Granted Patent B2

US 12,561,122 · App. 17/656,245 · Granted Feb 24, 2026

Inventors: Ting Dai (Elmsford, NY); Muhammed Fatih Bulut (West Greenwich, RI); Shripad Nadgowda (Elsmford, NY); Daby Mousse Sow (Croton on Hudson, NY)

Assignee: International Business Machines Corporation

G06F8/63G06F8/433G06F8/65G06F8/658G06F8/70G06F8/71

Abstract

Claims (67)

1 . A computer-implemented method, comprising:

generating a package dependency graph representing independent software packages and dependent software packages of an initial set of software packages installed in a virtual environment;

identifying a dependent software package that is dependent on one of the initial set of software packages, based on the package dependency graph;

iteratively:

updating one or more software packages of the initial set of software packages with one or more updated software packages to generate a subsequent set of software packages comprising the dependent software package;

performing a compatibility check on the subsequent set of software packages; and

installing the subsequent set of software packages based on the compatibility check until an upgrade stop condition occurs wherein the software packages within a subsequent set of software packages are not subject to known vulnerabilities and incompatibilities,

wherein generating the package dependency graph further comprises:

generating a forest of package dependency trees;

editing individual dependency trees within the forest to remove duplicate subtrees when dependee packages have a same dependent package; and

merging the dependency trees into a unified graph, wherein the merged dependency trees contain the same dependent packages.

2 . The method of claim 1 , wherein the virtual environment is a clone of a real-time environment.

3 . The method of claim 1 , wherein the updating the one or more software packages further comprises:

identifying one or more changed packages on the initial set of software packages within a change database; and

upgrading the one or more changed packages to a current package version on the change database.

4 . The method of claim 3 , wherein the identifying the one or more changed packages further comprises:

generating a list of vulnerable packages of the initial set of software packages, the list of vulnerable packages including a list of affected versions for at least one software package; and

aggregating the affected versions for the at least one software packages.

5 . The method of claim 1 , wherein the performing the compatibility check further comprises:

determining a call graph compatibility of each updated software package of the subsequent set of software packages with one or more dependent software packages depending on the updated software package.

6 . The method of claim 1 , wherein the performing the compatibility check further comprises:

determining a functionality compatibility of each updated software package of the subsequent set of software packages with one or more dependent software packages depending on the updated software package.

7 . A system, comprising:

one or more processors; and

a computer-readable storage medium, coupled to the one or more processors, storing program instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

generating a package dependency graph representing independent software packages and dependent software packages of an initial set of software packages installed in a virtual environment;

identifying a dependent software package that is dependent on one of the initial set of software packages, based on the package dependency graph;

iteratively:

updating one or more software packages of the initial set of software packages with one or more updated software packages to generate a subsequent set of software packages comprising the dependent software package;

performing a compatibility check on the subsequent set of software packages; and

installing the subsequent set of software packages based on the compatibility check until an upgrade stop condition occurs wherein the software packages within a subsequent set of software packages are not subject to known vulnerabilities and incompatibilities,

wherein generating the package dependency graph further comprises:

generating a forest of package dependency trees;

editing individual dependency trees within the forest to remove duplicate subtrees when dependee packages have a same dependent package; and

merging the dependency trees into a unified graph, wherein the merged dependency trees contain the same dependent packages.

8 . The system of claim 7 , wherein the virtual environment is a clone of a real-time environment.

9 . The system of claim 7 , wherein the updating the one or more software packages further comprises:

identifying one or more changed packages on the initial set of software packages within a change database; and

upgrading the one or more changed packages to a current package version on the change database.

10 . The system of claim 9 , wherein the identifying the one or more changed packages further comprises:

generating a list of vulnerable packages of the initial set of software packages, the list of vulnerable packages including a list of affected versions for at least one software package; and

aggregating the affected versions for the at least one software packages.

11 . The system of claim 7 , wherein the performing the compatibility check further comprises:

determining a call graph compatibility of each updated software package of the subsequent set of software packages with one or more dependent software packages depending on the updated software package.

12 . The system of claim 7 , wherein the performing the compatibility check further comprises:

determining a functionality compatibility of each updated software package of the subsequent set of software packages with one or more dependent software packages depending on the updated software package.

13 . A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions being executable by one or more processors to cause the one or more processors to perform operations comprising:

generating a package dependency graph representing independent software packages and dependent software packages of an initial set of software packages installed in a virtual environment;

identifying a dependent software package that is dependent on one of the initial set of software packages, based on the package dependency graph;

iteratively:

updating one or more software packages of the initial set of software packages with one or more updated software packages to generate a subsequent set of software packages comprising the dependent software package;

performing a compatibility check on the subsequent set of software packages; and

installing the subsequent set of software packages based on the compatibility check until an upgrade stop condition occurs wherein the software packages within a subsequent set of software packages are not subject to known vulnerabilities and incompatibilities,

where in generating the package dependency graph further comprises:

generating a forest of package dependency trees;

editing individual dependency trees within the forest to remove duplicate subtrees when dependee packages have a same dependent package; and

merging the dependency trees into a unified graph, wherein the merged dependency trees contain the same dependent packages.

14 . The computer program product of claim 13 , wherein the updating the one or more software packages further comprises:

identifying one or more changed packages on the initial set of software packages within a change database; and

upgrading the one or more changed packages to a current package version on the change database.

15 . The computer program product of claim 14 , wherein the identifying the one or more changed packages further comprises:

generating a list of vulnerable packages of the initial set of software packages, the list of vulnerable packages including a list of affected versions for at least one software package; and

aggregating the affected versions for the at least one software packages.

16 . The computer program product of claim 13 , wherein the performing the compatibility check further comprises:

determining a call graph compatibility of each updated software package of the subsequent set of software packages with one or more dependent software packages depending on the updated software package.

17 . The computer program product of claim 13 , wherein the performing the compatibility check further comprises:

determining a functionality compatibility of each updated software package of the subsequent set of software packages with one or more dependent software packages depending on the updated software package.

Assignments (1)

Continuity (1)

References Cited (34)