New tool uses AI and execution testing to verify which library dependencies actually matter

Developers juggling third-party library dependencies face a familiar challenge: identifying which vulnerabilities, version updates, and breaking changes actually affect their code. Existing tools struggle with precision because they rely entirely on static analysis—reading code without running it—which often flags issues that never reach execution.

Researchers have proposed FIKA, a new approach that bridges this gap by combining static analysis with runtime verification and AI-guided code generation. The system leverages a large language model to generate test code that exercises third-party library call sites, then runs that code to collect execution traces that prove whether a particular library function is truly reachable.

How FIKA works#

The pipeline operates in stages. Static analysis identifies candidate call sites that might invoke third-party libraries. An LLM then synthesizes executable test cases designed to trigger those calls. When the generated code runs successfully, the execution trace provides concrete evidence that the dependency is active—not just theoretically possible, but actually invoked during program execution.

Empirical results#

The researchers evaluated FIKA on eight Java projects. Initial findings showed that existing test suites already provide executability evidence for 54% of library call sites. FIKA improved that baseline by 20 percentage points, successfully generating runnable scenarios for 609 additional call sites out of 1,465 that were previously uncovered. In six of the eight projects tested, FIKA demonstrated that more than 75% of call sites have executable guarantees.

Practical advantages#

The results also show FIKA outperforms both Semgrep, a static-first tool used for vulnerability reachability analysis, and Jazzer, a fuzzing-based alternative. By filtering the dependency landscape down to only those libraries that genuinely run in practice, FIKA helps teams prioritize which updates and security patches warrant immediate attention—reducing alert fatigue and focusing engineering effort where it matters most.