Designing Abandabot: When Does Open Source Dependency Abandonment Matter?

Despite the inevitable risk that depending on abandoned open source dependencies poses, many developers feel a lack of resources and guidance on how to deal with this. Automated detection of abandonment is feasible, but not all abandoned dependencies impact a downstream project equally. In this paper, we perform a needfinding interview study with 22 open source maintainers to explore what makes the abandonment of certain dependencies impactful to their project, as well as their information needs and design requirements for such an automated notification tool. We find four main factors, the depth of integration, the availability of alternatives, the importance of the functionality, and external environmental pressures. Using this emerging theory, we then build an LLM-based classifier to predict the impact of a dependency's abandonment in a given context, and evaluate it with an independent user study with 124 open source maintainers. Our results show that the classifier is effective at predicting whether a dependency's abandonment would be impactful to a project, and that theory-based explanations given by the LLM are useful to developers when making judgments about the potential impactfulness of a given dependency's abandonment.

RQ1 How does the context of a project's dependency usage affect whether that dependency's abandonment would be impactful to the project?

Research on the development of automated tools for developers has demonstrated that it is important for such tools to (1) be designed in a way that integrates organically with existing developer workflows; and (2) provide relevant succinct evidence for automatic judgments [33,48,68]. With the goal of further informing the design of a developer-centric Abandabot tool, we ask: