  With the increasing disclosure of vulnerabilities in open-source software,
software composition analysis (SCA) has been widely applied to reveal
third-party libraries and the associated vulnerabilities in software projects.
Beyond the revelation, SCA tools adopt various remediation strategies to fix
vulnerabilities, the quality of which varies substantially. However,
ineffective remediation could induce side effects, such as compilation
failures, which impede acceptance by users. According to our studies, existing
SCA tools could not correctly handle the concerns of users regarding the
compatibility of remediated projects. To this end, we propose Compatible
Remediation of Third-party libraries (CORAL) for Maven projects to fix
vulnerabilities without breaking the projects. The evaluation proved that CORAL
not only fixed 87.56% of vulnerabilities which outperformed other tools (best
75.32%) and achieved a 98.67% successful compilation rate and a 92.96%
successful unit test rate. Furthermore, we found that 78.45% of vulnerabilities
in popular Maven projects could be fixed without breaking the compilation, and
the rest of the vulnerabilities (21.55%) could either be fixed by upgrades that
break the compilations or even be impossible to fix by upgrading.
