Functional programming provides strong foundations for developing reliable and secure software systems, yet its adoption remains limited because of its steep learning curve. Recent advances in Large Language Models (LLMs) for code generation present new opportunities to lower these barriers. However, most evaluations of LLMs focus on imperative programming languages, and their capabilities in functional programming languages remain under-explored. To address this gap, we introduce FPEval, a holistic evaluation framework equipped with FPBench, a new benchmark of 721 programming tasks across three difficulty levels and three mainstream functional programming languages: Haskell, OCaml, and Scala. FPEval combines comprehensive executable test suites with static-analysis tools to assess both functional correctness and code style and maintainability. Using this framework, we evaluate seven state-of-the-art LLMs, including GPT-5 and Claude Opus 4.6, on functional programming tasks, with Java included as an imperative baseline. Our results demonstrate that LLM performance in functional programming improves substantially with model advancement; however, error rates remain significantly higher in functional-first languages (Haskell and OCaml) than in hybrid (Scala) or imperative (Java) languages. More critically, LLMs frequently generate non-idiomatic functional code that follows imperative patterns, raising concerns about code style and maintainability. Finally, we show that LLMs can partially self-repair both correctness and quality issues when provided with static-analysis feedback and hand-crafted instructions targeting common issue types, paving the way for future improvements.

A single vulnerability in a widely used library can cascade through millions of dependent applications, yet more than half of vulnerability database entries contain missing or incorrect affected-library information. Existing automated approaches neglect the relational structure of vulnerability databases, treating identification as an isolated text retrieval problem. In this paper, we propose Athena, the first graph-based approach for vulnerability-affected library identification. Athena models vulnerability databases as a knowledge graph and reformulates the identification problem as knowledge graph completion (KGC). It comprises three key modules: a Modeling module that constructs a security knowledge graph integrating CVEs, libraries, CWE weakness types, CPE products, and software ecosystems; a Completion module that applies a modular KGC backbone to predict missing affected libraries for a given CVE via link prediction; and a Re-ranking module that retrieves KGC candidates and rescores them using a fine-tuned LLM augmented with knowledge graph embeddings, jointly leveraging structural and textual information. Our experiments on VulLib demonstrate that Athena significantly outperforms four state-of-the-art baselines, achieving a 32% improvement in Avg. F1 over the best baseline (i.e., VulLibGen). Notably, our KGC backbone with only 110M parameters already surpasses VulLibGen’s best configuration at 7B parameters, demonstrating the effectiveness of graph-based modeling; the re-ranking module then provides substantial further gains, consistently outperforming the best baseline across all evaluated LLM backbones.