Model-based upgrade recommendations using software dependencies

1. A method comprising:

obtaining, for an application, a plurality of application dependency specifications;

identifying, using the plurality of application dependency specifications and a list of known vulnerable components, a plurality of vulnerable components;

selecting, for a first vulnerable component of the plurality of vulnerable components, a first plurality of candidate dependency specifications each specifying a version ID for a component;

selecting, for a first candidate dependency specification of the first plurality of candidate dependency specifications, a first upgraded version ID for a first component;

verifying, using an application dependency graph generated from the plurality of application dependency specifications, that upgrading the first candidate dependency specification to the first upgraded version ID removes a first dependency on the first vulnerable component; and

recommending, for the application, an upgrade solution comprising upgrading the first candidate dependency specification to the first upgraded version ID.

2. The method of claim 1 , wherein selecting the first upgraded version ID for the first candidate dependency specification comprises:

obtaining a series of version IDs subsequent to a current version ID specified in the first candidate dependency specification;

generating a series of candidate version dependency graphs corresponding to the series of version IDs; and

determining, using the series of candidate version dependency graphs, that upgrading the first candidate dependency specification to a first subsequent version ID of the series of version IDs removes the first dependency on the first vulnerable component.

3. The method of claim 2 , further comprising:

determining, using the application dependency graph, that upgrading the first candidate dependency specification to the first subsequent version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components; and

determining, using the series of candidate version dependency graphs, that upgrading the first candidate dependency specification to a second subsequent version ID of the series of version IDs removes the second dependency on the second vulnerable component.

4. The method of claim 1 , further comprising:

selecting, for a second vulnerable component of the plurality of vulnerable components, a second plurality of candidate dependency specifications;

selecting a second upgraded version ID of a second candidate dependency specification of the second plurality of candidate dependency specifications; and

verifying, using the application dependency graph, that upgrading the second candidate dependency specification to the second upgraded version ID removes a second dependency on the second vulnerable component.

5. The method of claim 1 , further comprising:

determining, using the application dependency graph, that upgrading the first candidate dependency specification to the first upgraded version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components;

selecting, for the second vulnerable component, a second plurality of candidate dependency specifications;

selecting a second upgraded version ID of a second candidate dependency specification of the second plurality of candidate dependency specifications; and

verifying, using the application dependency graph, that upgrading the second candidate dependency specification to the second upgraded version ID removes the second dependency on the second vulnerable component.

6. The method of claim 5 , wherein the upgrade solution further comprises upgrading the second candidate dependency specification to the second upgraded version ID, the method further comprising:

generating an output file comprising the first upgraded version ID for the first candidate dependency specification and the second upgraded version ID for the second candidate dependency specification.

7. The method of claim 1 , further comprising:

determining, using the application dependency graph, that upgrading the first candidate dependency specification to the first upgraded version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components;

selecting, for the second vulnerable component, a second plurality of candidate dependency specifications;

failing, using the application dependency graph, to identify a candidate dependency specification in the second plurality of candidate dependency specifications that removes the second dependency on the second vulnerable component; and

issuing an alert indicating that the application comprises a dependency on the second vulnerable component.

8. A system comprising:

a repository configured to store:

a plurality of application dependency specifications, and

a list of known vulnerable components;

a computer processor; and

an upgrade manager executing on the computer processor and configured to:

obtain, for an application, the plurality of application dependency specifications,

identify, using the plurality of application dependency specifications and the list of known vulnerable components, a plurality of vulnerable components,

select, for a first vulnerable component of the plurality of vulnerable components, a first plurality of candidate dependency specifications each specifying a version ID for a component,

select, for a first candidate dependency specification of the first plurality of candidate dependency specifications, a first upgraded version ID for a first component,

verify, using an application dependency graph generated from the plurality of application dependency specifications, that upgrading the first candidate dependency specification to the first upgraded version ID removes a first dependency on the first vulnerable component, and

recommend, for the application, an upgrade solution comprising upgrading the first candidate dependency specification to the first upgraded version ID.

9. The system of claim 8 , wherein the upgrade manager is further configured to select the first upgraded version ID for the first candidate dependency specification by:

obtaining a series of version IDs subsequent to a current version ID specified in the first candidate dependency specification,

generating a series of candidate version dependency graphs corresponding to the series of version IDs, and

determining, using the series of candidate version dependency graphs, that upgrading the first candidate dependency specification to a first subsequent version ID of the series of version IDs removes the first dependency on the first vulnerable component.

10. The system of claim 9 , wherein the upgrade manager is further configured to:

determine, using the application dependency graph, that upgrading the first candidate dependency specification to the first subsequent version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components, and

determine, using the series of candidate version dependency graphs, that upgrading the first candidate dependency specification to a second subsequent version ID of the series of version IDs removes the second dependency on the second vulnerable component.

