Large-scale code reuse significantly reduces both development costs and time. However, the massive share of third-party code in software projects poses new challenges, especially in terms of maintenance and security. In this paper, we propose a novel technique to specialize dependencies of Java projects, based on their actual usage. Given a project and its dependencies, we systematically identify the subset of each dependency that is necessary to build the project, and we remove the rest. As a result of this process, we package each specialized dependency in a JAR file. Then, we generate specialized dependency trees where the original dependencies are replaced by the specialized versions. This allows building the project with significantly less third-party code than the original. As a result, the specialized dependencies become a first-class concept in the software supply chain, rather than a transient artifact in an optimizing compiler toolchain. We implement our technique in a tool called DepTrim, which we evaluate with 30 notable open-source Java projects. DepTrim specializes a total of 343 (86.6%) dependencies across these projects, and successfully rebuilds each project with a specialized dependency tree. Moreover, through this specialization, DepTrim removes a total of 57,444 (42.2%) classes from the dependencies, reducing the ratio of dependency classes to project classes from 8.7x in the original projects to 5.0x after specialization. These novel results indicate that dependency specialization significantly reduces the share of third-party code in Java projects.

翻译：大规模代码复用显著降低了开发成本与时间。然而，软件项目中第三方代码的广泛使用带来了新挑战，尤其在维护与安全性方面。本文提出一种基于实际使用情况的Java项目依赖特化新技术。给定一个项目及其依赖项，我们系统性地识别构建该项目所需的每个依赖子集，并移除其余部分。通过此过程，我们将每个特化后的依赖打包为JAR文件，并生成特化依赖树，其中原始依赖被特化版本替代。这使得项目构建所需的第三方代码量远少于原始版本。由此，特化依赖成为软件供应链中的一级概念，而非编译器优化工具链中的临时产物。我们在名为DepTrim的工具中实现了该技术，并使用30个知名开源Java项目进行评估。DepTrim共特化了这些项目中的343个（86.6%）依赖，并成功使用特化依赖树重建每个项目。此外，通过这种特化，DepTrim从依赖中移除了57,444个（42.2%）类，将依赖类与项目类之比从原始项目的8.7倍降低至特化后的5.0倍。这些新颖结果表明，依赖特化能显著减少Java项目中第三方代码的占比。