Granted Patent B2

US 12,430,447 · App. 19/191,907 · Granted Sep 30, 2025

Inventors: Joseph Hejderup (Palo Alto, CA); Philip Hamer (Palo Alto, CA); Georgios Apostolopoulos (San Jose, CA); Dimitrios Styliadis (San Jose, CA)

Assignee: Endor Labs Inc

G06F21/577G06F21/6218G06F21/552G06F21/565G06F21/70

Abstract

Claims (89)

1. A computer-implemented method comprising:

selecting a package in a software project;

determining a set of dependencies associated with the package, the set of dependencies determined from a plurality of dependencies located in third-party libraries;

generating a partial call graph for each dependency in the set of dependencies to create a set of partial call graphs and storing the set of partial call graphs in a cache;

stitching together the set of partial call graphs in the cache to create a complete call graph of the package;

determining unreachable code in the package based on the complete call graph;

determining a set of upgrade candidates for a particular dependency in the set of dependencies;

selecting an upgrade candidate in the set of upgrade candidates;

determining, based at least in part on the complete call graph, issues associated with upgrading the package to use the upgrade candidate;

determining a risk-benefit score associated with each upgrade candidate in the set of upgrade candidates based at least in part on:

the issues associated with upgrading the package to use each of the upgrade candidates;

a number of vulnerabilities addressed by upgrading the package to use each of the upgrade candidates; and

a severity of the vulnerabilities addressed by upgrading the package to use each of the upgrade candidates;

prioritizing each of the upgrade candidates in the set of upgrade candidates based on the associated risk-benefit score to create a prioritized set of upgrade candidates; and

providing, on a display device, the prioritized set of upgrade candidates to a developer associated with the package.

2. The computer-implemented method of claim 1 , wherein determining the set of upgrade candidates for the particular dependency in the set of dependencies comprises:

selecting a predetermined number of early versions of the upgrade candidates; and

selecting a predetermined number of later versions of the upgrade candidates.

3. The computer-implemented method of claim 1 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining an activity score indicating an amount of development activity associated with a third-party package in which the upgrade candidate is included.

4. The computer-implemented method of claim 1 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a security score indicating a number of security-related issues associated with a third-party package in which the upgrade candidate is included.

5. The computer-implemented method of claim 1 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a popularity score indicating an amount of usage received by a particular third-party package based at least in part on:

tracking source code management system metrics; and

how many other packages have a dependency on the particular third-party package.

6. The computer-implemented method of claim 1 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a code quality score indicating how well a particular third-party package complies with best practices for code development.

7. The computer-implemented method of claim 1 , wherein determining the set of dependencies associated with the package comprises:

ignoring test dependencies; and

ignoring unused dependencies.

8. A server comprising:

one or more processors; and

one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising:

selecting a package in a software project;

determining a set of dependencies associated with the package, the set of dependencies are determined from a plurality of dependencies located in third-party libraries;

generating a partial call graph for each dependency in the set of dependencies to create a set of partial call graphs and storing the set of partial call graphs in a cache;

stitching together the set of partial call graphs in the cache to create a complete call graph of the package;

determining unreachable code in the package based on the complete call graph;

determining a set of upgrade candidates for a particular dependency in the set of dependencies;

selecting an upgrade candidate in the set of upgrade candidates;

determining, based at least in part on the complete call graph, issues associated with upgrading the package to use the upgrade candidate;

determining a risk-benefit score associated with each upgrade candidate in the set of upgrade candidates based at least in part on:

the issues associated with upgrading the package to use each of the upgrade candidates;

a number of vulnerabilities addressed by upgrading the package to use each of the upgrade candidates; and

a severity of the vulnerabilities addressed by upgrading the package to use each of the upgrade candidates;

prioritizing each of the upgrade candidates in the set of upgrade candidates based on the associated risk-benefit score to create a prioritized set of upgrade candidates; and

providing, on a display device, the prioritized set of upgrade candidates to a developer associated with the package.

9. The server of claim 8 , wherein determining the set of upgrade candidates for the particular dependency in the set of dependencies comprises:

selecting a predetermined number of early versions of the upgrade candidates; and

selecting a predetermined number of later versions of the upgrade candidates.

10. The server of claim 8 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining an activity score indicating an amount of development activity associated with a third-party package in which the upgrade candidate is included.

11. The server of claim 8 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a number of breaking changes that would result from upgrading the package to use the upgrade candidate.

12. The server of claim 8 , wherein determining the set of dependencies associated with the package comprises:

ignoring test dependencies; and

ignoring unused dependencies.

13. The server of claim 8 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a code quality score indicating how a particular third-party package complies with best practices for code development.

14. The server of claim 8 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a number of licenses associated with the upgrade candidate.

15. One or more non-transitory computer readable media capable of storing instructions executable by one or more processors to perform operations comprising:

selecting a package in a software project;

determining a set of dependencies associated with the package, the set of dependencies are determined from a plurality of dependencies located in third-party libraries;

generating a partial call graph for each dependency individual in the set of dependencies to create a set of partial call graphs and storing the set of partial call graphs in a cache;

stitching together the set of partial call graphs in the cache to create a complete call graph of the package;

determining unreachable code in the package based on the complete call graph;

determining a set of upgrade candidates for a particular dependency in the set of dependencies;

selecting an upgrade candidate in the set of upgrade candidates;

determining, based at least in part on the complete call graph, issues associated with upgrading the package to use the upgrade candidate;

determining a risk-benefit score associated with each upgrade candidate in the set of upgrade candidates based at least in part on:

the issues associated with upgrading the package to use each of the upgrade candidates;

a number of vulnerabilities addressed by upgrading the package to use each of the upgrade candidates; and

a severity of the vulnerabilities addressed by upgrading the package to use each of the upgrade candidates;

prioritizing each of the upgrade candidates in the set of upgrade candidates based on the associated risk-benefit score to create a prioritized set of upgrade candidates; and

providing, on a display device, the prioritized set of upgrade candidates to a developer associated with the package.

16. The one or more non-transitory computer readable media of claim 15 , wherein determining the set of upgrade candidates for the particular dependency in the set of dependencies comprises:

selecting a predetermined number of early versions of the upgrade candidates; and

selecting a predetermined number of later versions of the upgrade candidates.

17. The one or more non-transitory computer readable media of claim 15 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining an activity score indicating an amount of development activity associated with a third-party package in which the upgrade candidate is included.

18. The one or more non-transitory computer readable media of claim 15 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a security score indicating a number of security-related issues associated with a third-party package in which the upgrade candidate is included.

19. The one or more non-transitory computer readable media of claim 15 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises:

determining a popularity score indicating an amount of usage received by a particular third-party package based at least in part on:

tracking source code management system metrics; and

how many other packages have a dependency on the particular third-party package.

20. The one or more non-transitory computer readable media of claim 15 , wherein determining, based at least in part on the complete call graph, the issues associated with upgrading the package to use the upgrade candidate comprises: determining a number of licenses associated with the upgrade candidate.

Assignments (1)

Continuity (4)

References Cited (14)