Granted Patent B2

US 12,602,490 · App. 19/270,079 · Granted Apr 14, 2026

Inventors: Henrik Plate (Valbonne, FR); Sebastian Cai (Palo Alto, CA); Dimitrios Styliadis (San Jose, CA); Alexandre Wilhelm (Kilauea, HI)

Assignee: Endor Labs Inc

G06F21/577G06F21/6218G06F21/552G06F21/565G06F21/70

Abstract

Claims (112)

1 . A computer-implemented method comprising:

determining, by one or more processors, that project code in a development system references an older version of a component in a third-party library;

determining, by the one or more processors, that the older version of the component has a vulnerability;

determining, by the one or more processors, that a newer version of the component in the third-party library has a fix commit that addresses the vulnerability;

determining, by the one or more processors, code changes associated with the fix commit;

determining, by the one or more processors, a subset of the code changes associated with the fix commit that addresses the vulnerability;

submitting, by the one or more processors through a communication network, a pull request to create a branch in a developer platform;

creating, in the branch by the one or more processors, a patch based on the subset of the code changes associated with the fix commit;

applying, in the branch by the one or more processors, the patch to the older version of the component to create a patched component;

validating, in the branch, the patch by the one or more processors; and

based on successfully validating the patch, uploading, by the one or more processors, the patched component and information associated with the patch to a registry to enable a software developer to download and use the patched component.

2 . The computer-implemented method of claim 1 , wherein validating the patch by the one or more processors comprises:

executing a set of test cases on a first build that includes the older version of the component to create first test results;

determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component;

executing the set of test cases on a second build that includes the patched component to create second test results; and

determining that the second test results indicate that the set of test cases did not exploit the vulnerability in the patched component.

3 . The computer-implemented method of claim 2 , further comprising:

initiating a process to create the first build using a build file comprising build rules and build options;

based on the process to create the first build failing, modifying the build file to create a modified build file; and

re-initiating the process to create the first build using the modified build file.

4 . The computer-implemented method of claim 1 , further comprising:

providing sufficient details in the information associated with the patch to enable the software developer to reproducibly build the patch.

5 . The computer-implemented method of claim 1 , further comprising:

performing change impact analysis on the patched component; and

determining, based on the change impact analysis, that the patched component does not introduce a breaking change.

6 . The computer-implemented method of claim 1 , wherein the information associated with the patch comprises:

information identifying the older version of the component in the third-party library;

information identifying the vulnerability;

information identifying files used;

information related to a build file;

information related to build options;

one or more configuration details; or

any combination thereof.

7 . A server comprising:

one or more processors; and

one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:

determining that project code in a development system references an older version of a component in a third-party library;

determining that the older version of the component has a vulnerability;

determining that a newer version of the component in the third-party library has a fix commit that addresses the vulnerability;

determining code changes associated with the fix commit;

determining a subset of the code changes associated with the fix commit that addresses the vulnerability;

submitting, via a communication network, a pull request to create a branch in a developer platform;

creating, in the branch, a patch based on the subset of the code changes associated with the fix commit;

applying, in the branch, the patch to the older version of the component to create a patched component;

validating, in the branch, the patch; and

based on successfully validating the patch, building and uploading the patched component and information associated with the patch to a registry to enable a software developer to download and use the patched component.

8 . The server of claim 7 , wherein validating the patch comprises:

executing a set of test cases on a first build that includes the older version of the component to create first test results;

determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component;

executing the set of test cases on a second build that includes the patched component to create second test results; and

determining that the second test results indicate that the set of test cases did not exploit the vulnerability in the patched component.

9 . The server of claim 8 , the operations further comprising:

initiating a process to create the first build using a build file comprising build rules and build options;

based on the process to create the first build failing, modifying the build file to create a modified build file; and

re-initiating the process to create the first build using the modified build file.

10 . The server of claim 7 , the operations further comprising:

providing sufficient details in the information associated with the patch to enable the software developer to reproducibly build the patch.

11 . The server of claim 7 , wherein validating the patch comprises:

executing a set of test cases on a first build that includes the older version of the component to create first test results;

determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component;

executing the set of test cases on a second build that includes the patched component to create second test results;

determining that the second test results indicate that the set of test cases exploited the vulnerability in the patched component;

modifying the patch to create a modified patch;

executing the set of test cases on a third build that includes the modified patch to create third test results; and

determining that the third test results indicate that the set of test cases did not exploit the vulnerability in the modified patch.

12 . The server of claim 7 , wherein the information associated with the patch comprises:

information identifying the older version of the component in the third-party library;

information identifying the vulnerability;

information identifying files used;

information related to a build file;

information related to build options;

one or more configuration details; or

any combination thereof.

13 . The server of claim 7 , the operations further comprising:

performing change impact analysis on the patched component;

determining, based on the change impact analysis, that the patch introduces a breaking change;

modifying the patch to create a modified patch; and

performing the change impact analysis using the modified patch.

14 . One or more non-transitory computer readable media capable of storing instructions executable by one or more processors to perform operations comprising:

determining that project code in a development system references an older version of a component in a third-party library;

determining that the older version of the component has a vulnerability;

determining that a newer version of the component in the third-party library has a fix commit that addresses the vulnerability;

determining code changes associated with the fix commit;

determining a subset of the code changes associated with the fix commit that addresses the vulnerability;

submitting, through a communication network, a pull request to create a branch in a developer platform;

creating, in the branch, a patch based on the subset of the code changes associated with the fix commit;

applying, in the branch, the patch to the older version of the component to create a patched component;

validating, in the branch, the patch; and

based on successfully validating the patch, building and uploading the patched component and information associated with the patch to a registry to enable a software developer to download and use the patched component.

15 . The one or more non-transitory computer readable media of claim 14 , wherein validating the patch comprises:

executing a set of test cases on a first build that includes the older version of the component to create first test results;

determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component;

executing the set of test cases on a second build that includes the patched component to create second test results; and

determining that the second test results indicate that the set of test cases did not exploit the vulnerability in the patched component.

16 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:

initiating a process to create the first build using a build file comprising build rules and build options;

based on the process to create the first build failing, modifying the build file to create a modified build file; and

re-initiating the process to create the first build using the modified build file.

17 . The one or more non-transitory computer readable media of claim 15 , the operations further comprising:

providing sufficient details in the information associated with the patch to enable the software developer to reproducibly build the patch.

18 . The one or more non-transitory computer readable media of claim 14 , the operations further comprising:

performing change impact analysis on the patched component; and

determining, based on the change impact analysis, that the patched component does not introduce a breaking change.

19 . The one or more non-transitory computer readable media of claim 14 ,

wherein the information associated with the patch comprises:

information identifying the older version of the component in the third-party library;

information identifying the vulnerability;

information identifying files used;

information related to a build file;

information related to build options;

one or more configuration details; or

any combination thereof.

Assignments (1)

Continuity (9)

References Cited (54)