Measuring the impact of library dependency on maintenance

Reusing code from open-source libraries is a useful practice for developers to avoid implementing the same functionalities multiple times. However, when a library is used in another software product, it creates a dependency that may spread the security vulnerabilities of the library to the product. Most package managers have dependency managers which only perform a binary evaluation of the dependencies. Thus, developers have no information about how much products depend on a library or how much effort would be needed to replace a dependency. In this research, we propose a way to measure the degree of library dependency, as well as how much effort would be required to replace the usage of a library with another one. We leverage existing coupling metrics and revisit them in the context of library dependencies. We present two metrics to measure the coupling generated by dependencies: method invocation and aggregation coupling, and briefly discuss the next steps.