Code Coverage for Java Dependencies

Sammanfattning

As software reuse continues to grow in prevalence in modern software development, external code is often integrated to efficiently implement required functionality. In the Java ecosystem, this practice is accelerated by repositories like Maven Central and build tools that automate the integration of external software packages. However, these outsourced packages, or dependencies, often include more functionality than necessary to support various use cases within their domain. The resulting unused code is a potential source of increased maintenance overhead and elevated security risks. Despite this, to our knowledge, no standalone tool currently evaluates the extent of dependency usage in Java projects. This thesis presents JACT, a tool to measure dependency usage in Java by leveraging code coverage to report usage of both the project and dependency code. This is achieved in two main steps. First, the project is built using Maven to produce an executable that contains both the project and dependency code. Second, the executable, together with the test suite's execution trace, enables the creation of the code coverage report, where JACT maps the coverage to dependencies and presents a structured overview of their usage. We evaluate JACT on 30 open-source Java projects to analyze dependency usage and assess its accuracy in mapping coverage information to dependencies. A comparison with the dependency debloating tool DepTrim provides insights into the strengths and limitations of code coverage in uncovering dependency usage. The results indicate that the dependencies are generally underutilized, with coverage increasing as alignment with project goals improves, while broader dependency feature sets lead to lower coverage. JACT accurately maps coverage to dependencies when Java package names are unique, but identical package names across dependencies introduce slight inaccuracies. Although JACT only captures coverage of executable code, it identifies additional used dependency class files compared to DepTrim, offering insights that could enhance precision in future debloating efforts in the Java ecosystem.