11. The system of claim 8 , wherein the upgrade manager is further configured to:

select, for a second vulnerable component of the plurality of vulnerable components, a second plurality of candidate dependency specifications,

select a second upgraded version ID of a second candidate dependency specification of the second plurality of candidate dependency specifications, and

verify, using the application dependency graph, that upgrading the second candidate dependency specification to the second upgraded version ID removes a second dependency on the second vulnerable component.

12. The system of claim 8 , wherein the upgrade manager is further configured to:

determine, using the application dependency graph, that upgrading the first candidate dependency specification to the first upgraded version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components,

select, for the second vulnerable component, a second plurality of candidate dependency specifications,

select a second upgraded version ID of a second candidate dependency specification of the second plurality of candidate dependency specifications, and

verify, using the application dependency graph, that upgrading the second candidate dependency specification to the second upgraded version ID removes the second dependency on the second vulnerable component.

13. The system of claim 12 , wherein the upgrade solution further comprises upgrading the second candidate dependency specification to the second upgraded version ID, and wherein the upgrade manager is further configured to:

generate an output file comprising the first upgraded version ID for the first candidate dependency specification and the second upgraded version ID for the second candidate dependency specification.

14. The system of claim 8 , wherein the upgrade manager is further configured to:

determine, using the application dependency graph, that upgrading the first candidate dependency specification to the first upgraded version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components,

select, for the second vulnerable component, a second plurality of candidate dependency specifications,

fail, using the application dependency graph, to identify a candidate dependency specification in the second plurality of candidate dependency specifications that removes the second dependency on the second vulnerable component, and

issue an alert indicating that the application comprises a dependency on the second vulnerable component.

15. A method, comprising:

obtaining, for an application, a plurality of application dependency specifications;

sending the plurality of application dependency specifications to an upgrade manager configured to perform:

identifying, using the plurality of application dependency specifications and a list of known vulnerable components, a plurality of vulnerable components,

selecting, for a first vulnerable component of the plurality of vulnerable components, a first plurality of candidate dependency specifications each specifying a version ID for a component,

selecting, for a first candidate dependency specification of the first plurality of candidate dependency specifications, a first upgraded version ID for a first component,

verifying, using an application dependency graph generated from the plurality of application dependency specifications, that upgrading the first candidate dependency specification to the first upgraded version ID removes a first dependency on the first vulnerable component,

recommending, for the application, an upgrade solution comprising upgrading the first candidate dependency specification to the first upgraded version ID, and

transmitting the upgrade solution; and

receiving, from the upgrade manager, the upgrade solution.

16. The method of claim 15 , wherein selecting the first upgraded version ID for the first candidate dependency specification comprises:

obtaining a series of version IDs subsequent to a current version ID specified in the first candidate dependency specification;

generating a series of candidate version dependency graphs corresponding to the series of version IDs; and

determining, using the series of candidate version dependency graphs, that upgrading the first candidate dependency specification to a first subsequent version ID of the series of version IDs removes the first dependency on the first vulnerable component.

17. The method of claim 16 , wherein the upgrade manager is further configured to perform:

determining, using the application dependency graph, that upgrading the first candidate dependency specification to the first subsequent version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components; and

determining, using the series of candidate version dependency graphs, that upgrading the first candidate dependency specification to a second subsequent version ID of the series of version IDs removes the second dependency on the second vulnerable component.

18. The method of claim 15 , wherein the upgrade manager is further configured to perform:

selecting, for a second vulnerable component of the plurality of vulnerable components, a second plurality of candidate dependency specifications;

selecting a second upgraded version ID of a second candidate dependency specification of the second plurality of candidate dependency specifications; and

verifying, using the application dependency graph, that upgrading the second candidate dependency specification to the second upgraded version ID removes a second dependency on the second vulnerable component.

19. The method of claim 15 , wherein the upgrade manager is further configured to perform:

determining, using the application dependency graph, that upgrading the first candidate dependency specification to the first upgraded version ID introduces a second dependency on a second vulnerable component of the plurality of vulnerable components;

selecting, for the second vulnerable component, a second plurality of candidate dependency specifications;

selecting a second upgraded version ID of a second candidate dependency specification of the second plurality of candidate dependency specifications; and

verifying, using the application dependency graph, that upgrading the second candidate dependency specification to the second upgraded version ID removes the second dependency on the second vulnerable component.

20. The method of claim 19 , wherein the upgrade solution further comprises upgrading the second candidate dependency specification to the second upgraded version ID, and wherein the upgrade manager is further configured to perform:

generating an output file comprising the first upgraded version ID for the first candidate dependency specification and the second upgraded version ID for the second candidate dependency specification.