-Software ecosystems are collections of projects that are developed and evolve together in the same environment. Existing literature investigates software ecosystems as isolated entities whose boundaries do not overlap and assumes they are self-contained. However, a number of software projects are distributed in more than one ecosystem. As different aspects, e.g., success, security vulnerabilities, bugs, etc., of such crossecosystem packages can affect multiple ecosystems, we investigate the presence and characteristics of these cross-ecosystem packages in 12 large software distributions. We found a small number of packages distributed in multiple packaging ecosystems and that such packages are usually distributed in two ecosystems. These packages tend to better support with new releases certain ecosystems, while their evolution can impact a multitude of packages in other ecosystems. Finally, such packages appear to be popular with large developer communities. Index Terms-software ecosystem, software distribution, GitHub, package manager, dependency network, empirical software engineering
Software ecosystems are formed by projects that are
developed and evolve together in the same environment [
The intensive research efforts to study ecosystem evolution aim to study and address the implications that arise from problems during the evolution of packages, and more concretely how these issues propagate to the entire ecosystem due to dependencies among packages. However, there are cases where packages are distributed in more than one ecosystem. For example, the lodash package1, a utility library delivering modularity, consistency and performance, is distributed in npm2, Clojars3, Maven4 and NuGet5. So, if lodash faces any health problems or risks of discontinuation, then all four 1https://github.com/lodash/lodash 2https://www.npmjs.com/package/lodash 3https://clojars.org/cljsjs/lodash 4https://mvnrepository.com/artifact/org.webjars.npm/lodash 5https://www.nuget.org/packages/lodash/ ecosystems will be affected. The impact of such problems may differ across ecosystems depending on the packages depending on the package, either directly or transitively, within each specific ecosystem. It is therefore important to go beyond the boundaries of individual ecosystems and investigate the presence, characteristics and evolution of packages that span across multiple ecosystems.
This paper focuses on the presence and characteristics of cross-ecosystem packages. To this end, we address the following research questions:
how many ecosystems do they reside? RQ2 Do cross-ecosystem packages release with the same frequency in each ecosystem? RQ3 To what extent are cross-ecosystem packages used by other packages in each ecosystem dependency network? RQ4 Do cross-ecosystem packages have different characteristics than other packages in the ecosystem?
By answering these questions, we aim to get a better understanding of the attributes and differences, if any, of cross-ecosystem packages compared to other packages in each ecosystem.
Our dataset relies on the 2018-03-13 dump of the open
source discovery service libraries.io [
For each package in the dataset, we extracted its package information (name, package manager, etc.), versions and dependencies. We also extracted the information related to the associated git repository, such as number of stars, forks, issues, etc. Since our analyses relies on git characteristics (crossecosystem package identification and characteristics of crossecosystem versus the other packages in each ecosystem), we excluded packages without a git repository.
We identified cross-ecosystem packages by looking at their associated git repository: if (at least) two packages on two distinct ecosystems share the same git repository, then they are labelled as cross-ecosystem packages and form an x-set. This approach is more reliable than looking for packages with identical names, which would risk missing cross-ecosystem packages due to different naming conventions for the different ecosystems (e.g., name-py, name-js) and could lead to false positives (e.g., the development of package json on Cargo is unrelated to the development of json on npm).
RQ1 How prevalent are cross-ecosystem packages and in how many ecosystems do they reside?
The first research question aims to gain an initial understanding of the prevalence and spread of cross-ecosystem packages. First, we measure the number of distinct packages corresponding to the x-sets that appear in multiple ecosystems.
In the case that multiple packages in one ecosystem participate in the same x-set, we include all such packages in our analyses, thus overestimating the number of cross-ecosystem packages.
For example, if one x-set consists of 5 packages in npm and 3 packages in Maven, all pointing to the same repository, then all 8 packages are included in our analysis.
Overall, we found 15,389 packages that are identified as cross-ecosystem packages. They represent a total of 2,928 xsets. Per ecosystem, the number of cross-ecosystem packages ranges from 3 in CPAN (0.001% of the CPAN packages) to 9,313 in NPM (1.33% of the NPM packages). These numbers are reported in Table I. In all cases, these cross-ecosystem packages represent a very small fraction of all packages that are distributed in each ecosystem.
