Thesis Defence: Studying Extrinsic Bugs in Open Source Software Ecosystems through Large-Scale Empirical Analysis

Tanner Wright, supervised by Dr. Gema Rodriguez-Perez, will defend their thesis titled “Studying Extrinsic Bugs in Open Source Software Ecosystems through Large-Scale Empirical Analysis” in partial fulfillment of the requirements for the degree of Master of Science in Computer Science.

An abstract for Tanner Wright’s thesis is included below.

Defences are open to all members of the campus community as well as the general public. Registration is not required for in-person defences.

Abstract

Open-source software has become an important part of modern software development, allowing developers to build systems quicker by utilizing existing libraries, frameworks and tools. While this reuse may improve development time, it also introduces software maintenance and quality concerns since projects are not dependent on code outside their direct control. When failures do occur, it may not always be easy to understand if the root cause lies within the project’s code base or rather in external dependency, platforms, configurations or other ecosystem-level changes. This distinction is especially important in dependency-heavy ecosystems such as the Node Package Manager (npm), where software maintenance often involves understanding both local project defects as well as externally induced failures.

Prior work has coined these failures as Intrinsic bugs, where the defect is traceable to the project’s own codebases, as well as Extrinsic bugs in which the defect is introduced beyond the project’s boundaries. While these types of bugs have been studied at the commit level, Extrinsic bugs still remain very underexplored, especially at the issue-report level as well as at scale in long-living projects. As a result, there remains a limited understanding of how Extrinsic bugs evolve over time, when they tend to appear within a project’s lifecycle and what issue characteristics are associated with their occurrence.

This thesis addresses the gap through four connected contributions. We first introduce InEx-Bug, a dataset of 377 GitHub issues drawn from 103 of the most depended-upon npm repositories, with each issue manually classified as Intrinsic, Extrinsic, Not-a-bug or Unknown. Second, we developed an iii LLM-based classification framework that sets the annotation rubric as a few-shot prompt, achieving 80.47% accuracy, Macro-F1 score of 0.801 and a Cohen’s κ of 0.707 with Qwen3-30B on a stratified validation sample. Third, we then applied this framework to over 69,000 issues across eight long-lived npm projects to understand bug distribution types, lifecycle trends, and dependency-related predictors of Extrinsic bugs. The results show that bug-type distributions change substantially over lifecycle of a project, as well as the direct dependency count is a statistically significant predictor of extrinsic bug reports which the odds compounding as the number of dependencies increases. Finally, we present the InEx-Agent, an agentic tool built for researchers with LangChain and LangGraph that supports issue collection, classification, statistical summarization, SQLite storage as well as and exportation for public GitHub repositories.