Effective code review is central to maintaining software quality, yet there is limited research about how the ordering of changed files in Pull Requests (PRs) influences review effectiveness. Most popular code review tools default to alphabetical ordering, favoring predictability over contextual relevance. While prior studies examined how file position shapes reviewer attention, it remains unclear how such ordering influences cognitive load and perceived review thoroughness. This study presents the first large-scale survey of 1,355 professional developers across 182 widely used open-source projects to investigate how file ordering impacts review behavior, comprehension, and perceived effectiveness. Our mixed-methods analysis reveals that only 10.2

Generative Artificial Intelligence (GenAI) has become a central component of many development tools (e.g., GitHub Copilot) that support software practitioners across multiple programming tasks, including code completion, documentation, and bug detection. However, current research has identified significant limitations and open issues in GenAI, including reliability, non-determinism, bias, and copyright infringement. While prior work has primarily focused on assessing the technical performance of these technologies for code generation, less attention has been paid to emerging concerns of software developers, particularly in the security realm. OBJECTIVE: This work explores security concerns regarding the use of GenAI-based coding assistants by analyzing challenges voiced by developers and software enthusiasts in public online forums. METHOD: We retrieved posts, comments, and discussion threads addressing security issues in GitHub Copilot from three popular platforms, namely Stack Overflow, Reddit, and Hacker News. These discussions were clustered using BERTopic and then synthesized using thematic analysis to identify distinct categories of security concerns. RESULTS: Four major concern areas were identified, including potential data leakage, code licensing, adversarial attacks (e.g., prompt injection), and insecure code suggestions, underscoring critical reflections on the limitations and trade-offs of GenAI in software engineering. IMPLICATIONS: Our findings contribute to a broader understanding of how developers perceive and engage with GenAI-based coding assistants, while highlighting key areas for improving their built-in security features.

Context: The characteristics of software professionals have been widely investigated in the literature. However, limited attention has been given to undesirable attributes in Requirements Engineering, despite the strong dependence of this activity on stakeholder interaction and collaboration. Objective: This study investigates the undesirable attributes of requirements engineers’ hat may hinder collaboration and project success. Method: We surveyed software practitioners to identify these attributes and conducted interviews to gather supporting evidence. Results: Seventeen undesirable attributes were identified, grouped into four categories (communication issues, lack of domain knowledge, personality, and lack of technical knowledge), and organized into conceptual maps. Conclusion: The maps help requirements engineers reflect on and improve their professional practice by recognizing traits that may hinder collaboration and project outcomes.

Serverless computing is a cloud execution model where developers run code, and the server management is handled by the cloud provider. Serverless computing is increasingly gaining popularity as more systems adopt it to enhance scalability and reduce operational costs. While it has numerous benefits, it also embodies unique challenges inherent to serverless computing. One such challenge is Technical Debt (TD), which is exacerbated by the complexities of the serverless paradigm. While prior work has investigated the activities and bad practices that lead to TD in serverless computing, there remains a gap in understanding how TD manifests, the challenges it poses, and the solutions proposed to address TD issues in serverless systems. This study aims to investigate TD in the serverless context using Stack Overflow (SO) as a knowledge base. We collected 78,867 serverless questions on SO and labeled them as TD or non-TD using deep learning. Moreover, we conducted an in-depth analysis to identify types of TD in serverless settings, associated issues, and proposed solutions. We found that 37

This is the Dagstuhl Perspectives Workshop 24452 manifesto on Reframing Technical Debt. The manifesto begins with a one-page summary of Values, Beliefs, and Principles. It then elaborates on each Value, Belief, and Principle to explain their rationale and clarify their meaning. Subsequently, the paper describes the current landscape of Technical Debt Management methods and tools and explains why the current practice is inadequate and where current research falls short. The current landscape is organized into five major topics: Technical Debt as Value-Creation, Tooling, Data Collection, the role of Architecture, and Socio-Technical Aspects. Finally, the paper outlines a roadmap to realize the stated principles, with concrete milestones to be addressed by researchers, software practitioners, and tool vendors. The manifesto is signed by the workshop participants.

We reflect on our combined 15+ years of academic and industry experiences and collaborations with the software industry to discuss our perspectives from five dimensions, propose a collaborative pathway to address the industry-academia collaboration (IAC) issues highlighted, and conclude with recommendations to promote IAC.