For each x-set, we identified in how many and which ecosystems its cross-ecosystem packages are distributed. Figure 1 shows the number of x-sets whose packages are distributed on 2 to 6 ecosystems. We observe that most x-sets spread over only 2 ecosystems. However, we found 276 x-sets that spread over 3 to 5 ecosystems. We also found one x-set, containing the FontAwesome6 package, that spreads over 6 ecosystems.
6https://github.com/FortAwesome/Font-Awesome 2000 s t e -xs1500 f o #1000 500 0
The second research question focuses on (cross-ecosystem) package release frequency. For each x-set X, we identified in which ecosystem e1 package p 2 X has the highest number n of releases. Then, for each other ecosystem e2, we computed the ratio between the number of releases that p0 2 X has in e2 and n. We call this ratio the support for X in e2.
Formally, assuming #releasese(X) corresponds to the number of releases that package p 2 X has in ecosystem e 2 E, supporte2 (X) =
#releasese2 (X) maxe12E #releasese1 (X)
With this definition, at least one ecosystem has a support
equal to 1, while for the remaining ecosystems in E support
ranges between [
For each x-set X, and each considered ecosystem e that distributes a package in X, we computed supporte(X).
Figure 2 shows the distribution of supporte(X) by means of violin plots. We observe different distributions, depending on the ecosystem. For instance, some ecosystems such as npm, Packagist, PyPI and Rubygems mostly have support close to the maximal value, where other ecosystems such as
Clojars and Maven mostly have support close to the minimal 1.0 value. Finally, some ecosystems stand in between, e.g., CRAN, CocoaPods, Hackage or NuGet.
These results show that maintainers tend to better support with new releases certain ecosystems, while providing less support for others. Interestingly, we found 109 x-sets (out of 2,928) that have maximal support (i.e., support = 1) for all the ecosystems their packages are distributed in.
RQ3 To what extent are cross-ecosystem packages used by other packages in each ecosystem dependency network?
One of the main reasons why packages depend on others is
to enable software reuse. Packaging ecosystems make it easier
for developers to reuse code from other packages through
dependencies. On the other hand, dependencies increase the
risk of having important security or maintainability problems
and failures [
We limited our analysis to 6 ecosystems (npm, NuGet, Cargo, Packagist, Rubygems and CRAN), because the dependency information for these ecosystems is known to be complete and accurate, while it is not necessarily the case for the other ecosystems. The total number of cross-ecosystem packages in these 6 ecosystems is 11,608, corresponding to 2,773 x-sets. For each package in these x-sets, we count the number of direct and transitive dependents (i.e., the number of other packages having a direct or transitive dependency on them) in each ecosystem the package is distributed. This number somehow represents the “potential impact” of a package.
As cross-ecosystem packages could affect dependent packages in more than one ecosystem, we compared its “global potential impact” (total number of dependents across all ecosystems) and its “maximal local impact” (maximum number of dependents within a single ecosystem).
Figures 3a and 3b show the reversed cumulative proportion of x-sets in function of their impact ratio for direct (above) and transitive (below) dependents. This ratio represents the additional impact of a package due to its presence in more than one ecosystem. The y-axis indicates the percentage of x-sets having at least the corresponding ratio value. We observe from Figure 3a that 7.7% of the x-sets (148 x-sets) have a global potential that is at least 1.2 times greater than the maximal local impact (i.e., ratio >= 1:2). For transitive dependents (Figure 3b), only 5% have a ratio greater than 1.33. Thus, a small set of x-sets can impact a multitude of other packages in other ecosystems, but this impact can be significant given the number of dependent packages; up to 54,751 direct and 332,504 transitive dependent packages.
RQ4 Do cross-ecosystem packages have different characteristics compared to other packages in the ecosystem?
With the fourth research question, we aim to investigate if the characteristics of cross-ecosystem packages are different than the characteristics of packages being distributed in a single ecosystem.
