stability. We then manually analyze 81 cases of systematic disagreement in which models incorrectly judge functional equivalence, examining the code logic and the generated Chain-of-Thought reasoning. Finally, we categorize these failures and compare them across GPT-o4-mini, Claude-Opus-4.7, and Gemini-3-Flash to determine whether they reflect model-specific issues or broader limitations of state-of-the-art LLMs. Results: We identify a difficulty-dependent breakdown in equivalence judgment (harder problems make the model increasingly prone to misclassifying non-equivalent code as equivalent), a model-specific sensitivity to programming language for the best-performing model (particularly a more conservative behavior on Python), and a partial reliance on similarity-based cues. GPT-o4-mini also shows substantial run-to-run instability under identical settings, indicating inconsistent rather than absent capability. Conclusions: Current LLMs do not reliably capture functional equivalence within or across languages.

cs.SE↗

Extending Decision Maps for Sustainable Safety and Security in Self-Adaptive Systems

Sustainability refers to a system's ability to maintain its functionality and endure over time. Hence, sustainability is a highly desirable property of software systems, including Self-Adaptive Systems (SASs). SASs can change (adapt) their behavior at runtime to continue achieving their objectives despite external or internal impacts. SASs' intended long-term system behavior can be expressed through a sustainability-driven visual modeling notation called Decision Maps (DMs). Although DMs have been proven helpful, they lack adequate modeling support for safety and security concerns. We address this limitation by extending the current notation for sustainability-driven modeling of SASs to better accommodate the unique characteristics of safety and security scenarios. First, we introduce an additional modeling dimension to account for safety incidents. Second, we adopt a fine-grained divide-and-conquer approach, modeling from distinct temporal security viewpoints ("security modes") to address security. We employ the extended DM notation in a real-world use case scenario provided by our industry partner to assess its feasibility and suitability for practitioners. Our results indicate that our modeling notation helps capture security and safety scenarios more accurately and provides holistic support for the self-adaptation life cycle phases.

cs.SE↗

On the JI-RADAR: Uncovering Sustainability Tool Support for Requirements Engineering

Context: Software-intensive systems are integral to nearly all facets of modern society [1]. Consequently, both their sustainability and their role in facilitating sustainable processes must be established by design [2], [3]. Software sustainability is defined as "the preservation of the long-term and beneficial use of software, and its appropriate evolution, in a context that continuously changes" [2]. RE Problem & Motivation: Regulatory initiatives increasingly require (software) organizations to integrate sustainability into their day-to-day business and operational processes. The United Nations 2030 Agenda formulated 17 Sustainable Development Goals (SDGs) [6], while the EU passed the Corporate Sustainability Reporting Directive (CSRD), which requires companies to publish and audit sustainability-related information [7]. Regulations and laws require organizations in the software development sector to disclose both qualitative and quantitative sustainability metrics, among other obligations [1]. Consequently, integrating sustainability reporting processes into the software development life cycle becomes increasingly important. RE processes often lack systematic methods to elicit, analyze, and prioritize sustainability requirements alongside functional and non-functional requirements, and studies indicate that tool support for this integration remains limited [4]. To address this gap, we introduce JI-RADAR, which supports stakeholders involved in system design (e.g., developers, requirements engineers, project managers, and usability engineers) [5] by providing practical tools to integrate sustainability into the RE process. We extend the widely used Atlassian Jira platform [8] by implementing a ready-to-use plugin that can be directly adopted in industrial practice.

cs.SE↗

Vulnerability Detection with Interprocedural Context in Multiple Languages: Assessing Effectiveness and Cost of Modern LLMs

Large Language Models (LLMs) have been a promising way for automated vulnerability detection. However, most prior studies have explored the use of LLMs to detect vulnerabilities only within single functions, disregarding those related to interprocedural dependencies. These studies overlook vulnerabilities that arise from data and control flows that span multiple functions. Thus, leveraging the context provided by callers and callees may help identify vulnerabilities. This study empirically investigates the effectiveness of detection, the inference cost, and the quality of explanations of four modern LLMs (Claude Haiku 4.5, GPT-4.1 Mini, GPT-5 Mini, and Gemini 3 Flash) in detecting vulnerabilities related to interprocedural dependencies. To do that, we conducted an empirical study on 509 vulnerabilities from the ReposVul dataset, systematically varying the level of interprocedural context (target function code-only, target function + callers, and target function + callees) and evaluating the four modern LLMs across C, C++, and Python. The results show that Gemini 3 Flash offers the best cost-effectiveness trade-off for C vulnerabilities, achieving F1 >= 0.978 at an estimated cost of $0.50-$0.58 per configuration, and Claude Haiku 4.5 correctly identified and explained the vulnerability in 93.6% of the evaluated cases. Overall, the findings have direct implications for the design of AI-assisted security analysis tools that can generalize across codebases in multiple programming languages.

