Microsoft Technology Licensing, LLC

Eric N St John

Jan Kotas

Kumar Gaurav Khanna

Zhanliang Chen

David M Kean

Jobst-Immo Landwerth

Matthew Cohn

Livar Correia De Oliveira Cavalcanti Cunha

Gaye Oncul Kok

Alok Shriram

Peter A Marcu

Mohammad Rahim Bhojani

Divya Swarnkar

Zlatko Knezevic

Michael J Rayhelson

Michael Rousos

Weitao Su

Techniques are described herein that are capable of trimming unused dependencies using a package graph and a module graph. For instance, the package graph and the module graph may be traversed to determine whether dependencies of an application are used during execution of the application. A version of the application may be configured to include the dependencies that are used and to not include the dependencies that are not used. For instance, the version of the application may be configured to be utilized at deployment time.

Trimming unused dependencies using package graph and module graph

An enhanced binder provides flexibility and certainty when selecting a version of a software library to load, and an enhanced loader prevents a library version vulnerable to a security flaw from being loaded. The binder can perform unification, implicit override, and/or redirection. Implicit override searches assembly-specific locations for an implicit_version, and override the previously chosen unification or other version with the implicit_version when the implicit_version is greater. The implicit_version gets updated with the individual assembly, whereas the unification_version gets updated with the framework. Redirection may override the implicit_version. Unlike redirection, an implicit_version does not recite an explicit range and is found outside application configuration files. The implicit_version is specified implicitly by the assembly without an XML declaration. Vulnerable libraries are not loaded, based on out-of-band metadata placed in response to a list of known out-of-band assemblies, an out-of-band-servicing attribute, or a custom servicing library.

Out-of-band framework libraries within applications

Growing community of inventors

Redmond, WA, United States of America

Eric N St John