ABSTRACT In the rapidly evolving field of software development, open‐source software (OSS) has gained significant momentum due to its collaborative nature and emphasis on knowledge sharing. OSS source code is available under a license that allows users to inspect, improve, and modify it. In OSS, requirements are often created through informal online discussions, developer brainstorming, feature requests, and user feedback. Ambiguous or conflicting requirements can harm the software development process. The requirements engineering (RE) process in OSS faces several challenges, such as incomplete and ambiguous requirements, poor requirements prioritization, and conflicts among stakeholders over requirements. This research aims to identify and validate key challenges and their solutions within the RE process for open‐source software development (OSSD). A Multivocal Literature Review (MLR) was conducted using a customized search string aligned with our research questions (RQs). Following the MLR, an empirical study using a questionnaire survey (QS) was conducted to validate the findings. The results from the QS align with the conclusions drawn from the MLR. We identified a total of nine challenges across 47 selected articles (37 formal literature, 10 gray literature). To address these challenges, 66 practices/solutions are proposed. The best practices include involving developers and users in the RE process, along with formal requirements documentation and prioritization. The findings from this research will help OSS practitioners and academic researchers gain insights into the RE process, thereby improving it within OSS projects.
ABSTRACT Cost estimation is a critical task in software engineering and is particularly challenging in Agile projects. Although various optimization methods have been proposed to improve estimation accuracy, estimates often still deviate from actual costs. This study proposes the use of Constricted Particle Swarm Optimization (CPSO) to tune an Agile cost estimation model. Based on data from 21 industrial Agile software development projects, the model uses historical story points, team velocity, team wages, and workdays as input features. The performance of the CPSO algorithm is then systematically evaluated on this small dataset. The model is reparameterized with four tunable parameters—, and —and CPSO is applied to minimize MMRE on the training folds to obtain optimal parameter sets. Evaluation is carried out using outer fivefold cross‐validation, with hyperparameter tuning performed on the training data, and performance is compared with a standard PSO baseline and the results reported by Zia et al. The CPSO‐optimized model achieves an MMRE of (4.74% 1.89%) on test folds and a PRED (10%) of (96.00% 8.94%). The MMRE represents a 9.71% relative reduction compared with the employed baseline and a 17.71% relative reduction compared with the result reported by Zia et al. The contribution of this study lies in systematically embedding CPSO into an identifiable agile cost estimation model and evaluating it within a rigorous outer‐layer cross‐validation and ensemble prediction framework. The results indicate that CPSO can effectively tune the Agile cost estimation model within the specific dataset and experimental setting considered in this study. The findings should be interpreted as an incremental contribution based on a small industrial dataset, and they provide parameter‐level insights that may support future calibration of agile cost estimation models on larger and more heterogeneous datasets.
ABSTRACT Aligning business and IT is crucial in the software industry, where successful software projects depend not only on technology but also on management methodology. Software implementation involves development, migration, and tailoring across architecture‐based systems. The previous studies care on measuring success or failure of project methodologies without interest in system architectures and their effect on project management phases. The wrong selection of management methodology means failure of IT firms, where there is a lack in studying the success factor of selecting suitable project management methodology. Furthermore, there is no study until now that cares on searching the relationship between system architectures and project management methodologies. This paper fills this gap by finding answers for the research question “is system architecture's type one of selection factor for methodology of software project management?” This study investigates different models that measured success of the most popular project management methodologies (waterfall, agile, scrum, Kanban, Scrumban, agile‐waterfall, and DevOps) since 2019 until Jan 2026 through all three cases of software development (customization, ETO developing, migration) for three system architectures (MSA, SOA, Monolith). This study uses descriptive statistics to study the relation between system architectures and software project management. Pearson Correlation and Paired t ‐test are used to study the success of developing system architecture by management methodologies. Means and Cohen's d are also used to measure the degree of effect. The main result is that management methodology has variable significance in different cases of developing three architecture‐based systems. Selecting a system architecture is correlated and one of project management's success factors.