cs.SE↗

Where are the Hidden Gems? Applying Transformer Models for Design Discussion Detection

Design decisions are at the core of software engineering and appear in Q\&A forums, mailing lists, pull requests, issue trackers, and commit messages. Design discussions spanning a project's history provide valuable information for informed decision-making, such as refactoring and software modernization. Machine learning techniques have been used to detect design decisions in natural language discussions; however, their effectiveness is limited by the scarcity of labeled data and the high cost of annotation. Prior work adopted cross-domain strategies with traditional classifiers, training on one domain and testing on another. Despite their success, transformer-based models, which often outperform traditional methods, remain largely unexplored in this setting. The goal of this work is to investigate the performance of transformer-based models (i.e., BERT, RoBERTa, XLNet, LaMini-Flan-T5-77M, and ChatGPT-4o-mini) for detecting design-related discussions. To this end, we conduct a conceptual replication of prior cross-domain studies while extending them with modern transformer architectures and addressing methodological issues in earlier work. The models were fine-tuned on Stack Overflow and evaluated on GitHub artifacts (i.e., pull requests, issues, and commits). BERT and RoBERTa show strong recall across domains, while XLNet achieves higher precision but lower recall. ChatGPT-4o-mini yields the highest recall and competitive overall performance, whereas LaMini-Flan-T5-77M provides a lightweight alternative with stronger precision but less balanced performance. We also evaluated similar-word injection for data augmentation, but unlike prior findings, it did not yield meaningful improvements. Overall, these results highlight both the opportunities and trade-offs of using modern language models for detecting design discussion.

cs.SE↗

Test Code Review in the Era of GitHub Actions: A Replication Study

Test code is indispensable in software development, ensuring the correctness of production code and supporting maintainability. Nonetheless, errors or omissions in the test code can conceal production defects. While code review is widely adopted to assess code quality and correctness, little research has examined how test code is reviewed. Spadini et al.'s research on Gerrit (a pre-commit review model) found that test code receives significantly less discussion than production code. However, the most popular review model is currently based on pull requests (PRs), in which contributors propose changes for discussion and approval, a more negotiable and flexible model compared to Gerrit. Furthermore, GitHub Actions (GHA) has become widely used to automate pre-checks and testing, potentially impacting review practices. This leads us to explore whether Spadini et al.'s findings still hold for the PR model in the era of GHA? Our work replicates and extends their work. We focus on GitHub PRs and analyze six open-source projects. We investigate the impact of the PR model and GHA on test code review. Our results show that GitHub's PR model fosters more balanced discussions between test and production files than Gerrit, albeit with lower overall comment density. However, despite cross-project heterogeneity, GHA adoption triggered a sharp pivot toward production code. Post-GHA, for PRs involving tests, both review probability and comment density reached a median of zero. These findings reveal how evolving continuous integration pipelines can marginalize test code review. The observed decline in test-centric discussion under GHA warrants concern regarding long-term software quality. Our work also presents recommendations for stakeholders involved in the software development life cycle.

cs.SE↗

Brevity is the Soul of Wit: Condensing Code Changes to Improve Commit Message Generation

Commit messages are valuable resources for describing why code changes are committed to repositories in version control systems (e.g., Git). They effectively help developers understand code changes and better perform software maintenance tasks. Unfortunately, developers often neglect to write high-quality commit messages in practice. Therefore, a growing body of work is proposed to generate commit messages automatically. These works all demonstrated that how to organize and represent code changes is vital in generating good commit messages, including the use of fine-grained graphs or embeddings to better represent code changes. In this study, we choose an alternative way to condense code changes before generation, i.e., proposing brief yet concise text templates consisting of the following three parts: (1) summarized code changes, (2) elicited comments, and (3) emphasized code identifiers. Specifically, we first condense code changes by using our proposed templates with the help of a heuristic-based tool named ChangeScribe, and then fine-tune CodeLlama-7B on the pairs of our proposed templates and corresponding commit messages. Our proposed templates better utilize pre-trained language models, while being naturally brief and readable to complement generated commit messages for developers. Our evaluation based on a widely used dataset showed that our approach can outperform six baselines in terms of BLEU-Norm, METEOR, and ROUGE-L, with average improvements of 51.7%, 78.7%, and 62.5%, respectively. The ablation study and human evaluation also provide further insights into the effectiveness of our approach.

