HGFE: A plug-and-play heterogeneous graph feature enhancement framework for software fault localization

GVFL: Variable Level Fault Localization Using Graph Representation Learning

Fault localization is a critical phase in software testing and debugging which significantly impacts the efficiency of software fault repair. Existing fault localization research predominantly focuses on the method or statement level, while variable level localization remains less explored. Although variable level techniques offer finer-grained clues closer to root causes, current approaches typically rely on isolated statistical analysis. They fail to capture the complex structural dependencies among program entities, which limits their effectiveness in tracing error propagation. To address this, we propose GVFL, a variable level fault localization method that utilizes graph representation learning to capture complex structural dependencies. It first employs decision trees to select critical variables strongly associated with failures. Then, it constructs a variable relationship graph to capture the dependencies among these variables. Finally, it utilizes graph representation learning to compute suspiciousness scores for fault localization. To evaluate the performance of GVFL, we conduct an empirical study on 835 real faults from the widely used Defects4J v2.0.0 dataset. The results show that GVFL locates a total of 210, 566, and 844 faulty variable positions on Top-1, Top-5, and Top-10 metrics, respectively. It outperforms state-of-the-art FL techniques, including IsoVar, SmartFL, and VarDT. We further analyze the impact of different graph neural network models and variable attributes on GVFL performance. Experimental results indicate that GGAT achieves the best performance for GVFL. Furthermore, all three variable attributes significantly influence the effectiveness of GVFL, with variable value features being the most important.

Graph Neural Networks for Software Vulnerability Mining: A Review

Software vulnerability mining is important for improving software reliability and security. Compared with sequence-based models, graph neural networks (GNNs) can explicitly model program structures such as syntax, control flow, data flow, call relations, and dependency paths, and have therefore been widely studied for vulnerability detection, localization, explanation, and repair. This paper presents a PRISMA-informed structured topical review of 87 studies and addresses five research questions concerning program graph representation, homogeneous and heterogeneous GNN architectures, Graph–LLM integration, evaluation reliability, and future research directions. The reviewed evidence shows that graph-based methods are most effective when vulnerability mechanisms can be faithfully represented through explicit structural relations. However, their reported performance remains strongly affected by duplicated samples, random function-level splits, noisy labels, incomplete repository context, graph-construction errors, and weak explanation protocols. Homogeneous GNNs provide efficient structural message passing but may mix different semantic relations, whereas heterogeneous GNNs preserve relation types more explicitly at the cost of greater graph-quality and computational requirements. Graph–LLM systems can improve semantic reasoning, repository-level analysis, explanation generation, and repair support, but their benefits should be evaluated together with memory consumption, inference latency, deployment complexity, and verification cost. This review further proposes minimum requirements for reliable vulnerability benchmarks and verifiable explanations, and develops a strategic agenda covering leakage-resistant datasets, uncertainty-aware graph construction, repository-level evaluation, cost-effective Graph–LLM collaboration, and graph-guided autonomous vulnerability repair.

Balancing Richness and Reliability: An Explore-Construct-Verify Framework for API Knowledge Graph Construction

This work proposes Explore-Construct-Verify (ECV), a three-stage framework for API KG construction using large language models (LLMs), which preserves LLMs’ ability to discover domain-specific knowledge while enabling efficient post-hoc validation.

CoFiLoc: A Coarse-to-fine LLM-based framework for method-level bug localization

OptGraph: Large Language Models Enhanced Evolutionary Optimization Via Graph Retrieval-Augmented Generation

OptGraph is the first optimization agentic workflow that introduces graph retrieval-augmented generation (GraphRAG) and first constructs reusable experience as a typed graph, capturing the relationships among modeling patterns, problem formalization, implementation details, and error corrections.

LLM-Enhanced Evolutionary Dependency Graphs: A System Approach to Precise Vulnerability Propagation Tracking

With the widespread adoption of open-source software (OSS), software supply chain attacks have become increasingly sophisticated, posing severe threats to digital infrastructure. Traditional Software Composition Analysis (SCA) tools and Software Bill of Materials (SBOM) systems face critical limitations, including disconnection between static metadata and dynamic code evolution, inability to detect silent fixes and backported patches, and LLM-induced hallucinations in vulnerability detection. To address these challenges, this paper proposes the LLM-Enhanced Component Dependency Evolution Graph (CDEG) framework. The system constructs a time-aware heterogeneous graph by parsing SBOMs to establish static dependency edges and linking version lineages to model temporal evolution. Within this framework, we map code patches using a hybrid representation that fuses structural features extracted by Tree-sitter with semantic embeddings derived from a fine-tuned LLM, effectively distinguishing backported patches from code refactoring. Experimental results on the SC-Vuln-Real dataset demonstrate that our framework achieves 88.4% recall for backported patch detection and achieves an F1-Score of 93.8% in container image scanning.