ABSTRACT The increasing integration of artificial intelligence (AI) within software engineering is reshaping the profession, leading to opportunities for innovation and productivity. However, while its technical advantages are clear, it is essential to consider the psychological effects AI may have. As software engineers play a crucial role in software development, any impact on their mental well‐being can profoundly affect the pace and quality of work. This study aims to investigate the psychological effects of AI adoption on software engineers, focusing on their emotional well‐being, motivation, and the broader implications for their professional identity. We conducted a qualitative survey based on online documents, such as blog posts, to identify the diversity of software developers' impressions on using AI for software engineering. We analyzed the selected documents using thematic analysis. The analysis revealed that rather than a single and uniform perception, there is a duality of positive and negative affects towards AI, which could manifest even in the same individual. These affects are generally associated with experiences that also can be positive and negative. These affects can have a profound impact on the motivation and psychological well‐being of software developers. Our results provide evidence that practitioners are excited about the increasing use of AI tools, but, at the same time, they fear the consequences of this change leading to negative feelings, such as sadness. These results indicate the need for further research on preparing practitioners for this new wave of changes.
ABSTRACT Bug report descriptions usually contain three types of key information: observed behavior, expected behavior, and steps to reproduce. These elements help developers identify, reproduce, and fix software bugs. Manually identifying them in large bug reports is time‐consuming, so automation is needed. However, existing methods mainly rely on features extracted from individual sentences and neglect contextual information, which leads to poor performance in bug report sentence classification. To address this problem, we construct a semantic knowledge base to capture contextual information and then employ a multidimensional fusion strategy to integrate features from multiple sources for bug report sentence classification. The semantic knowledge base consists of three components: a keyword co‐occurrence matrix, synonym sets, and causality pair sets, which together capture contextual information. We then fuse the semantic knowledge base features with BERT word embeddings through a cross‐attention mechanism, followed by the concatenation of discourse pattern features to improve classification accuracy. We evaluated our method on a context‐dependent dataset, achieving an accuracy of 73.4% and a Hamming loss of 0.167. Experimental results indicate that AIBRD outperforms existing methods. Compared with the state‐of‐the‐art baseline DEMIBuD‐H, AIBRD improves macro‐average accuracy by 3.3% and macro‐average F1 score by 7.0%.
The field of gamification research lacks consistency regarding the naming and categorization of methods and concepts. It also shows inconsistencies in terms of which influencing factors are considered and reported. These inconsistencies hinder the retrievability and comparability of gamification studies and encourage criticism of the research field. Current taxonomies investigate inconsistencies regarding game elements, but there is no research regarding the naming of other relevant factors such as the surrounding context and processes. Therefore, we conducted a systematic literature review to identify several factors that must be considered when conducting and reporting gamification research. We followed the Extended Taxonomy Design Process to structure our findings into a taxonomy of considerations for gamification projects and research. The result is a taxonomy with three dimensions (Context and Organization, Project Strategy, and Gamification Strategy), 12 categories, and 10 subcategories. This taxonomy can be used (1) as a road map for what to consider when planning a gamification project, (2) as a way to identify methods and tools for the implementation of gamification, and (3) as a guide for documentation when reporting gamification research.
Deep learning has revolutionized various fields, including computer vision, natural language processing, and robotics. Python, with its simplicity and extensive libraries, has emerged as one of the primary programming languages for implementing deep learning models, and several frameworks like TensorFlow, Gaffe, and PyTorch are proposed by machine learning communities/companies for Python. TensorFlow is one of the most popular frameworks in Python for deep learning; hence, it is important to investigate the kind of issue that TensorFlow developers face. In this work, we analyzed 105,437 TensorFlow questions from the Stack Overflow website and answered five research questions. Our analysis reveals that, despite a decreasing trend in the number of questions asked, there is a high level of user engagement and satisfaction in the TensorFlow community. Our tag analysis reveals that "python," "Keras," "deep-learning," "machine-learning," and "neural-network" are the top tags associated with TensorFlow questions. We perform topic analysis and reveal four main topics: machine learning and data processing, neural network and architecture, TensorFlow installation and usage, and TensorFlow manipulation and operation. Further analysis reveals that error, model training and prediction, optimization, data loading and preprocessing, and installation and deployment are among the most frequently occurring subtopics. ValueError is the most common error and the model training and prediction subtopic is the most affected by errors. Our analysis reveals that the TensorFlow installation and usage is the most popular and difficult topic. Our study also reveals a high percentage (i.e., 31%) of broken links in TensorFlow questions.
