MANAGEMENT OF SOFTWARE DEPENDENCIES

1 . A computer system for managing software dependencies, comprising:

one or more processors; and

non-transitory computer-readable storage media encoding instructions which, when executed by the one or more processors, causes the computer system to:

identify a vulnerability associated with a dependency for a computer program as the computer program is being developed;

determine a severity of the vulnerability; and

manage the dependency based upon the severity of the vulnerability.

2 . The computer system of claim 1 , comprising further instructions which, when executed by the one or more processors, causes the computer system to block the dependency or block release of the computer program based upon the severity.

3 . The computer system of claim 1 , comprising further instructions which, when executed by the one or more processors, causes the computer system to generate an alert based upon the severity of the vulnerability.

4 . The computer system of claim 1 , comprising further instructions which, when executed by the one or more processors, causes the computer system to:

block downloading of the dependency;

block code including the dependency during versioning; and

block release of the computer program including the dependency.

5 . The computer system of claim 1 , wherein the dependency is managed using rules.

6 . The computer system of claim 5 , wherein the dependency is managed by:

create a risk score associated with all vulnerabilities for the computer program; and

use the rules to hold the computer program based upon the risk score.

7 . The computer system of claim 5 , wherein the rules are based upon the severity of the vulnerability and a context of the dependency.

8 . The computer system of claim 5 , wherein the rules are stored in a central database.

9 . The computer system of claim 1 , comprising further instructions which, when executed by the one or more processors, causes the computer system to generate a compliance report based upon vulnerabilities identified for the computer system.

10 . The computer system of claim 9 , comprising further instructions which, when executed by the one or more processors, causes the computer system to identify trends associated with the vulnerabilities identified for the computer system.

11 . A method for managing software dependencies, comprising:

identifying a vulnerability associated with a dependency for a computer program as the computer program is being developed;

determining a severity of the vulnerability; and

managing the dependency based upon the severity of the vulnerability.

12 . The method of claim 11 , further comprising blocking the dependency or block release of the computer program based upon the severity.

13 . The method of claim 11 , further comprising generating an alert based upon the severity of the vulnerability.

14 . The method of claim 11 , further comprising:

blocking downloading of the dependency;

blocking code including the dependency during versioning; and

blocking release of the computer program including the dependency.

15 . The method of claim 11 , wherein the dependency is managed using rules.

16 . The method of claim 15 , wherein the dependency is managed by:

creating a risk score associated with all vulnerabilities for the computer program; and

using the rules to hold the computer program based upon the risk score.

17 . The method of claim 15 , wherein the rules are based upon the severity of the vulnerability and a context of the dependency.

18 . The method of claim 15 , wherein the rules are stored in a central database.

19 . The method of claim 11 , further comprising generating a compliance report based upon vulnerabilities identified for a computer system.

20 . The method of claim 19 , further comprising identifying trends associated with the vulnerabilities identified for the computer system.