Nufix: Escape From NuGet Dependency Maze

Developers usually suffer from dependency maze (DM) issues, i.e., package dependency constraints are violated when a project’s platform or dependencies are changed. This problem is especially serious in .NET ecosystem due to its fragmented platforms (e.g., .NET Framework, .NET Core, and .NET Standard). Fixing DM issues is challenging due to the complexity of dependency constraints: multiple DM issues often occur in one project; solving one DM issue usually causes another DM issue cropping up; the exponential search space of possible dependency combinations is also a barrier. On the other hand, as observed in our empirical study, fixing DM issues for a .NET project is, however, a challenging task, which multiple DM issues often occur in a project at the same time. For those projects with large dependency graphs, fixing such issues is a time-consuming and error prone process that exercises a series of changes in dependency constraints in response to newly induced DM issues and it is difficult for developers to imagine all possible dependency graphs affected by dependency changes, to figure out an optimal solution that satisfies their preferences.

To help .NET developers combat DM issues, we propose NuFix, an automated technique to repair DM issues. NuFix is implemented as a Visual Studio plugin, whose main features include: 1) building on top of a comprehensive study of developers’ preferences in fixing DC issues (e.g., installing fewer packages, inducing fewer risky build warnings); 2) seeking for the global optimal fixing solution based on a linear optimization model; 3) allowing developers to customize and iteratively refine the search scope of package versions based on their requirements; 4) visualizing dependency graph after adopting the derived fixes.

Our evaluation shows that NuFix can generate fixes for a given .NET project within 12 seconds and achieves a 100% fixing ratio for 262 real DC issues. We invited ten experienced .NET experts working in a leading IT enterprise to evaluate the quality our generated fixes. Their feedback indicates that the generated fixes meet the developers’ desired properties for the build management. Encouragingly, 20 projects (including affected projects such as Dropbox) have approved and merged our generated fixes, and shown great interests in our technique.