ABSTRACT Open‐source licenses grant developers significant flexibility to use, modify, and distribute code, but they also introduce obligations that may pose legal or compliance risks. Among these, copyright‐related terms are especially critical. Ensuring compliance with such terms is challenging due to the widespread use of third‐party libraries and the diversity of license types. While license‐related issues have attracted research interest, most prior work targets a narrow set of licenses and often overlooks copyright terms. To bridge this gap, we propose an automated approach for detecting copyright term violations in open‐source projects that incorporate third‐party libraries, covering a wide range of Open Source Initiative‐approved licenses. Our method extracts licenses from both projects and their dependencies, uses large language models to interpret key copyright terms, and identifies potential violations. We applied our approach to 500 popular Python projects on GitHub and found that about 10% exhibited at least one violation. These results highlight the complexity of third‐party license management and the need for improved compliance tools. By analyzing tens of thousands of licenses, we also uncovered common patterns in license usage. To foster further research and promote proactive compliance, we release our tool and dataset to the community.
ABSTRACT Mob Programming (MP) is an emerging, relatively new, and unexplored programming technique that is becoming increasingly popular and receiving attention in the software industry. It is a collaborative programming approach where the entire development team works together on a single task. This study explores the success factors (SFs) and their implementation practices for the effective use of MP in the software industry. The research was conducted in two phases: First, a multivocal literature review (MLR) analyzed formal and gray literature (GL), reviewing 76 primary studies to identify SFs and their implementation practices for adopting MP. In the second phase, an empirical survey was conducted, involving 106 software industry experts from 30 countries, to validate the MLR findings. The study identified 12 SFs, among which four factors, “professional communication and team collaboration,” “skills and wills,” “proper feedback sessions,” and “self‐organized, self‐motivated, and cooperative teams” were ranked as critical success factors (CSFs). Similarly, 126 implementation practices were discovered for the implementation of the identified SFs. The findings suggest that empirical methods are commonly used in MP studies and interest in MP has grown significantly over the past decade. The survey confirmed that the identified SFs are prevalent across projects and organizations of varying sizes. These results offer valuable insights to enhance developers' competence and promote the successful implementation of the MP in the software industry.
ABSTRACT In the rapidly evolving field of information technology (IT), blockchain‐based smart contracts have emerged as a transformative force, redefining the mechanisms of digital agreements and transactions. These self‐executing contracts, with terms directly written into code on a blockchain, promise to enhance the automation, transparency and security of business processes. The integration of smart contracts into IT businesses stands as a critical innovation, aiming to streamline operations and foster trust in digital interactions. This paper aims to identify and prioritize the key variables influencing the adoption of blockchain‐based smart contracts within IT businesses. To achieve the stated objective, initially, a systematic literature review (SLR) was conducted to identify the variables of blockchain‐based smart contracts in IT businesses. Secondly, questionnaire‐based survey was conducted with IT professionals and experts, to get the experts perceptions on identified variables. The study further applied the fuzzy analytic hierarchy process (AHP) to evaluate and prioritize the identified variables based on their significance and impact on the adoption process. The research successfully identified 16 critical variables that significantly influence the adoption of blockchain‐based smart contracts in IT businesses. These variables were categorized and analyzed to understand their roles and interdependencies in the adoption process. The fuzzy AHP results revealed a hierarchical ranking of these variables, highlighting those with the most substantial impact on successful adoption, such as “security and privacy concerns,” “technical complexity,” and “regulatory and legal challenges.” The integration of blockchain‐based smart contracts presents both opportunities and challenges for IT businesses. The identified variables and their prioritization offer a roadmap for organizations to navigate the complexities of adopting this technology.
Although abstract syntax tree (AST) path-based approaches have proven effective, the impact of node embedding initialization methods on model performance remains understudied. This work presents a comprehensive investigation of node embedding initialization for AST path-based code analysis models, proposing Syn2Vec, a semantic-aware initialization method. Our approach learns the semantic relationships between AST nodes in path contexts through a pre-training process, simultaneously capturing structural features and contextual dependencies. This generates initial embeddings that integrate both syntactic and semantic information. Syn2Vec effectively models the structural relatedness and semantic correlation between AST nodes, providing superior initialization for downstream code analysis models. Experimental results on standard code classification benchmarks demonstrate that Syn2Vec-initialized models achieve a 9.43% improvement in the F1-score compared with random initialization, conclusively establishing the importance of initialization strategies for the analysis of AST path-based code.
