The Brokers in a Dependency Ecosystem: An Empirical Study on using Package Managers

A package manager (PM) is crucial to most technology stacks, acting as a broker to ensure that a verified dependency package is correctly installed, configured, or removed from an application. Diversity in technology stacks has led to dozens of PMs with various features. While recent studies have shown that developers struggle to migrate their dependencies, the common assumption is that PMs broker dependencies without any issues. In this paper, we would like to explore issues faced by developers when using PMs through an empirical study of content on Stack Overflow (SO). Through a quantitative analysis of 470,806 posts related to 16 PMs, we first determine the importance of PM-related posts and extract topics contained in these posts. We then carry out a qualitative analysis of 1,131 posts related to the Maven, npm, and NuGet dependency ecosystems to analyze questions, underlying causes and their resolutions. Our results confirm that developers tend to struggle with PMs. The choice of PM affects their user experience, as questions are likely to arise from lack of instructions and error messages. We find that PM-related posts are not likely to get resolved, with only 40% to 50% having an accepted answer. Our work further lays out a road-map to investigate the trade-off between design features to understand what an ideal PM would look like.