cs.SE↗

A Large-Scale Study on Developer Engagement and Expertise in Configurable Software System Projects

Modern systems operate in multiple contexts making variability a fundamental aspect of Configurable Software Systems (CSSs). Variability, implemented via pre-processor directives (e.g., #ifdef blocks) interleaved with other code and spread across files, complicates maintenance and increases error risk. Despite its importance, little is known about how variable code is distributed among developers or whether conventional expertise metrics adequately capture variable code proficiency. This study investigates developers' engagement with variable versus mandatory code, the concentration of variable code workload, and the effectiveness of expertise metrics in CSS projects. We mined repositories of 25 CSS projects, analyzing 450,255 commits from 9,678 developers. Results show that 59% of developers never modified variable code, while about 17% were responsible for developing and maintaining 83% of it. This indicates a high concentration of variable code expertise among a few developers, suggesting that task assignments should prioritize these specialists. Moreover, conventional expertise metrics performed poorly--achieving only around 55% precision and 50% recall in identifying developers engaged with variable code. Our findings highlight an unbalanced distribution of variable code responsibilities and underscore the need to refine expertise metrics to better support task assignments in CSS projects, thereby promoting a more equitable workload distribution.

cs.SE↗

Refactoring $\neq$ Bug-Inducing: Improving Defect Prediction with Code Change Tactics Analysis

Just-in-time defect prediction (JIT-DP) aims to predict the likelihood of code changes resulting in software defects at an early stage. Although code change metrics and semantic features have enhanced prediction accuracy, prior research has largely ignored code refactoring during both the evaluation and methodology phases, despite its prevalence. Refactoring and its propagation often tangle with bug-fixing and bug-inducing changes within the same commit and statement. Neglecting refactoring can introduce bias into the learning and evaluation of JIT-DP models. To address this gap, we investigate the impact of refactoring and its propagation on six state-of-the-art JIT-DP approaches. We propose Code chAnge Tactics (CAT) analysis to categorize code refactoring and its propagation, which improves labeling accuracy in the JIT-Defects4J dataset by 13.7%. Our experiments reveal that failing to consider refactoring information in the dataset can diminish the performance of models, particularly semantic-based models, by 18.6% and 37.3% in F1-score. Additionally, we propose integrating refactoring information to enhance six baseline approaches, resulting in overall improvements in recall and F1-score, with increases of up to 43.2% and 32.5%, respectively. Our research underscores the importance of incorporating refactoring information in the methodology and evaluation of JIT-DP. Furthermore, our CAT has broad applicability in analyzing refactoring and its propagation for software maintenance.

cs.SE↗

RefModel: Detecting Refactorings using Foundation Models

Refactoring is a common software engineering practice that improves code quality without altering program behavior. Although tools like ReExtractor+, RefactoringMiner, and RefDiff have been developed to detect refactorings automatically, they rely on complex rule definitions and static analysis, making them difficult to extend and generalize to other programming languages. In this paper, we investigate the viability of using foundation models for refactoring detection, implemented in a tool named RefModel. We evaluate Phi4-14B, and Claude 3.5 Sonnet on a dataset of 858 single-operation transformations applied to artificially generated Java programs, covering widely-used refactoring types. We also extend our evaluation by including Gemini 2.5 Pro and o4-mini-high, assessing their performance on 44 real-world refactorings extracted from four open-source projects. These models are compared against RefactoringMiner, RefDiff, and ReExtractor+. RefModel is competitive with, and in some cases outperform, traditional tools. In real-world settings, Claude 3.5 Sonnet and Gemini 2.5 Pro jointly identified 97% of all refactorings, surpassing the best-performing static-analysis-based tools. The models showed encouraging generalization to Python and Golang. They provide natural language explanations and require only a single sentence to define each refactoring type.

cs.SE↗

Assessing the Bug-Proneness of Refactored Code: A Longitudinal Multi-Project Study