Context and motivation: Several studies have investigated attributes of great software practitioners. However, the investigation of such attributes is still missing in Requirements Engineering (RE). The current knowledge on attributes of great software practitioners might not be easily translated to the context of RE because its activities are, usually, less technical and more human-centered than other software engineering activities. Question/problem: This work aims to investigate which are the attributes of great requirements engineers, the relationship between them, and strategies that can be employed to obtain these attributes. We follow a method composed of a survey with 18 practitioners and follow up interviews with 11 of them. Principal ideas/results: Investigative ability in talking to stakeholders, judicious, and understand the business are the most commonly mentioned attributes amongst the set of 22 attributes identified, which were grouped into four categories. We also found 38 strategies to improve RE skills. Examples are training, talking to all stakeholders, and acquiring domain knowledge. Contribution: The attributes, their categories, and relationships are organized into a map. The relations between attributes and strategies are represented in a Sankey diagram. Software practitioners can use our findings to improve their understanding about the role and responsibilities of requirements engineers.

Serverless computing has gained widespread adoption due to its scalability, cost-efficiency, and abstraction of infrastructure management. However, the shift toward event-driven, function-based architectures introduces new code quality challenges and development practices that differ from traditional paradigms. While recent research has identified serverless-specific bad practices commonly referred to as "smells," there remains a lack of automated tools to support their detection and remediation. This paper presents ServLessSense, a tool designed to detect code smells automatically in serverless applications written in JavaScript and TypeScript. Built using a custom ESLint plugin, ServLessSense identifies five serverless-specific smells, provides visualizations through an interactive dashboard, and integrates Large Language Models to offer automated refactoring suggestions. We evaluated the precision and recall of the tool using five open-source serverless applications and conducted a pilot survey study to assess its potential usefulness from the practitioners' perspective. The results indicate that ServLessSense is helpful in detecting serverless-specific smells and generating refactoring suggestions. The survey participants showed an overall favorable perspective towards ServLessSense. Tool & Data: https://doi.org/10.5281/zenodo.15477162 Demo Video: https://youtu.be/3WDCiqBpQ9c

Code review is a widely adopted quality assurance practice in software engineering, where expert reviewers assess developers' code changes before merging. While prior studies have explored review comment quality and usefulness, they often overlook the clarity and understandability of Code Change Request (CCR) comments. Unclear CCR comments can pose significant challenges for developers to address. Therefore, this study investigates the prevalence and impact of confusing or unclear CCR comments and proposes two approaches to enhance CCR communication during code review. Using a dataset of 182 open-source GitHub projects with over 55K pull requests and 466K CCR comments, we analyzed how often unclear comments occur and their effects on the review process. Our classifier, built from manually annotated developers' replies in response to CCR comments, revealed that 24% of comments led to author confusion. Statistical analysis shows that unclear CCR comments significantly increase resolution time and discussion length, and that pull requests with clear CCR comments are more likely to be addressed and merged. A manual analysis of 400 confusing CCR comments identified six key characteristics, with lack of clarity and unclear rationale being the most common. Our first approach, the confusion classifier, flags authors' confusion to enable reviewers to clarify ambiguities promptly (recall of 0.96), while the second classifier enables reviewers to evaluate the clarity and understandability of their CCR comments (recall of 0.93). This pioneering study further provides recommendations for enhancing CCR comments and offering a foundation for future research to streamline the review process.

Background: Technical Debt (TD) describes suboptimal software development practices with long-term consequences, such as defects and vulnerabilities. Deadlines are a leading cause of the emergence of TD in software systems. While multiple aspects of TD have been studied, the empirical research findings on the impact of deadlines are still inconclusive. Aims: This study investigates the impact of scheduled deadlines on TD. It analyzes how scheduled deadlines affect code quality, commit activities, and issues in issue-tracking systems. Method: We analyzed eight Open Source Software (OSS) projects with regular release schedules using SonarQube. We analyzed 12.3k commits and 371 releases across these eight OSS projects. The study combined quantitative metrics with qualitative analyses to comprehensively understand TD accumulation under scheduled deadlines. Results: Our findings indicated that some projects had a clear increase in TD as deadlines approached (with above 50% of releases having increasing TD accumulation as deadlines approached), while others managed to maintain roughly the same amount of TD. Analysis of commit activities and issue tracking revealed that deadline proximity could lead to increased commit frequency and bug-related issue creation. Conclusions: Our study highlights that, in some cases, impending deadlines have a clear impact on TD. The findings pinpoint the need to mitigate last-minute coding rushes and the risks associated with deadline-driven TD accumulation.

Mining Software Repositories (MSR) has become a popular research area recently. MSR analyzes different sources of data, such as version control systems, code repositories, defect tracking systems, archived communication, deployment logs, and so on, to uncover interesting and actionable insights from the data for improved software development, maintenance, and evolution. This chapter provides an overview of MSR and how to conduct an MSR study, including setting up a study, formulating research goals and questions, identifying repositories, extracting and cleaning the data, performing data analysis and synthesis, and discussing MSR study limitations. Furthermore, the chapter discusses MSR as part of a mixed method study, how to mine data ethically, and gives an overview of recent trends in MSR as well as reflects on the future. As a teaching aid, the chapter provides tips for educators, exercises for students at all levels, and a list of repositories that can be used as a starting point for an MSR study.

