Granted Patent B1

US 12,393,700 · App. 19/069,793 · Granted Aug 19, 2025

Inventors: Georgios Apostolopoulos (San Jose, CA); Philip Hamer (Palo Alto, CA)

Assignee: Endor Labs Inc

G06F21/577G06F21/6218G06F21/552G06F21/565G06F21/70

Abstract

Claims (91)

1. A computer-implemented method executed by one or more processors, the method comprising:

determining a set of dependencies associated with a package in a software project stored in a database, wherein individual dependencies of the set of dependencies are located in one or more of network accessible third-party libraries that include at least one open-source library;

determining a set of upgrade candidates for a particular dependency in the set of dependencies;

based on determining that a number of upgrade candidates in the set of upgrade candidates is greater than a predetermined threshold, selecting a subset of the upgrade candidates by selecting a predetermined number of versions of the upgrade candidates;

selecting an upgrade candidate in the subset of the upgrade candidates;

determining issues associated with upgrading the package to use the upgrade candidate;

emulating a state of a dependency graph associated with upgrading the package to use the upgrade candidate;

determining diamond dependencies in the dependency graph associated with upgrading the package to use the upgrade candidate;

determining a number of vulnerabilities addressed by upgrading the package to use the upgrade candidate;

determining a severity of vulnerabilities addressed by upgrading the package to use the upgrade candidate;

determining a risk-benefit score associated with each upgrade candidate in the subset of the upgrade candidates based at least in part on:

the issues associated with upgrading the package to use the upgrade candidate;

the diamond dependencies in the dependency graph associated with upgrading the package to use the upgrade candidate;

the number of vulnerabilities addressed by upgrading the package to use the upgrade candidate; and

the severity of the vulnerabilities addressed by upgrading the package to use the upgrade candidate;

prioritizing each of the upgrade candidates in the subset of the upgrade candidates based on the associated risk-benefit score to create a prioritized subset of the upgrade candidates; and

providing, on a display device, the prioritized subset of the upgrade candidates to a developer associated with the package.

2. The computer-implemented method of claim 1 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a number of breaking changes associated with upgrading the package to use the upgrade candidate.

3. The computer-implemented method of claim 1 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises:

determining an activity score indicating an amount of development activity associated with a third-party package in which the upgrade candidate is included.

4. The computer-implemented method of claim 1 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a security score indicating a number of security-related issues associated with a third-party package in which the upgrade candidate is included.

5. The computer-implemented method of claim 1 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a popularity score indicating an amount of usage received by a particular third-party package based at least in part on:

tracking source code management system metrics; and how many other packages have a dependency on the particular third-party package.

6. The computer-implemented method of claim 1 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a code quality score indicating how well a particular third-party package complies with best practices for code development.

7. The computer-implemented method of claim 1 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a number of licenses associated with the upgrade candidate.

8. A server comprising:

one or more processors; and

one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:

determining a set of dependencies associated with a package in a software project stored in a database, wherein individual dependencies of the set of dependencies are located in one or more of network accessible third-party libraries that include at least one open-source library;

determining a set of upgrade candidates for a particular dependency in the set of dependencies;

based on determining that a number of upgrade candidates in the set of upgrade candidates is greater than a predetermined threshold, selecting a subset of the upgrade candidates by selecting a predetermined number of versions of the upgrade candidates;

selecting an upgrade candidate in the subset of the upgrade candidates;

determining issues associated with upgrading the package to use the upgrade candidate;

emulating a state of a dependency graph associated with upgrading the package to use the upgrade candidate;

determining diamond dependencies in the dependency graph associated with upgrading the package to use the upgrade candidate;

determining a number of vulnerabilities addressed by upgrading the package to use the upgrade candidate;

determining a severity of vulnerabilities addressed by upgrading the package to use the upgrade candidate;

determining a risk-benefit score associated with each upgrade candidate in the subset of the upgrade candidates based at least in part on:

the issues associated with upgrading the package to use the upgrade candidate;

the diamond dependencies in the dependency graph associated with upgrading the package to use the upgrade candidate;

the number of vulnerabilities addressed by upgrading the package to use the upgrade candidate; and

the severity of the vulnerabilities addressed by upgrading the package to use the upgrade candidate;

prioritizing each of the upgrade candidates in the subset of the upgrade candidates based on the associated risk-benefit score to create a prioritized subset of the upgrade candidates; and

providing, on a display device, the prioritized subset of the upgrade candidates to a developer associated with the package.