Refactoring is a common practice in software development, aimed at improving the internal code structure in order to make it easier to understand and modify. Consequently, it is often assumed that refactoring makes the code less prone to bugs. However, in practice, refactoring is a complex task and applied in different ways (e.g., various refactoring types, single vs. composite refactorings) and with a variety of purposes (e.g., root-canal vs. floss refactoring). Therefore, certain refactorings can inadvertently make the code more prone to bugs. Unfortunately, there is limited research in the literature on the long-term relationship between the different characteristics of refactorings and bugs. This paper presents a longitudinal study of 12 open source software projects, where 27,450 refactorings, 6,051 reported bugs, and 49,250 bugs detected with static analysis tools were analyzed. While our study confirms the common intuition that refactored code is less bug-prone than non-refactored code, we also extend or contradict existing body of knowledge in other ways. First, a code element that undergoes multiple refactorings is not less bug-prone than an element that undergoes a single refactoring. A single refactoring is the one not performed in conjunction with other refactorings in the same commit. Second, single refactorings often induce the occurrence of bugs across all analyzed projects. Third, code elements affected by refactorings made in conjunction with other non-refactoring changes in the same commit (i.e., floss refactorings) are often bug-prone. Finally, many of such bugs induced by refactoring cannot be revealed with state-of-the-art techniques for detecting behavior-preserving refactorings.

cs.SE↗

Relating Complexity, Explicitness, Effectiveness of Refactorings and Non-Functional Requirements: A Replication Study

Refactoring is a practice widely adopted during software maintenance and evolution. Due to its importance, there is extensive work on the effectiveness of refactoring in achieving code quality. However, developer's intentions are usually overlooked. A more recent area of study involves the concept of self-affirmed refactoring (SAR), where developers explicitly state their intent to refactor. While studies on SAR have made valuable contributions, they provide little insights into refactoring complexity and effectiveness, as well as the refactorings' relations to specific non-functional requirements. A study by Soares et al. addressed such aspects, but it relied on a quite small sample of studied subject systems and refactoring instances. Following the empirical method of replication, we expanded the scope of Soares et al.'s study by doubling the number of projects analyzed and a significantly larger set of validated refactorings (8,408). Our findings only partially align with the original study. We observed that when developers explicitly state their refactoring intent, the resulting changes typically involve a combination of different refactoring types, making them more complex. Additionally, we confirmed that such complex refactorings positively impact code's internal quality attributes. While refactorings aimed at non-functional requirements tend to improve code quality, our findings only partially align with the original study and contradict it in several ways. Notably, SARs often result in fewer negative impacts on internal quality attributes despite their frequent complexity. These insights suggest the importance of simplifying refactorings where possible and explicitly stating their goals, as clear intent helps shape more effective and targeted refactoring strategies.

cs.SE↗

Seamless Data Migration between Database Schemas with DAMI-Framework: An Empirical Study on Developer Experience

Many businesses depend on legacy systems, which often use outdated technology that complicates maintenance and updates. Therefore, software modernization is essential, particularly data migration between different database schemas. Established methodologies, like model transformation and ETL tools, facilitate this migration; they require deep knowledge of database languages and both the source and target schemas. This necessity renders data migration an error-prone and cognitively demanding task. Our objective is to alleviate developers' workloads during schema evolution through our DAMI-Framework. This framework incorporates a domain-specific language (DSL) and a parser to facilitate data migration between database schemas. DAMI-DSL simplifies schema mapping while the parser automates SQL script generation. We assess developer experience in data migration by conducting an empirical evaluation with 21 developers to assess their experiences using our DSL versus traditional SQL. The study allows us to measure their perceptions of the DSL properties and user experience. The participants praised DAMI-DSL for its readability and ease of use. The findings indicate that our DSL reduces data migration efforts compared to SQL scripts.

cs.SE↗

An Empirical Study on Challenges of Event Management in Microservice Architectures

Microservices emerged as a popular architectural style over the last decade. Although microservices are designed to be self-contained, they must communicate to realize business capabilities, creating dependencies among their data and functionalities. Developers then resort to asynchronous, event-based communication to fulfill such dependencies while reducing coupling. However, developers are often oblivious to the inherent challenges of the asynchronous and event-based paradigm, leading to frustrations and ultimately making them reconsider the adoption of microservices. To make matters worse, there is a scarcity of literature on the practices and challenges of designing, implementing, testing, monitoring, and troubleshooting event-based microservices. To fill this gap, this paper provides the first comprehensive characterization of event management practices and challenges in microservices based on a repository mining study of over 8000 Stack Overflow questions. Moreover, 628 relevant questions were randomly sampled for an in-depth manual investigation of challenges. We find that developers encounter many problems, including large event payloads, modeling event schemas, auditing event flows, and ordering constraints in processing events. This suggests that developers are not sufficiently served by state-of-the-practice technologies. We provide actionable implications to developers, technology providers, and researchers to advance event management in microservices.