Modern Code Review (MCR) is an integral part of the software development process where developers improve product quality through collaborative discussions. Unfortunately, these discussions can sometimes become heated by the presence of inappropriate behaviors such as personal attacks, insults, disrespectful comments, and derogatory conduct, often referred to as incivility. While researchers have extensively explored such incivility in various public domains, our understanding of its causes, consequences, and courses of action remains limited within the professional context of software development, specifically within code review discussions. To bridge this gap, our study draws upon the experience of 171 professional software developers representing diverse development practices across different geographical regions. Our findings reveal that more than half of these developers (56.72%) have encountered instances of workplace incivility, and a substantial portion of that group (83.70%) reported experiencing such incidents at least once a month. We also identified various causes, positive and negative consequences, and potential courses of action for uncivil communication. Moreover, to address the negative aspects of incivility, we propose a model for promoting civility that detects uncivil comments during communication and provides alternative civil suggestions while preserving the original comments’ semantics, enabling developers to engage in respectful and constructive discussions. An in-depth analysis of 2K uncivil review comments using eight different evaluation metrics and a manual evaluation suggested that our proposed approach could generate civil alternatives significantly compared to the state-of-the-art politeness and detoxification models. Moreover, a survey involving 36 developers who used our civility model reported its effectiveness in enhancing online development interactions, fostering better relationships, increasing contributor involvement, and expediting development processes. Our research is a pioneer in generating civil alternatives for uncivil discussions in software development, opening new avenues for research in collaboration and communication within the software engineering context.

Industry practitioners assess software from a security perspective to reduce the risks of deploying vulnerable software. Besides following security best practice guidelines during the software development life cycle, predicting vulnerability before roll-out is crucial. Software metrics are popular inputs for vulnerability prediction models. The objective of this study is to provide a comprehensive review of the source code-level security metrics presented in the literature. Our systematic mapping study started with 1451 studies obtained by searching the four digital libraries from ACM, IEEE, ScienceDirect, and Springer. After applying our inclusion/exclusion criteria as well as the snowballing technique, we narrowed down 28 studies for an in-depth study to answer four research questions pertaining to our goal. We extracted a total of 685 code-level metrics. For each study, we identified the empirical methods, quality measures, types of vulnerabilities of the prediction models, and shortcomings of the work. We found that standard machine learning models, such as decision trees, regressions, and random forests, are most frequently used for vulnerability prediction. The most common quality measures are precision, recall, accuracy, and F$$ F $$-measure. Based on our findings, we conclude that the list of software metrics for measuring code-level security is not universal or generic yet. Nonetheless, the results of our study can be used as a starting point for future studies aiming at improving existing security prediction models and a catalog of metrics for vulnerability prediction for software practitioners. The objective of this study is to provide a comprehensive review of the source code-level security metrics presented in the literature. Our systematic mapping study started with 1451 studies obtained by searching the four digital libraries from ACM, IEEE, ScienceDirect, and Springer. After applying our inclusion/exclusion criteria as well as the snowballing technique, we narrowed down 28 studies for an in-depth study to answer four research questions pertaining to our goal. We extracted a total of 685 code-level metrics. For each study, we identified the empirical methods, quality measures, types of vulnerabilities of the prediction models, and shortcomings of the work. We found that standard machine learning models, such as decision trees, regressions, and random forests, are most frequently used for vulnerability prediction. The most common quality measures are precision, recall, accuracy, and F$$ F $$-measure. Based on our findings, we conclude that the list of software metrics for measuring code-level security is not universal or generic yet. Nonetheless, the results of our study can be used as a starting point for future studies aiming at improving existing security prediction models and a catalog of metrics for vulnerability prediction for software practitioners. image

Due to the large volume of data and its unstructured nature, managing user feedback via application (app) reviews is a significant challenge for Android developers. This study presents a dashboard to streamline this process using advanced machine learning and analysis techniques. The dashboard employs a fine-tuned Generative Pre-trained Transformer (GPT-3.5) model to detect and categorize issues in user reviews automatically. Additional dashboard features include sentiment and toxicity analysis to provide insights into user emotions, potentially negative feedback, and code analysis to identify code smells across different app versions. We conducted a pilot study to evaluate the usability and effectiveness of the dashboard. The results indicate that the dashboard is user-friendly and effective in helping developers manage user feedback and monitor code quality. However, certain limitations were identified, such as dependency on the quality of training data and potential inaccuracies in sentiment and toxicity analysis. This dashboard aims to aid developers in effectively managing app reviews, prioritizing issues, and maintaining high app quality to improve user satisfaction. Tool URL: https://tdresearchgroup.github.io/Review-Pulse/dashboard/ Demo Video: https://youtu.be/cT6su8dqh2g

