Selecting third-party libraries: the practitioners' perspective
Enrique Larios Vargas, Maurício Finavaro Aniche, Christoph Treude, Magiel Bruntink, Georgios Gousios
Abstract
The selection of third-party libraries is an essential element of virtually any software development project. However, deciding which libraries to choose is a challenging practical problem. Selecting the wrong library can severely impact a software project in terms of cost, time, and development effort, with the severity of the impact depending on the role of the library in the software architecture, among others. Despite the importance of following a careful library selection process, in practice, the selection of third-party libraries is still conducted in an ad-hoc manner, where dozens of factors play an influential role in the decision.
In this paper, we study the factors that influence the selection process of libraries, as perceived by industry developers. To that aim, we perform a cross-sectional interview study with 16 developers from 11 different businesses and survey 115 developers that are involved in the selection of libraries. We systematically devised a comprehensive set of 26 technical, human, and economic factors that developers take into consideration when selecting a software library. Eight of these factors are new to the literature. We explain each of these factors and how they play a role in the decision. Finally, we discuss the implications of our work to library maintainers, potential library users, package manager developers, and empirical software engineering researchers.
• Software and its engineering → Software development process management.
Ask about this paper
Your agent reads all of it.
Lune indexed this paper to the last equation, along with the top-tier papers that cite it. Ask a question and the answer quotes them.
Your agent calls
Luneget_paper_fulltext
Free to start. No credit card required.
Terminal
Install the CLIlune papers fulltext b088d09e-2b83-49cc-9366-02b13c2cb6a2Cited by top-tier papers14
- LastPyMile: identifying the discrepancy between sources and packagesDuc-Ly Vu, Fabio Massacci, Ivan Pashchenko, Henrik Plate et al.FSE 2021 · 53 citations
- A large-scale empirical study on Java library migrations: prevalence, trends, and rationalesHao He, Runzhi He, Haiqiao Gu, Minghui ZhouFSE 2021 · 47 citations
- "We Feel Like We're Winging It: " A Study on Navigating Open-Source Dependency AbandonmentCourtney Miller, Christian Kästner, Bogdan VasilescuFSE 2023 · 19 citations
- Concept-Annotated Examples for Library ComparisonLitao Yan, Miryung Kim, Bjoern Hartmann, Tianyi Zhang et al.UIST 2022 · 14 citations
- ChatGPT Incorrectness Detection in Software ReviewsMinaoar Hossain Tanzil, Junaed Younus Khan, Gias UddinICSE 2024 · 10 citations
Related papers
- A Qualitative Study on the Implementation Design Decisions of DevelopersJenny T. Liang, Maryam Arab, Minhyuk Ko, Amy J. Ko et al.ICSE 2023 · 11 citations
- A Qualitative Study of Dependency Management and Its Security ImplicationsIvan Pashchenko, Duc-Ly Vu, Fabio MassacciCCS 2020 · 84 citations
- Automated Third-Party Library Detection for Android Applications: Are We There Yet?Xian Zhan, Lingling Fan, Tianming Liu, Sen Chen et al.ASE 2020 · 55 citations
- An Exploratory Study on the Engineering of Security FeaturesKevin Hermann, Sven Peldszus, Jan-Philipp Steghöfer, Thorsten BergerICSE 2025 · 2 citations
- "I'm Pretty Expert and I Still Screw It Up": Qualitative Insights into Experiences and Challenges of Designing and Implementing Cryptographic Library APIsJuliane Schmüser, Philip Klostermeyer, Kay Friedrich, Sascha FahlS&P 2025
