Front-end activities in software development projects are activities conducted before the actual software development begins. Such activities are needed both to assess profitability and to ensure good project execution. This paper aims to increase our understanding of how the front-end phase in public-sector software development projects, where the execution phase has agile practices, is carried out and how its characteristics relate to project outcomes. We interviewed software professionals and analyzed documents covering the front-end phase and the outcomes of 27 Norwegian public-sector software development projects that used agile practices to varying degrees during their execution phases. The results show that the front-end phase of public-sector projects was long, milestone-driven, and largely plan-oriented, with agile practices mainly confined to the execution phase rather than the front-end. The length of the front-end phase of the projects studied was substantial, with a mean length of 2.7 years, only slightly shorter than the mean planned project duration. A longer front-end phase was associated with lower project execution success. We report on the perceived success and failure factors in the front-end phase and provide recommendations to improve it. We recommend greater flexibility in how the front-end phase is conducted and a pre-front-end phase to design its execution.
Artificial Intelligence (AI) has created new possibilities for improving Verification and Validation (V V) activities in software engineering. Among recent advances, Large Language Models (LLMs) have gained attention for their potential to automate tasks such as test generation, defect detection, and requirements analysis. Although interest in these technologies has increased, their use in industrial environments is still limited and not well understood. Concerns remain about their reliability, transparency, and ethical implications, especially when applied in safety-critical or regulated domains. This paper reports an exploratory empirical study based on a survey with 39 software professionals from different sectors and company sizes in Brazil. The questionnaire investigates the reported use of conventional V V tools, AI-based testing solutions, and LLM-supported practices, as well as perceptions of effectiveness, workflow integration, cost, and governance challenges. Respondents reported perceived benefits, such as support for automation, test-case creation, code understanding, and efficiency-oriented tasks, along with difficulties related to integration, transparency, reliability, hallucinations, over-reliance, data misuse, and governance. By documenting current practices, perceptions, and expectations, this study offers an exploratory empirical view of how AI and LLMs are being selectively incorporated into industrial V V activities in Brazil. The findings may inform discussions on responsible AI adoption in software engineering and provide preliminary, practitioner-informed insights for future research and governance-oriented decision-making. Given the exploratory design, convenience sample, and self-reported data, these findings should be interpreted as indicative perceptions rather than statistically generalizable evidence.
Architectural smells, e.g., cyclic dependencies (CDs), are widespread in software systems and pose significant challenges to maintainability, reliability and scalability. While tools can automatically detect such smells, refactoring them remains a manual and time-consuming task that developers often postpone in favor of implementing new features, which leads to increasing architectural technical debt. This paper explores the use of Large Language Models (LLMs) to support the automated refactoring of CD smells across multiple programming languages, including C#, Java, and Python. We focus on enhancing LLM-generated refactoring suggestions through prompt engineering and Retrieval-Augmented Generation (RAG), enriching the models with context-specific information. We build on tools like Arcan, Understand and Pyexamine to identify CD smells and extract resolution strategies, which are then fed to both local and cloud-based LLMs to generate refactoring proposals. The effectiveness of these proposals is qualitatively assessed through interviews with seventeen participants: ten software engineering master students and seven professional developers. Our findings show that detailed contextualization significantly improves the quality of LLM-generated suggestions and that more complex smells may benefit from an agentic approach. This study demonstrates the potential of LLMs to assist in architectural refactoring tasks and provides insights into optimizing their use through tailored prompting and retrieval techniques.
Predictive mutation testing mitigates the high computational cost of traditional mutation testing by employing prediction models to approximate mutation testing results. In its fine-grained form, predictive mutation testing predicts whether individual test cases will kill specific mutants. These predictions enable the construction of kill matrices, which is essential for downstream tasks such as test case prioritization. Existing fine-grained predictive mutation testing studies predominantly rely on deep learning, which faces two critical limitations in practice: (1) Exorbitant computational costs. The deep learning models adopted in these studies demand significant computational resources for training and inference acceleration. This introduces high costs and undermines the cost-reduction goal of predictive mutation testing. (2) Constrained applicability. Although modern mutation testing tools generate mutants both inside and outside methods, current fine-grained predictive mutation testing approaches handle only inside-method mutants. As a result, they cannot predict outside-method mutants, limiting their applicability in real-world scenarios. We aim to develop a more cost-effective and practically applicable fine-grained predictive mutation testing approach that reduces computational costs while supporting the prediction of outside-method mutants, thereby enhancing its real-world applicability. We propose WITNESS, a new fine-grained predictive mutation testing approach. WITNESS adopts a twofold design: (1) With collected features from both inside-method and outside-method mutants, WITNESS is suitable for all generated mutants. (2) Instead of using computationally expensive deep learning, WITNESS employs lightweight classical machine learning models for training and prediction. This makes it more cost-effective and enabling straightforward explanations of the decision-making processes behind the adopted models. Evaluations on Defects4J projects show that WITNESS consistently achieves state-of-the-art predictive performance across different scenarios. Additionally, WITNESS significantly enhances the efficiency of kill matrix prediction. Post-hoc analysis reveals that features incorporating information from before and after the mutation are the most important among those used in WITNESS. Test case prioritization based on the predicted kill matrix shows that WITNESS delivers results much closer to those obtained by using the actual kill matrix, outperforming baseline approaches. Compared to deep learning-based fine-grained predictive mutation testing, WITNESS is simpler yet delivers higher effectiveness, greater efficiency, and broader applicability. It advances fine-grained predictive mutation testing and sets a new baseline for future research.
Recently, data breaches have grown increasingly frequent, severe, and costly–posing substantial threats to individuals, organizations, and national infrastructure. A growing portion of these breaches are facilitated through software supply chain attacks, particularly via malicious packages uploaded to open-source repositories like the Python Package Index (PyPI). Among these, data exfiltration packages, which stealthily steal sensitive information, have emerged as a critical and underexplored threat. This paper presents the first comprehensive empirical study of malicious PyPI data exfiltration packages. We investigate five research questions to understand their prevalence, attack patterns, disguise techniques, exfiltration objectives, and the effectiveness of current detection tools. Our findings reveal a significant increase with regard to downloads counts those packages in recent years. We summarize their diverse and evolving attack patterns, sophisticated disguise techniques and their pillar objectives. Notably, many existing security tools and package vetting systems fail to detect these threats reliably. Our study highlights the urgent need for targeted defenses against data exfiltration attacks in the software supply chain.
