System and method for managing software application currency

1. A method for managing software application currency, the method comprising:

receiving a notification that a plurality of software applications within a deployed environment are subject to a security risk;

identifying a first group of the plurality of software applications as being subject to the security risk;

identifying a second group of the plurality of software applications as not being subject to the security risk;

for a first software application of the first group:

scanning a source code repository corresponding to the first software application within a development environment;

detecting a first dependency corresponding to the first software application as being subject to the security risk based on the scan of the source code repository corresponding to the first software application;

linking the first dependency to the first software application on a master update table within the development environment;

determining a first version and a second version corresponds to the first dependency;

ranking the first version and the second version on the master update table within the development environment based on a first version currency and a second version currency;

prioritizing the first software application for a currency update within the deployed environment, based at least on the ranking of the second version currency being more current than the first version currency;

for a second software application of the first group:

scanning a source code repository corresponding to the second software application within the development environment;

detecting a second dependency corresponding to the second software application as being subject to the security risk based on the scan of the source code repository corresponding to the second software application;

linking the second dependency to the second software application on the master update table within the development environment;

matching the second dependency to the first dependency on the master update table based on a determination that the second dependency and the first dependency are the same dependency;

determining that a third version corresponds to the second dependency;

ranking the third version on the master update table within the development environment based on a third version currency;

determining that the third version currency is less current than the first version currency based on the master update table rankings;

modifying the priority of the currency update from the first software application to the second software application based at least on the third version currency being less current than the first version currency; and

updating, within the deployed environment, the second software application to mitigate the security risk.

2. The method according to claim 1 , further comprising:

displaying information representing:

the first software application,

the second software application,

the first version corresponding to the first dependency,

the second version corresponding to the first dependency,

the third version corresponding to the second dependency,

the priority for currency update of the first software application, and

the priority for currency update of the second software application.

3. The method according to claim 1 , further comprising:

for the first software application of the first group:

identifying all dependencies based on at least the scan of the source code repository corresponding to the first software application;

determining all versions corresponding to all the dependencies; and

displaying information representing all the versions and all the dependencies.

4. The method according to claim 1 , further comprising:

for the first software application of the first group:

identifying a total number of dependencies based on at least the scan of the source code repository corresponding to the first software application; and

displaying information representing the total number of dependencies for the first software application.

5. The method according to claim 1 , further comprising:

for the first group of the plurality of software applications:

identifying a total number of software applications having the first version that corresponds to the first dependency; and

displaying information representing the total number of software applications in the first group having the first version that corresponds to the first dependency.

6. The method according to claim 1 , further comprising:

for the first group of the plurality of software applications:

identifying a total number of software applications having the first dependency; and

displaying information representing the total number of software applications in the first group having the first dependency.

7. The method according to claim 1 , further comprising:

for the first group of the plurality of software applications:

identifying names of all the software applications having the first dependency; and

displaying information representing the names of all the software applications having the first dependency.

8. The method according to claim 1 , further comprising:

for the second group of the plurality of software applications:

identifying names of software applications in the second group having the first dependency by using at least source code repositories;

displaying information representing the names of the software applications in the second group having the first dependency; and

displaying an option to change the identification of the software applications in the second group having the first dependency from the second group where they are not subject to the security risk to the first group where they are subject to the security risk.

9. The method according to claim 1 , further comprising:

for the second group of the plurality of software applications:

identifying names of software applications in the second group having the first dependency by using at least metadata associated with the software applications in the second group;

displaying information representing the names of the software applications in the second group having the first dependency; and

displaying an option to change the identification of the software applications in the second group having the first dependency from the second group where they are not subject to the security risk to the first group where they are subject to the security risk.

10. The method according to claim 1 , further comprising:

for a third software application that is not in either the first group or the second group:

identifying third dependencies of the third software application based on at least a scan of a source code repository corresponding to the third software application;

determining that the first dependency corresponds to one of the third dependencies; and

displaying information representing the third dependencies and respective versions.

11. A system for managing software application currency, comprising:

a network interface to communication in a network;

a processor coupled to the network interface and adapted to execute one or more processes; and

a memory configured to store a process executable by the processor, the process, when executed, is operable to:

receive a notification that a plurality of software applications within a deployed environment are subject to a security risk;

identify a first group of the plurality of software applications as being subject to the security risk;

identify a second group of the plurality of software applications as not being subject to the security risk;

for a first software application of the first group:

scan a source code repository corresponding to the first software application within a development environment;

detect a first dependency corresponding to the first software application as being subject to the security risk based on the scan of the source code repository corresponding to the first software application;

link the first dependency to the first software application on a master update table within the development environment;

determine a first version and a second version corresponds to the first dependency;

rank the first version and the second version on the master update table within the development environment based on a first version currency and a second version currency;

prioritize the first software application for a currency update within the deployed environment, based at least on the ranking of the second version currency being more current than the first version currency;

for a second software application of the first group:

scan a source code repository corresponding to the second software application within a development environment;

detect a second dependency corresponding to the second software application as being subject to the security risk based on the scan of the source code repository corresponding to the second software application;

link the second dependency to the second software application on the master update table within the development environment;

match the second dependency to the first dependency on the master update table based on a determination that the second dependency and the first dependency are the same dependency;

determine that a third version corresponds to the second dependency;

rank the third version on the master update table within the development environment based on a currency of the third version;

determine that the third version currency is less current than the first version currency based on the master update table rankings;

modify the priority of the currency update from the first software application to the second software application based at least on the third version currency being less current than the first version currency; and

update, within the deployed environment, the second software application to mitigate the security risk.

12. The system of claim 11 , wherein the process, when executed, is further operable to:

display information representing:

the first software application,

the second software application,

the first version corresponding to the first dependency,

the second version corresponding to the first dependency,

the third version corresponding to the second dependency,

the priority for currency update of the first software application, and

the priority for currency update of the second software application.

13. The system of claim 11 , wherein the process, when executed, is further operable to:

for the first software application of the first group:

identify all dependencies based on at least the scan of the source code repository corresponding to the first software application;

determine all versions corresponding to all the dependencies; and

display information representing all the versions and all the dependencies.

14. The system of claim 11 , wherein the process, when executed, is further operable to:

for the first software application of the first group:

identify a total number of dependencies based on at least the scan of the source code repository corresponding to the first software application; and

display information representing the total number of dependencies for the first software application.

15. The system of claim 11 , wherein the process, when executed, is further operable to:

for the first group of the plurality of software applications:

identify a total number of software applications having the first version that corresponds to the first dependency; and

display information representing the total number of software applications in the first group having the first version that corresponds to the first dependency.

16. The system of claim 11 , wherein the process, when executed, is further operable to:

for the first group of the plurality of software applications:

identify a total number of software applications having the first dependency; and

display information representing the total number of software applications in the first group having the first dependency.

17. The system of claim 11 , wherein the process, when executed, is further operable to:

for the first group of the plurality of software applications:

identify names of all the software applications having the first dependency; and

display information representing the names of all the software applications having the first dependency.

18. The system of claim 11 , wherein the process, when executed, is further operable to:

for the second group of the plurality of software applications:

identify names of software applications in the second group having the first dependency by using at least source code repositories;

display information representing the names of the software applications in the second group having the first dependency; and

display an option to change identification of the software applications in the second group having the first dependency from the second group where they are not subject to the security risk to the first group where they are subject to the security risk.