On the Use of Static Analysis to Safeguard Recursive Dependency Resolution

Modern software systems are not developed from scratch - they rely heavily on the reuse of functionality provided by libraries. Selecting the right libraries remains a challenging task. What is more, libraries themselves often depend on other libraries. Managing these transitive dependencies on libraries is risky. In this paper, we describe the problems that can occur when transitive dependencies are resolved automatically using examples from real-world programs. We then present an empirical study to assess the extent of the problem when the popular Maven tool is used, and propose an approach based on static type checking that can capture many of the problems described at build time.