Nufix: Escape From NuGet Dependency Maze

Developers usually suffer from dependency maze (DM) issues, i.e., package dependency constraints are violated when a project's platform or dependencies are changed. This problem is especially serious in .NET ecosystem due to its fragmented platforms (e.g., .NET Framework, .NET Core, and .NET Standard). Fixing DM issues is challenging due to the complexity of dependency constraints: multiple DM issues often occur in one project; solving one DM issue usually causes another DM issue cropping up; the exponential search space of possible dependency combinations is also a barrier. In this paper, we aim to help .NET developers tackle the DM issues. First, we empirically studied a set of real DM issues, learning their common fixing strategies and developers' preferences in adopting these strategies. Based on these findings, we propose NuFix, an automated technique to repair DM issues. NuFix formulates the repair task as a binary integer linear optimization problem to effectively derive an optimal fix in line with the learnt developers' preferences. The experiment results and expert validation show that NuFix can generate high-quality fixes for all the DM issues with 262 popular .NET projects. Encouragingly, 20 projects (including affected projects such as Dropbox) have approved and merged our generated fixes, and shown great interests in our technique.