Stitching partial call graphs to create a complete call graph to determine when to upgrade to a newer version

Inventors: Joseph Hejderup (Palo Alto, CA); Philip Hamer (Palo Alto, CA); Georgios Apostolopoulos (San Jose, CA); Dimitrios Styliadis (San Jose, CA)

Assignee: Endor Labs Inc

G06F21/577 G06F21/6218 G06F21/552 G06F21/565 G06F21/70 G06F2221/033

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12688310
App. No.: 19/377,532
Granted: Jul 21, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

In some implementations, a package in a software project is selected and dependencies in the selected package are determined. A partial call graph for individual dependencies is created and stored in a cache to create partial call graphs that are stitched together to create a complete call graph of the package. A set of upgrade candidates for individual dependencies is determined and an upgrade candidate is selected from the set. Based at least in part on the complete call graph, issues associated with upgrading the package to use the upgrade candidate are determined and a risk-benefit score associated with each upgrade candidate determined based on the issues, the number of vulnerabilities addressed, and a severity of the vulnerabilities addressed by upgrading the package to use the upgrade candidate. The set of upgrade candidates is prioritized based on the associated risk-benefit score to create a prioritized set and provided to a developer associated with the package.

Claims (65)

1 . A computer-implemented method comprising:

selecting a package in a software project;

determining a set of dependencies associated with the package, the dependencies located in third-party libraries that are accessed via a network;

generating a partial call graph for individual dependencies in the set of dependencies and storing the partial call graph in a cache to create a set of partial call graphs in the cache;

stitching together the set of partial call graphs in the cache to create a complete call graph of the package comprises: stitching together the set of partial call graphs by connecting call sites found in bytecode with component implementations that can be reached by a corresponding invoke instruction;

determining unreachable code in the package based on the complete call graph;

determining a set of upgrade candidates for a particular dependency in the set of dependencies;

selecting an upgrade candidate in the set of upgrade candidates;

determining, based at least in part on the complete call graph, issues associated with upgrading the package to use the upgrade candidate;

determining a risk-benefit score associated with individual upgrade candidates in the set of upgrade candidates based at least in part on:

the issues associated with upgrading the package to use the individual upgrade candidates;

a number of vulnerabilities addressed by upgrading the package to use the individual upgrade candidates; and

a severity of the vulnerabilities addressed by upgrading the package to use the individual upgrade candidates;

prioritizing the individual upgrade candidates in the set of upgrade candidates based on the associated risk-benefit score to create a prioritized set of upgrade candidates; and

providing, on a display device, the prioritized set of upgrade candidates to a developer associated with the package.

2 . The computer-implemented method of claim 1 , further comprising: based on determining that an invocation type in the partial call graph comprises either an invoke virtual or an invoke interface, adding children of a receiver type to a set of receiver types; and add one or more edges to a call graph.

3 . The computer-implemented method of claim 1 , further comprising: based on determining that an invocation type in the partial call graph comprises either an invoke static or an invoke special, querying defending packages of a target signature; and add one or more edges to a call graph.

4 . The computer-implemented method of claim 1 , further comprising: determining a global type hierarchy based on the set of partial call graphs.

5 . The computer-implemented method of claim 1 , wherein determining, based at least in part on the complete call graph, issues associated with upgrading the package to use the upgrade candidate comprise: determining security vulnerabilities associated with the upgrade candidate based on the complete call graph.

6 . The computer-implemented method of claim 1 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises: determining a code quality score indicating how well a particular third-party package complies with best practices for code development.

7 . The computer-implemented method of claim 1 , wherein determining the set of upgrade candidates for the particular dependency in the set of dependencies comprises: selecting a predetermined number of early versions of the set of upgrade candidates; and selecting a predetermined number of later versions of the set of upgrade candidates.

8 . A server comprising:

one or more processors; and

one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:

selecting a package in a software project;

determining a set of dependencies associated with the package, the set of dependencies located in third-party libraries that are accessed via a network;