Goblin: A Framework for Enriching and Querying the Maven Central Dependency Graph

This archive contains the datasets, results, and tools used for the paper "Goblin: A Framework For Enriching And Querying the Maven Central Dependency Graph".

The contents are the following:

• goblinWeaver-1.0.0.jar: Jar of the Weaver used to process the paper experiences.
• neo4j_dgmf_ap.dump: Neo4j (4.x) dump of the Maven dependency graph generated with "https://github.com/sse-labs/dgmf" as of October 06, 2023.
• experiences_results.zip: Results of the paper experiences.
• output_ecosystemDependencyMiner.zip: Output of our Maven dependency miner for a generation from scratch to October 05, 2023.
• output_1week.zip: Output of our Maven dependency miner for a one-week update.
• neo4j_ecosystemDependencyMiner.dump: Neo4j (4.x) dump of the Maven dependency graph generated with our miner as of October 05, 2023.
• osvData.zip: Json of Maven CVEs present on OSV when experiments are run (2023/12/04).
• output_1year.zip: Output of our Maven dependency miner for a one-year update.
• output_6months.zip: Output of our Maven dependency miner for a six-month update.

The Maven dependency graph was made with this miner: https://github.com/Goblin-Ecosystem/goblinDependencyMiner
The code of the goblinWeaver-1.0.0.jar is available here: https://github.com/Goblin-Ecosystem/goblinWeaver
The code of the experiments is available here: https://github.com/Goblin-Ecosystem/mavenDatasetExperiences

 Procedure for relaunching experiments (was made with java v17.0.2 and mvn v3.6.3):

1. Download the Maven dependency graph dump "neo4j_ecosystemDependencyMiner.dump".
2. Import the dump on a Neo4j 4.x database and run it.
3. Edit the neo4j.conf file of your Neo4j database containing the Maven Central graph to increase the heap max size ("dbms.memory.heap.max_size=3G").
4. Download the jar "goblinWeaver-1.0.0.jar".
5. Download the "osvData.zip", unzip it, and put it in the same folder as the neo4jEcosystemWeaver jar.
6. Run the neo4jEcosystemWeaver jar with the "noUpdate" argument (e.g., "java -Dneo4jUri="bolt://localhost:7687/" -Dneo4jUser="neo4j" -Dneo4jPassword="Password1" -jar .\goblinWeaver-1.0.0.jar noUpdate").
7. Clone the experiments GitHub repository here "https://github.com/Goblin-Ecosystem/mavenDatasetExperiences".
8. Go to the cloned MavenDatasetExperience folder and run it with "mvn clean install exec:java".