To enhance the compatibility in the version control of Java Third-party Libraries (TPLs), Maven adopts Semantic Versioning (SemVer) to standardize the underlying meaning of versions, but users could still confront abnormal execution and crash after upgrades even if compilation and linkage succeed. It is caused by semantic breaking (SemB) issues, such that APIs directly used by users have identical signatures but inconsistent semantics across upgrades. To strengthen compliance with SemVer rules, developers and users should be alerted of such issues. Unfortunately, it is challenging to detect them statically, because semantic changes in the internal methods of APIs are hard to be captured. Dynamic testing can confirmingly uncover some, but it is limited by inadequate coverage.

To detect SemB issues over compatible upgrades (Patch and Minor) by SemVer rules, we conducted an empirical study on 180 SemB issues to understand the root causes, inspired by which, we propose Sembid (Semantic Breaking Issue Detector) to statically detect such issues of TPLs for developers and users. Since APIs are directly used by users, Sembid detects and reports SemB issues based on APIs. For a pair of APIs, Sembid walks through the call chains originating from the API to locate breaking changes by measuring semantic diff. Then, Sembid checks if the breaking changes can affect API’s output along call chains. The evaluation showed Sembid achieved 90.26% recall and 81.29% precision and outperformed other API checkers on SemB API detection. We also revealed Sembid detected over 3 times more SemB APIs with better coverage than unit tests, the commonly used solution. Furthermore, we carried out an empirical study on 1, 629, 589 APIs from 546 version pairs of top Java libraries and found there were 2-4 times more SemB APIs than those with signature-based issues. Due to various version release strategies, 33.83% of Patch version pairs and 64.42% of Minor version pairs had at least one API affected by any breaking.

• We conducted a study to understand the root causes of SemB and summarized the patterns of benign semantic changes.

• We proposed the first static SemB issue detector (Sembid) to detect potential SemB issues against SemVer rules.

• We built a benchmark dataset of APIs for SemB detection to facilitate further research.

• We carried out a study on compliance with SemVer rules in the top 21 real-world Java libraries. We found version release strategies adopted by libraries varied greatly so that SemVer rules were not reliable for users. The prevalence of SemB proved the necessity of detecting SemB when upgrading TPLs.

• RQ1: What is the accuracy of Sembid in terms of SemB detection?

• RQ2: How is the effectiveness of Sembid against unit tests?

• RQ3: How do top Java libraries comply with SemVer rules?