ABSTRACT Software reliability growth models are essential for assessing software quality, predicting failure behavior, and supporting release planning during the software development lifecycle. However, many existing models rely on simplifying assumptions, such as independent failures, perfect debugging, and fixed operational conditions, which may limit their predictive accuracy in real‐world software systems. To address these limitations, this study proposes a generalized Software Reliability Growth Model based on the Non‐Homogeneous Poisson Process framework. The proposed model integrates dependent failure behavior, testing coverage, fault detection intensity, repair intensity, and uncertainty in operational usage profiles. By incorporating fault dependency dynamics into the mean value function, the model provides a more realistic representation of how software failures occur and evolve during testing. The model parameters are estimated using the Maximum Likelihood Estimation method, and its performance is evaluated using 2 real‐world software failure datasets. Comparative analysis is conducted against several established independent and dependent failure models using multiple goodness‐of‐fit and predictive accuracy criteria, including Mean Squared Error, Mean Absolute Error, Adjusted R‐squared, Akaike Information Criterion, Root Mean Square Prediction Error, Predictive Power, Predictive Ratio Risk, and Theil Statistic. The results show that the proposed model achieves superior or highly competitive performance across both datasets, particularly in terms of error reduction and model fit. In addition, an optimal software release‐time framework is developed to examine the effect of testing cost, error removal cost, installation cost, failure penalty cost, and expected usage duration on release decisions. The findings indicate that the proposed model can support more accurate reliability assessment, cost‐sensitive release planning, and improved software quality management. Overall, the study provides a practical and analytically flexible framework for modeling software reliability under dependent failures, testing coverage variation, and operational uncertainty.
ABSTRACT Business process model and notation (BPMN) is a widely used modeling language for representing business processes. BPMN has been extended to represent particular domains or application areas, or to improve practical aspects. BPMN extensions have been the subject of recent studies. This study aims to identify and analyze the BPMN extensions proposed between 2019 and 2025 (until July). This paper followed the steps of a systematic literature review (SLR) to identify and analyze the BPMN extensions. We first performed automatic and manual search and selection process to obtain the primary studies. We also selected papers using forward and backward snowballing techniques. In this analysis, we checked whether the studies reviewed presented clear meaning for the new extended constructs, including name, formal description, purpose, and application in the proposed context. The research identified 84 studies that resulted in new BPMN extensions, analyzing essential attributes, application areas, type of extension, syntax level, and adherence to Object Management Group (OMG) standards. The results showed that 95.7% of the extensions do not preserve the original BPMN syntax, and 55% do not support the modeling of the new elements, making their adoption difficult. In addition, we found that the presentation of the extensions lacks standardization: 55% of the studies do not provide meaning, 18.8% present partial definitions, and only 26.3% offer complete and structured descriptions. These findings reinforce the need for more consistent guidelines for defining and implementing BPMN extensions, contributing to future research into the extensibility of the notation. In this paper, we presented the results of an updated SLR to identify BPMN extensions. Our goal was to improve the understanding of how BPMN has been extended through evidence in literature. We identified 84 papers that extended BPMN in the last years (2019–2025), and five research questions were answered and discussed.
ABSTRACT Biometric systems play a crucial role in institutions where security is a priority. However, there is currently no specific guideline addressing security deficiencies during their development. This study proposes an agile method for the development of biometric systems, designed to meet the strict security and privacy requirements of the ISO/IEC 24745 standard. The method combines the five phases of the Scrum methodology (initiation, planning, implementation, retrospective, and release), 19 processes from the Scrum Body of Knowledge Guide (SBOK), 120 best practices (ABP), and 19 specific activities aimed at meeting the requirements of the standard. To evaluate its effectiveness, two biometric systems were developed: one for prison record management, using the proposed method, and another for prison visit management, using traditional Scrum. Both projects were carried out by the same team of engineers. The results showed that the proposed method increased agility by 40% and improved security by 71% compared with the traditional methodology. These results highlight the method's ability to optimize both agility and security in the development of biometric systems, emphasizing its relevance in contexts where data protection and efficiency are essential.