cs.SE↗

Model-based Maintenance and Evolution with GenAI: A Look into the Future

Model-Based Engineering (MBE) has streamlined software development by focusing on abstraction and automation. The adoption of MBE in Maintenance and Evolution (MBM&E), however, is still limited due to poor tool support and a lack of perceived benefits. We argue that Generative Artificial Intelligence (GenAI) can be used as a means to address the limitations of MBM&E. In this sense, we argue that GenAI, driven by Foundation Models, offers promising potential for enhancing MBM&E tasks. With this possibility in mind, we introduce a research vision that contains a classification scheme for GenAI approaches in MBM&E considering two main aspects: (i) the level of augmentation provided by GenAI and (ii) the experience of the engineers involved. We propose that GenAI can be used in MBM&E for: reducing engineers' learning curve, maximizing efficiency with recommendations, or serving as a reasoning tool to understand domain problems. Furthermore, we outline challenges in this field as a research agenda to drive scientific and practical future solutions. With this proposed vision, we aim to bridge the gap between GenAI and MBM&E, presenting a structured and sophisticated way for advancing MBM&E practices.

cs.SE↗

Contemporary Software Modernization: Perspectives and Challenges to Deal with Legacy Systems

Software modernization is an inherent activity of software engineering, as technology advances and systems inevitably become outdated. The term "software modernization" emerged as a research topic in the early 2000s, with a differentiation from traditional software evolution. Studies on this topic became popular due to new programming paradigms, technologies, and architectural styles. Given the pervasive nature of software today, modernizing legacy systems is paramount to provide users with competitive and innovative products and services. Despite the large amount of work available in the literature, there are significant limitations: (i) proposed approaches are strictly specific to one scenario or technology, lacking flexibility; (ii) most of the proposed approaches are not aligned with the current modern software development scenario; and (iii) due to a myriad of proposed modernization approaches, practitioners may be misguided on how to modernize legacies. In this work, our goal is to call attention to the need for advances in research and practices toward a well-defined software modernization domain. The focus is on enabling organizations to preserve the knowledge represented in legacy systems while taking advantages of disruptive and emerging technologies. Based on this goal, we put the different perspectives of software modernization in the context of contemporary software development. We also present a research agenda with 10 challenges to motivate new studies.

cs.SE↗

Feature-oriented Test Case Selection and Prioritization During the Evolution of Highly-Configurable Systems

Testing Highly Configurable Systems (HCSs) is a challenging task, especially in an evolution scenario where features are added, changed, or removed, which hampers test case selection and prioritization. Existing work is usually based on the variability model, which is not always available or updated. Yet, the few existing approaches rely on links between test cases and changed files (or lines of code), not considering how features are implemented, usually spread over several and unchanged files. To overcome these limitations, we introduce FeaTestSelPrio, a feature-oriented test case selection and prioritization approach for HCSs. The approach links test cases to feature implementations, using HCS pre-processor directives, to select test cases based on features affected by changes in each commit. After, the test cases are prioritized according to the number of features they cover. Our approach selects a greater number of tests and takes longer to execute than a changed-file-oriented approach, used as baseline, but FeaTestSelPrio performs better regarding detected failures. By adding the approach execution time to the execution time of the selected test cases, we reached a reduction of $\approx$50%, in comparison with retest-all. The prioritization step allows reducing the average test budget in 86% of the failed commits.

cs.SE↗

TRIAD: Automated Traceability Recovery based on Biterm-enhanced Deduction of Transitive Links among Artifacts

Traceability allows stakeholders to extract and comprehend the trace links among software artifacts introduced across the software life cycle, to provide significant support for software engineering tasks. Despite its proven benefits, software traceability is challenging to recover and maintain manually. Hence, plenty of approaches for automated traceability have been proposed. Most rely on textual similarities among software artifacts, such as those based on Information Retrieval (IR). However, artifacts in different abstraction levels usually have different textual descriptions, which can greatly hinder the performance of IR-based approaches (e.g., a requirement in natural language may have a small textual similarity to a Java class). In this work, we leverage the consensual biterms and transitive relationships (i.e., inner- and outer-transitive links) based on intermediate artifacts to improve IR-based traceability recovery. We first extract and filter biterms from all source, intermediate, and target artifacts. We then use the consensual biterms from the intermediate artifacts to extend the biterms of both source and target artifacts, and finally deduce outer and inner-transitive links to adjust text similarities between source and target artifacts. We conducted a comprehensive empirical evaluation based on five systems widely used in other literature to show that our approach can outperform four state-of-the-art approaches, and how its performance is affected by different conditions of source, intermediate, and target artifacts. The results indicate that our approach can outperform baseline approaches in AP over 15% and MAP over 10% on average.

cs.SE↗