The cross-ecosystem packages only represent a small fraction (< 1%) of the total number of packages in each ecosystem. As reported in detail in Section III, only 15,389 out of 1,556,300 packages are cross ecosystem packages. To avoid any bias in our analyses when comparing the characteristics of cross-ecosystem packages with those of other packages, we generated representative samples of each ecosystem’s package population that are comparable in size with the population of cross-ecosystem packages in each ecosystem.
The research literature reports different approaches to
sample a population of software projects. For example, the
approach by Nagappan et al. [
Therefore, we implemented a random sample generation (Algorithm 1) that will preserve the characteristics of the population, i.e., if there is a predominant class in a characteristic for the entire population, we aim for this characteristic to be predominant in the random sample as well. Algorithm 1 presents the steps to generate a random sample of size S, or differ in most attributes (CocoaPods, Maven, npm, Pypi, Rubygems). Overall, cross-ecosystem packages have usually more stars, forks, watchers and contributors w.r.t. other packages in the ecosystem (see the listed attributes on the third and fourth columns of Table II). By taking into account that cross-ecosystem packages tend to be more popular based on stars, forks and watchers, and that they have a large number of dependent packages across different ecosystems (see RQ3), it is evident that these packages are very important and more in-depth analyses are required to study their evolution. originating from a population P and based on a set of attributes A. The random sample is generated (line 6) and then, the set of attributes sample same attributes is retrieved for which the random sample follows the same distribution as the entire population (line 7). If the set sample same attributes is larger than the current best (line 8), then the random sample and the set of attributes are stored (lines 9 and 11). Each time IV. CONCLUSION the algorithm fetches a new random sample, the repetitions We observed that a small fraction of the software packages counter increments (line 5); if the algorithm finds a better distributed in packaging ecosystems are also distributed in match then the counter is reset to zero (line 10). The algorithm packaging ecosystems for other programming languages. Such finishes when all attributes of the random sample follow the cross-ecosystem packages can benefit from a potentially larger same distribution as the population, or when the number of pool of contributors. On the other hand, issues in these packrepetitions without finding a better sample exceeds a threshold ages (e.g. bugs or security issues) may have a wider impact, ST (line 13). because they may affect other packages in each ecosystem in
For our analysis, we gathered a random sample for each which they are distributed. In the preliminary investigation of ecosystem according to Algorithm 1, where P is the set of non this paper, we empirically analysed the characteristics of crosscross-ecosystem packages, the sample size S is the number ecosystem packages in 12 popular programming language of cross-ecosystem packages, the stop criterion ST = 100, ecosystems. We observed that many cross-ecosystem packages and the set of attributes A contains the following information may have a potentially high impact in multiple ecosystems due provided by libraries.io for each git repository: # of versions, to the large number of other packages depending on them. repository size, # of stars, # of forks, # of open issues, # of More in-depth analyses are required to shed more light in watchers, # of contributors and longevity. We compared the the reasons for distributing packages across multiple ecosyscross-ecosystem packages with the random sample generated tems, as well as the evolution dynamics and release policy for each ecosystem by use of Mann-Whitney U tests to deter- of these packages. We also aim to study if there are sociomine which attributes are different between the two samples; technical health issues in the development teams of crossall tests were performed with = 0:05. The resulting p-values ecosystem packages. These and related aspects and questions were adjusted following Bonferroni-Holm method to control will be investigated in our future work. family-wise error rate.
ACKNOWLEDGMENT
Table II presents the different attributes for each ecosystem.
These results suggest that cross-ecosystem packages in CPAN, This research was carried out in the context of FRQCRAN and Hackage do not have different characteristics than FNRS collaborative research project R.60.04.18.F “SECOother packages, while Cargo cross-ecosystem packages only Health”, FNRS Research Credit J.0023.16 “Analysis of Softhave a larger # of stars compared to the randomly sampled ware Project Survival” and Excellence of Science project ones. For the remaining ecosystems, cross-ecosystem packages 30446992 SECO-Assist financed by FWO - Vlaanderen and are either completely different (Clojars, NuGet, Packagist), F.R.S.-FNRS.