Supporting practitioners in managing horizontal and vertical dependencies in large-scale software systems

Abstract

Modern software systems are nowadays based on interconnected components. A software system can be composed of multiple interacting components, such as plugin-based systems, service-oriented architectures (SOA), and microservice applications. These interactions provide complementary features that together offer a service, and may require coordinated changes across components, which we refer to as horizontal dependencies. At the same time, a component in a software system can use a set of external dependencies that manifest as external libraries and that provide a set of utilities to implement a service. For example, instead of re implementing filesystem utilities, developers can easily import a dependency that provides the same features. Changes in such external libraries may require corresponding adaptations in the client project, and we refer to these relationships as vertical dependencies. We concretely define horizontal dependencies as dependencies between the components and services of the same software system, whereas vertical dependencies are defined as dependencies between a project and the third-party libraries specified in the project's manifest file (e.g., package. json). In this thesis, horizontal and vertical dependencies are treated as two complementary forms of maintenance dependency: one within the project boundary and the other across the project boundary. While vertical and horizontal component interconnections offer significant benefits, they also introduce complex challenges that manifest in the maintenance burden of synchronizing across components and managing external dependencies. From a horizontal perspective, developers frequently need to coordinate across component boundaries - synchronizing changes with teams working on other components, collaborating on complementary code spread across multiple components to fix a bug or deliver a new feature, and ensuring that a change made in one component is properly validated by tests in other components. This cross-team coordination adds friction to daily development and, when overlooked, can result in broken builds, partial merges, and CI/CD pipeline failures. From a vertical perspective, third-party libraries frequently release updates containing new features, bug fixes, and security patches. Failing to integrate these updates promptly can render client projects unstable, introduce exploitable security flaws, and expose the client's source code to risks. This thesis investigates the maintenance dependencies of large-scale, multi-component systems through a series of empirical studies, with the goal of better understanding these dependencies, uncovering the challenges they introduce, and proposing automated approaches to support practitioners in managing such maintenance tasks. In particular, we first study how a change in one component can depend on changes in others, also known as cross-component dependencies. This study sheds light on how different components, often owned by different teams, depend on each other, highlights the challenges that arise from these dependencies, and distills practical implications for both practitioners and researchers. We then propose a machine-learning-based approach and an agentic-AI-based approach to help practitioners identify candidate changes that may be related to a given code change. Finally, we investigate vertical maintenance dependencies by examining how third-party dependency upgrades are managed in terms of upgrade strategies, time, and configuration practices to provide developers and researchers with guidance on helping practitioners better manage their dependencies. Our findings highlight the importance of maintenance dependencies, both horizontal and vertical, in modern software systems. Accordingly, the proposed recommendation system can help developers in the maintenance of such systems. We also discuss several implications of our findings and outline potential directions for future research.

Date	17 Aug 2026
Original language	American English
Awarding Institution	École de technologie supérieure
Supervisor	Mohammed Sayagh (Supervisor)