Software Supply Chains are Dead: Use-Case-Oriented Regeneration

• URL: http://arxiv.org/abs/2607.13021v1
• Date: Tue, 14 Jul 2026 17:58:09 GMT
• Title: Software Supply Chains are Dead: Use-Case-Oriented Regeneration
• Abstract summary: Software supply chain attacks have raised the cost of external reliance, while generative AI has lowered the cost of local implementation.<n>We envision use-case-oriented regeneration as a new software sourcing paradigm that shifts the supply chain from external trust to local verification.
• Score: 7.037884618663316
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Modern software development relies on an increasingly doubtful premise: that the up-front implementation savings from adopting a dependency outweighs the maintenance costs. Two changes are reshaping the build-vs.-reuse calculus: software supply chain attacks have raised the cost of external reliance, while generative AI has lowered the cost of local implementation. We envision use-case-oriented regeneration as a new software sourcing paradigm that shifts the supply chain from external trust to local verification. We evaluate an agentic workflow that synthesizes only the specific slice of dependency functionality that a repository exercises. Our measurements across 180 repository-dependency pairs suggest that this approach is feasible: the replacements preserve 99.8% of repository-observed behavior across baseline validation checks and reduce the exported API surface by 93%. Software sourcing may evolve toward verifiable repository-specific code synthesis, especially when the required functionality is narrow, stable, and well tested.

Related papers

• Beyond Code Generation: Reliability, Verification, and Cost Economics in the Agentic Software Development Lifecycle [0.0]
  AI coding systems are moving from autocomplete and chat toward agents that can inspect repositories, edit multiple files, run tools, write tests, open pull requests, and work for long periods with limited supervision.<n>Recent field studies show meaningful gains in coding activity, but newer evidence also shows that those gains attenuate sharply between writing code and shipping reliable software.<n>This paper synthesizes peer-reviewed software-engineering research, university studies, benchmark audits, production reports from major technology companies, developer telemetry, and cost-management evidence.
  arXiv  Detail & Related papers  (2026-09-04T03:16:30Z)
• SWE-Gate: Passing Functional Tests Is Not Enough for Software Engineering Agents [63.65682461568621]
  We introduce SWE-Gate, a repository-level benchmark for software engineering agents that explicitly evaluates review constraint compliance alongside functional correctness.<n>SWE-Gate derives review constraints from real pull request review comments and synthesizes repository-level repair instances around these constraints.<n>Each instance provides separate functional and constraint tests, together with non-compliant and gold patches, enabling explicit separation between issue resolution capability and review constraint compliance.
  arXiv  Detail & Related papers  (2026-09-03T17:53:34Z)
• Do These Violent Delights Have Violent Ends? Measuring the Post-Merge Fate of Agentic Code [8.771752397414094]
  Agentic coding tools are increasingly used to make autonomous repository-level changes to real-world projects.<n>We conduct a longitudinal empirical analysis of agentic and human contributions across 182 repositories.<n>We find statistically significant evidence that agentic maintenance burden is associated with repository characteristics.
  arXiv  Detail & Related papers  (2026-07-10T18:45:37Z)
• Understanding by Reconstruction: Reversing the Software Development Process for LLM Pretraining [66.89012795621349]
  Large Language Models (LLMs) often struggle with the deep, long-horizon reasoning required for complex software engineering.<n>We propose a novel paradigm: understanding via reconstruction.<n>We introduce a framework that synthesizes latent agentic trajectories using a multi-agent simulation.
  arXiv  Detail & Related papers  (2026-03-11T09:23:20Z)
• ABC-Bench: Benchmarking Agentic Backend Coding in Real-World Development [72.4729759618632]
  We introduce ABC-Bench, a benchmark to evaluate agentic backend coding within a realistic, executable workflow.<n>We curated 224 practical tasks spanning 8 languages and 19 frameworks from open-source repositories.<n>Our evaluation reveals that even state-of-the-art models struggle to deliver reliable performance on these holistic tasks.
  arXiv  Detail & Related papers  (2026-01-16T08:23:52Z)
• NL2Repo-Bench: Towards Long-Horizon Repository Generation Evaluation of Coding Agents [79.29376673236142]
  Existing benchmarks fail to rigorously evaluate the long-horizon capabilities required to build complete software systems.<n>We present NL2Repo Bench, a benchmark explicitly designed to evaluate the long-horizon repository generation ability of coding agents.
  arXiv  Detail & Related papers  (2025-12-14T15:12:13Z)
• Automated Code Review Assignments: An Alternative Perspective of Code Ownership on GitHub [9.824540566919184]
  GitHub introduced the CODEOWNERS feature, which automatically designates reviewers for specific files.<n>We present the first large-scale empirical study of CODEOWNERS usage across over 844,000 pull requests with 1.9 million comments and over 2 million reviews.<n>Results indicate that codeowners tend to adhere the rules specified in the CODEOWNERS file, exhibit similar collaborative behaviours to traditional metrics of ownership, but tend to contribute to a smoother and faster PR workflow over time.
  arXiv  Detail & Related papers  (2025-12-05T09:14:22Z)
• An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chains [16.099037403682594]
  Open-source software supply chain contributes to efficient and convenient engineering practices.<n>Lack of maintenance for underlying dependencies and insufficient community auditing create challenges in ensuring source code security.<n>We propose a fine-grained project evaluation framework for backdoor risk assessment in open-source software.
  arXiv  Detail & Related papers  (2025-11-17T13:10:36Z)
• Thinking Longer, Not Larger: Enhancing Software Engineering Agents via Scaling Test-Time Compute [61.00662702026523]
  We propose a unified Test-Time Compute scaling framework that leverages increased inference-time instead of larger models.<n>Our framework incorporates two complementary strategies: internal TTC and external TTC.<n>We demonstrate our textbf32B model achieves a 46% issue resolution rate, surpassing significantly larger models such as DeepSeek R1 671B and OpenAI o1.
  arXiv  Detail & Related papers  (2025-03-31T07:31:32Z)
• Insights into Dependency Maintenance Trends in the Maven Ecosystem [0.14999444543328289]
  We present a quantitative analysis of the Neo4j dataset using the Goblin framework.<n>Our analysis reveals that releases with fewer dependencies have a higher number of missed releases.<n>Our study shows that the dependencies in the latest releases have positive freshness scores, indicating better software management efficacy.
  arXiv  Detail & Related papers  (2025-03-28T22:20:24Z)
• Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks [23.756533975349985]
  Recent high-profile incidents in open-source software have raised practitioner attention on software supply chain attacks.<n>Security practitioners advocate pinning dependency to specific versions rather than floating in version ranges.<n>We quantify, through counterfactual analysis and simulations, the security and maintenance impact of version constraints in the npm ecosystem.
  arXiv  Detail & Related papers  (2025-02-10T16:50:48Z)
• Analyzing Maintenance Activities of Software Libraries [55.2480439325792]
  Industrial applications heavily integrate open-source software libraries nowadays.<n>I want to introduce an automatic monitoring approach for industrial applications to identify open-source dependencies that show negative signs regarding their current or future maintenance activities.
  arXiv  Detail & Related papers  (2023-06-09T16:51:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.