The Android permission system regulates access to sensitive mobile device resources such as camera and location. To access these resources, third-party developers need to request permissions. However, the Android permission system is complex and fast-evolving, presenting developers with numerous challenges surrounding compatibility issues, misuse of permissions, and vulnerabilities related to permissions. Our study aims to explore whether Large Language Models (LLMs) can serve as a reliable tool to assist developers in using Android permissions correctly and securely, thereby reducing the risks of misuse and security vulnerabilities in apps. In our study, we analyzed 1,008 Stack Overflow questions related to Android permissions and their accepted answers. In parallel, we generate answers to these questions using a popular LLM tool, ChatGPT. We focused on how well the ChatGPT's responses align with the accepted answers on Stack Overflow. Our findings show that above 50% of ChatGPT's answers align with Stack Overflow's accepted answers. ChatGPT offers better-aligned responses for challenges related to Documentation and Conceptual Understanding, while it provides less aligned answers for Debugging-related issues. In addition, we found that ChatGPT provides more consistent answers for 73.27% questions. Our study demonstrates the potential for using LLMs such as ChatGPT as a supporting tool to help developers navigate Android permission-related problems.

Background: Competitive programming platforms such as LeetCode, Codeforces, and HackerRank provide challenges to evaluate programming skills. Technical recruiters frequently utilize these platforms as a criterion for screening resumes. With the recent advent of advanced Large Language Models (LLMs) like ChatGPT, Gemini, and Meta AI, there is a need to assess their problem-solving ability on the programming platforms. Aims: This study aims to assess LLMs’ capability to solve diverse programming challenges across programming platforms with varying difficulty levels, providing insights into their performance in real-time and offline scenarios, comparing them to human programmers, and identifying potential threats to established norms in programming platforms. Method: This study utilized 98 problems from LeetCode and 126 from Codeforces, covering 15 categories and varying difficulty levels. Then, we participated in nine online contests from Codeforces and LeetCode. Finally, two certification tests were attempted on HackerRank to gain insights into LLMs’ real-time performance. Prompts were used to guide LLMs in solving problems, and iterative feedback mechanisms were employed. We also tried to find any possible correlation among the LLMs in different scenarios. Results: LLMs generally achieved higher success rates on LeetCode (e.g., ChatGPT at 71.43%) but faced challenges on Codeforces. While excelling in HackerRank certifications, they struggled in virtual contests, especially on Codeforces. Despite diverse performance trends, ChatGPT consistently performed well across categories, yet all LLMs struggled with harder problems and lower acceptance rates. In LeetCode archive problems, LLMs generally outperformed users in time efficiency and memory usage but exhibited moderate performance in live contests, particularly in harder Codeforces contests compared to humans. Conclusions: While not necessarily a threat, the performance of LLMs on programming platforms is indeed a cause for concern. With the prospect of more efficient models emerging in the future, programming platforms need to address this issue promptly.

Background: The Android permission system is a set of controls to regulate access to sensitive data and platform resources (e.g., cameras). The fast-evolving nature of Android permissions and inadequate documentation result in numerous challenges for third-party developers. Aims: This study investigates the permission-related challenges developers face and the solutions provided to resolve them on the crowdsourcing platform Stack Overflow. Method: We conducted qualitative and quantitative analyses on 3,327 permission-related questions and 3,271 corresponding answers. Results: We found that most questions are related to non-evolving SDK permissions that remain constant across various Android versions, emphasizing the lack of documentation. We also classify developers’ challenges into several categories: Documentation-Related, Problems with Dependencies, Debugging, Conceptual Understanding, and Implementation Issues. Conclusions: Our study indicates the need for clear, consistent documentation to guide the use of permissions and reduce developer misunderstandings, which can lead to potential misuse of Android permissions.

In application (app) development, effectively harnessing user feedback is crucial for enhancing app quality and user feedback. However, the vast and unstructured nature of user reviews often complicates these efforts, posing challenges in accurately capturing and integrating this feedback into the development processes. We automate the classification of issues in app reviews and examine how these issues correlate with code quality metrics (code smells and bug reports) and development activities (additions, deletions, and time to merge in pull requests). We aim to provide evidence-based guidance for effectively prioritizing and addressing user feedback. Employing a Mining Software Repositories (MSR) approach, we gathered and analyzed reviews from seven open-source Android apps. We evaluated the efficacy of three machine learning models-Support Vector Machines (SVM), BERT, and a fine-tuned GPT-3.5-for classifying issues in app reviews. The GPT-3.5 model achieved the highest accuracy at 95.0%. We found statistically significant correlations between the classified issues, code quality metrics, and development activities. However, these relationships varied across applications, highlighting the complex relationship between user feedback and the development process. Our study highlights the effectiveness of automated tools in identifying and classifying feedback within app reviews. Our automated approach enhances developers' ability to manage feedback effectively and supports optimal resource allocation to improve app quality and user feedback.