Advances in Automated Software Quality Assurance, Defect Detection,and Codebase Reliability Engineering

Abstract

The period to date has marked a turning point for automated software quality assurance. Large language models trained on
source code moved from research curiosity to developer tooling, neural program repair systems began to outperform template
based approaches on standard benchmarks, and deep learning vulnerability detectors were subjected to the first rigorous, realistic
evaluations that exposed their limits. At the same time, a series of high profile incidents, from the SolarWinds compromise
to the Log4Shell vulnerability, shifted the focus of reliability engineering from individual services to the integrity of entire
software supply chains. Using a structured narrative review of 200 sources published to date, this paper synthesises the
principal advances of the year across four connected areas: learned representations of code, automated defect detection and
prediction, automated program repair, and test quality, together with the broader discipline of codebase reliability engineering.
It also connects these advances to adjacent research streams on reliability engineering in cyber-physical systems, anomaly and
fraud detection, continuous security validation, governance and audit automation, and platform engineering, drawing on one
hundred related studies from a consolidated peer literature published to date. For each area we summarise the key techniques,
the empirical evidence that supported or challenged them, and the industrial adoption that has begun. We then propose the
Integrated Continuous Quality Assurance (ICQA) model, a five-layer conceptual model linking data and evidence, detection,
verification and repair, delivery and runtime reliability, and governance through an upward assurance flow and a downward
feedback loop, and derive five testable propositions. We argue that the defining feature of this period was convergence: machine
learning, static analysis, testing, and operations practice began to be treated as parts of a single quality pipeline rather than as
separate disciplines. We discuss implications for research, practice, and policy, state the limitations of the review, and close
by identifying future research on the open problems that remain unresolved, including dataset realism, evaluation validity,
the security of machine generated code, and the measurement of reliability at the scale of whole ecosystems.