ABSTRACT Code smells are clear indicators of design flaws that compromise maintainability, reliability, and overall performance in software systems. As systems become complex, traditional detection methods become inadequate, prompting the need for automated approaches. In this study, we evaluate the potential of conventional machine learning algorithms for detecting critical code smells. Specifically, we examine Classification and Regression Trees (CART), Gradient Boosting Classifiers, Extreme Gradient Boosting (XGBoost), RuleFit, Adaptive Boosting (AdaBoost), K ‐Nearest Neighbors (KNN), Stochastic Gradient Descent (SGD), and Random Forest to identify six key code smell categories: Large Class, Long Parameter List, Switch Statements, God Class, Data Class, and Long Method. Advanced resampling techniques such as SMOTE–ENN and SMOTE–Tomek are employed to mitigate dataset imbalances alongside tree‐based feature extraction for effective dimensionality reduction. Systematic experimentation demonstrates that SMOTE‐based strategies significantly enhance detection performance, yielding robust results across multiple evaluation metrics. By focusing on the core challenges of code smell detection, this study provides a cost‐effective alternative to deep learning methods, which often demand extensive computational resources and large labeled datasets.
ABSTRACT Context Code smells are issues in the code that can damage the code quality and adversely impact software quality attributes. The real effect of code smells on software development remains a subject of ongoing research. Objective The main purpose of this study is to analyze and uncover the previous studies on how different code smells affect software quality. This study targets the most common factors of code smell. Method This study provides a systematic review on the code smells. SLR Protocol is designed and executed accordingly. Results As a result of SLR, data were extracted from 42 research papers and as a result, a total of 11 code smells were identified. Identified code smells were analyzed based on their impact on different factors such as factors that are caused by these code smells such as why code smells are developed in software systems, how code smells generate other code smells, and which code smells still need to be addressed. Conclusion This study provided a systematic examination into the observation of code smells and their impacts on software development. The most affected factors from code smells are addressed in this research. The purpose of this research is to provide software developers and engineers with a complete understanding of code smells via SLR. Each study defines specific code smells and examines their effects on particular aspects of the code in previous research. The basic context to seeing the code smell is to find the nature and reliance of the code smell. In light of existing studies, a common issue identified by software professionals is that code smells have a significant impact on software quality, thereby degrading the overall quality of software products.
Agile processes have become a key factor in the continuously changing sector of contemporary software development, fundamentally affecting conventional project management approaches. In modern society, the global software development system has become a worldwide business, spreading daily. While integrating software engineering with agile methodologies offers benefits, it also presents several challenges. First, all possible challenges are identified from the literature via a systematic literature review (SLR). Next, these challenges are reviewed by software industries using a questionnaire survey across various types and levels of experts and then by comparing SLR and Questionnaire Survey. As a result of SLR, 18 challenges were identified from a total of 60 articles that were finalized after executing SLR protocol. The identified challenges were analyzed based on expert role, experience, and type. Further analysis of identified challenges was based on SLR result comparison with questionnaire survey results. This study tries to fill the gap between empirical results and literature findings. Results of systematic literature and empirical study will help industrial experts to have a better understanding of the effect of challenges of agile in GSD.
ABSTRACT In secure software development, time pressure has a significant impact on how people make decisions, especially when it comes to high‐stakes cybersecurity activities. As development teams adopt agile workflows and short release cycles, security‐related decisions are being made under progressively greater pressure. This paper examines the effects of time pressure on cognitive function and the caliber of decisions made in software development contexts related to cybersecurity. In addition, this review aims to identify recurrent patterns of bias, inaccuracy, and risky behavior, as well as to highlight gaps in current research and practice. Relevant articles published between 2015 and 2024 were chosen from six main academic databases, following the systematic literature review (SLR) guidelines of Kitchenham and Charters. Peer‐reviewed research on software engineering, security decision‐making, and time pressure was the emphasis of the inclusion criteria. A total of 20 core studies were analyzed using thematic synthesis. According to the review, time pressure is consistently linked to cognitive overload, stress‐induced shortcuts, and heuristic‐driven decisions, which frequently result in unsafe coding, insufficient patching, and inaccurate risk assessments. However, the impact varies depending on context, task type, and individual or team resilience. It is noteworthy that certain cognitive biases, including confirmation bias, seem to persist despite time limits, indicating that mitigation calls for more than just time management. While time pressure remains a significant risk factor in secure software development, it interacts with broader human and organizational factors. Validated therapies and team‐based and longitudinal research are lacking in the field. This review calls for human‐centered design of tools, targeted training, and cultural practices that support secure decision‐making under time pressure.
