PVAC: Package Version Activity Categorizer, Leveraging Semantic Versioning in a Heterogeneous System

<b>Context: </b>Modern open-source software ecosystems, such as those managed by GNU/Linux distributions, are composed of numerous packages developed independently by diverse communities. These ecosystems employ package management tools to facilitate software installation and dependency resolution. However, these tools lack robust mechanisms for systematically evaluating the development activity and versioning dynamics within their heterogeneous software environments.<br><b>Objective:</b> This research aims to introduce a systematic method and a prototype tool for assessing version activity within heterogeneous package manager ecosystems, enabling quantitative analysis of software package updates.<br><b>Method:</b> We developed PVAC,a <b>P</b>ackage <b>V</b>ersion<b> </b><b>A</b>ctivity <b>C</b>ategorizer, a novel approach<br>that leverages semantic versioning to surface the activity of software packages at both the system level using the Version Number Delta (VND) metric and at the package level using the Activity Categorizer. PVAC utilizes tailored regular expressions to parse semantic versioning details (epoch, major, minor, and patch versions) from diverse package version strings, thereby enabling consistent categorization and quantitative scoring of version changes.<br><b>Results</b>: PVAC was empirically evaluated using a dataset of 22,535 packages drawn from<br>recent releases of Debian and Ubuntu GNU/Linux distributions. Our findings<br>demonstrate PVAC's effectiveness for accurately categorizing versioning schemes and quantitatively measuring version activity across releases. We provide empirical evidence confirming that semantic versioning, including adapted variations, is predominantly employed across these ecosystems.<br><b>Conclusions</b>: PVAC represents an effective solution for systematically assessing and<br>monitoring the software package version activity within heterogeneous ecosystems. By providing clear metrics for software activity, PVAC aids practitioners and researchers in identifying packages requiring attention, thereby reducing security risks and technical debt.