9. The server of claim 8 , the operations further comprising:

determining a recommended global upgrade candidate for individual dependencies in a global set of dependencies across multiple projects, wherein each individual projects of the multiple projects includes one or more packages; and

determining a set of global upgrade candidates for the multiple projects.

10. The server of claim 9 , wherein determining the set of global upgrade candidates for the multiple projects comprises:

performing a global computation to identify the recommended global upgrade candidate for the individual dependencies in the global set of dependencies across the multiple projects.

11. The server of claim 9 , wherein determining the set of global upgrade candidates for the multiple projects comprises:

determining the set of global upgrade candidates having a lowest cumulative risk-benefit score.

12. The server of claim 8 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises any combination of one or more of:

determining a number of breaking changes associated with upgrading the package to use the upgrade candidate; and/or

determining an activity score indicating an amount of development activity associated with a third-party package in which the upgrade candidate is included; and/or

determining a security score indicating a number of security-related issues associated with the third-party package in which the upgrade candidate is included; and/or

determining a popularity score indicating an amount of usage received by a particular third-party package based at least in part on:

tracking source code management system metrics; and how many other packages have a dependency on the particular third-party package.

13. The server of claim 8 , wherein determining the set of dependencies associated with the package comprises: ignoring test dependencies.

14. The server of claim 8 , wherein determining the set of dependencies associated with the package comprises: ignoring unused dependencies.

15. One or more non-transitory computer readable media capable of storing instructions executable by one or more processors to perform operations comprising:

determining a set of dependencies associated with a package in a software project stored on a database, wherein individual dependencies of the set of dependencies are located in one or more of network accessible third-party libraries that include at least one open-source library;

determining a set of upgrade candidates for a particular dependency in the set of dependencies;

based on determining that a number of upgrade candidates in the set of upgrade candidates is greater than a predetermined threshold, selecting a subset of the upgrade candidates by selecting a predetermined number of versions of the upgrade candidates;

selecting an upgrade candidate in the subset of the upgrade candidates;

determining issues associated with upgrading the package to use the upgrade candidate;

emulating a state of a dependency graph associated with upgrading the package to use the upgrade candidate;

determining diamond dependencies in the dependency graph associated with upgrading the package to use the upgrade candidate;

determining a number of vulnerabilities addressed by upgrading the package to use the upgrade candidate;

determining a severity of vulnerabilities addressed by upgrading the package to use the upgrade candidate;

determining a risk-benefit score associated with each upgrade candidate in the subset of the upgrade candidates based at least in part on:

the issues associated with upgrading the package to use the upgrade candidate;

the diamond dependencies in the dependency graph associated with upgrading the package to use the upgrade candidate;

the number of vulnerabilities addressed by upgrading the package to use the upgrade candidate; and

the severity of the vulnerabilities addressed by upgrading the package to use the upgrade candidate;

prioritizing each of the upgrade candidates in the subset of the upgrade candidates based on the associated risk-benefit score to create a prioritized subset of the upgrade candidates; and

providing, on a display device, the prioritized subset of the upgrade candidates to a developer associated with the package.

16. The one or more non-transitory computer readable media of claim 15 , the operations further comprising:

determining a recommended upgrade candidate for individual dependencies in a set of project dependencies across multiple projects, wherein individual projects of the multiple projects include one or more packages.

17. The one or more non-transitory computer readable media of claim 16 , the operations further comprising:

determining a set of global upgrade candidates for the multiple projects in the set of project dependencies.

18. The one or more non-transitory computer readable media of claim 17 , wherein determining the set of global upgrade candidates for the multiple projects comprises:

determining the set of global upgrade candidates with a lowest cumulative risk-benefit score.

19. The one or more non-transitory computer readable media of claim 16 , the operations further comprising:

performing a global computation to identify a recommended global upgrade candidate for the individual dependencies in the set of project dependencies across the multiple projects.

20. The one or more non-transitory computer readable media of claim 15 , wherein determining the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a code quality score indicating how well a particular third-party package complies with best practices for code development.

Assignments (1)

Continuity (4)

References Cited (54)

Cited By (1)

US 12,547,731