{
  "researchId": "JPC-26-00127",
  "researchUrl": "https://jipcet.org/r/JPC-26-00127",
  "articleUrl": "https://jipcet.org/articles/jipcet-2026-0127",
  "articleRef": "JIPCET-2026-0127",
  "externalDoi": null,
  "title": "Static Analysis Signals as Predictors of Post-Release Defects: An Empirical Study of 1.2 Million Commits",
  "authors": [
    {
      "name": "Grace Russo",
      "affiliation": "Drexel University, USA",
      "orcid": null
    },
    {
      "name": "Brian Whitfield",
      "affiliation": "University of Nebraska Omaha, USA",
      "orcid": null
    },
    {
      "name": "Karen Lindqvist",
      "affiliation": "Drexel University, USA",
      "orcid": null
    }
  ],
  "abstract": "Background. Static-analysis dashboards are widely used as leading indicators of software quality, and engineering organisations set release gates on them. The empirical basis for treating these signals as predictors of post-release defects is weaker than their operational role implies, in part because prior studies rarely control for change volume, which correlates with both signal counts and defect incidence. Objective. We estimate the predictive value of eleven commonly reported static-analysis signals for post-release defects, before and after controlling for change volume, and test whether any retain value out of sample. Methods. We assembled a commit-level dataset of 1.2 million commits from 180 open-source and industrial repositories across four languages, linking releases to post-release defect reports through a validated issue-linking heuristic (manually audited on 1,000 links, precision 0.91). We modelled defect incidence per release with mixed-effects negative-binomial regression including random intercepts for repository, and evaluated out-of-sample discrimination by repository-held-out cross-validation. Results. Ten of eleven signals were significantly associated with defects in unadjusted models. After adding change volume — lines changed, files touched and commit count — only three retained significance: cyclomatic-complexity growth in modified functions, newly introduced nullability warnings on public interfaces, and unresolved concurrency warnings. Change volume alone achieved an area under the curve of 0.71; adding all eleven signals raised it to 0.74, and adding only the three retained signals raised it to 0.735. Aggregate signal counts, the form most dashboards display, had no independent predictive value. Conclusion. Most static-analysis signal counts are proxies for how much code changed. Three signal classes carry genuine additional information, and quality gates should be rewritten around them rather than around totals.",
  "keywords": [
    "static analysis",
    "software quality",
    "empirical software engineering",
    "defect prediction",
    "mining software repositories",
    "confounding"
  ],
  "area": "Computing & Software",
  "issue": "JIPCET 2026; 3(1)",
  "pageRange": "67–96",
  "published": "2026-02-05",
  "received": "Received 30 Jun 2025",
  "version": "1.0",
  "versions": [
    {
      "version": "1.0",
      "date": "2026-02-05",
      "note": "Version of record published after editorial decision."
    }
  ],
  "articleType": "Research Article",
  "reviewStatus": "Peer reviewed under named human editorial supervision",
  "peerReviewed": true,
  "handlingRecord": "Handled by a named JIPCET editor of record, who read the manuscript, oversaw review and approved the decision.",
  "methodology": "Research Article",
  "dataAvailability": "Available from the corresponding author on reasonable request, in line with participant and organisational agreements.",
  "codeAvailability": "Analysis procedures are documented in full in the methods section of the article.",
  "referenceCount": 6,
  "references": [
    "Russo, G. (2024). Quality proxies and the change-volume confound. Empirical Software Engineering 29(1), 77–98.",
    "Whitfield, B. & Lindqvist, K. (2025). Repository-held-out validation for defect models. Proceedings of MSR, 155–167.",
    "Lindqvist, K. (2024). Warning actionability across four languages. IEEE Transactions on Software Engineering 50(11), 2790–2808.",
    "Whitfield, B. & Russo, G. (2025). Reconciling issue links with release histories. Proceedings of ICPE, 74–86.",
    "Haddad, J. (2025). Delta-form quality gates in continuous delivery. JIPCET 2(1), 30–52.",
    "Osei, P. & Tan, M. (2024). Measurement instruments and engineering incentives. Journal of Systems and Software 216, 112–130."
  ],
  "replications": "No independent replication recorded to date.",
  "corrections": "No corrections issued. Any correction is published as a new version with a dated entry in the version history.",
  "license": "CC BY 4.0",
  "fullTextHtml": "https://jipcet.org/articles/jipcet-2026-0127",
  "fullTextPdf": null,
  "publisher": {
    "name": "JIPCET Editorial Office",
    "url": "https://jipcet.org",
    "email": "editor@jipcet.org"
  },
  "journal": {
    "title": "Journal of Innovation, Product, Computing & Emerging Technologies",
    "short": "JIPCET"
  }
}