Endor Labs Inc

Philip Hamer

Georgios Apostolopoulos

Dimitrios Styliadis

Joseph Hejderup

Georgios Gousios

Henrik Plate

Camilla Odlund

Thomas Durieux

Anand Ashok Sawant

In some examples, a server determines that project code calls a component in a third-party library that has been updated. The server determines a first type hierarchy associated with the component, a second type hierarchy associated with the updated component, and performs a type hierarchy comparison of the first and the second type hierarchy. The server determines a first call graph associated with the component, determines a second call graph associated with the updated component, and performs a call graph comparison of the first and second call graph. Based at least in part on the type hierarchy comparison and the call graph comparison, the server determines a set of breaking changes associated with the updated component, with each breaking change in the set identifying changes to the updated component, relative to the component, that are determined to cause an incompatibility when the project code calls the updated component.

Impact analysis of changes in third-party software components on downstream users

In some implementations, a set of dependencies in a selected package are determined. Each dependency in the set of dependencies is used to create a set of partial call graphs that are stitched together to create a complete call graph of the package. A subset of upgrade candidates may be selected from a set of upgrade candidates for a particular dependency. Determining issues associated with upgrading the package to use an upgrade candidate includes determining security vulnerabilities based on the complete call graph, determining a number of vulnerabilities addressed by upgrading the package to use the upgrade candidate, and determining a severity of vulnerabilities addressed by upgrading the package to use the upgrade candidate. A risk-benefit score associated with each of the upgrade candidates is determined to create a subset of upgrade candidates prioritized based on the risk-benefit score. The prioritized subset is provided to a developer associated with the package.

Creating and using call graphs to select an update

In some examples, a code file in a development system is selected and the selected code file is segmented, using a language-specific parser, to create multiple parsed blocks. A block of the multiple parsed blocks is selected and a cryptographic hash function used to create a block signature that uniquely identifies the selected block. The block signature is compared to multiple signatures of blocks in third-party libraries. The multiple signatures are stored in an index. When the block signature matches one of the multiple signatures of blocks in third-party libraries, the index is used to determine a source file from which the selected block was copied. Vulnerabilities included in the source file and fixes to address the vulnerabilities are identified to enable a software developer to apply the fixes to the identified vulnerabilities.

Software composition analysis (SCA) to identify AI-generated code that is copied code from third-party libraries

In some implementations, dependencies associated with a package selected from a software project are determined. Each dependency of the dependencies is used to create a set of partial call graphs that are stitched together to create a complete call graph of the package. A set of upgrade candidates for a dependency is determined. An upgrade candidate from the set of upgrade candidates is determined. Based on the complete call graph, issues associated with upgrading the package to use the upgrade candidate are determined. For each upgrade candidate in the set of the upgrade candidates, a risk-benefit score is determined based on issues associated with upgrading the package to use the upgrade candidate, a number of vulnerabilities, and a severity of the vulnerabilities addressed by upgrading the package to use the upgrade candidate. The upgrade candidates are prioritized based on the risk-benefit score to create prioritized upgrade candidates that are provided to a software developer.

Using call graphs to identify an update when upgrading to a newer version

A computer-implemented method, a non-transitory computer-readable media, and a server for identifying an update of a code dependency to use based on risk and benefit trade-offs are described. In some implementations, a package is selected from a database and a set of dependencies associated with the package are determined. A set of upgrade candidates for a particular dependency is determined. For an upgrade candidate, issues associated with upgrading the package to use the upgrade candidate are determined, a state of a dependency graph associated with upgrading are determined, diamond dependencies in the dependency graph are determined, a number of vulnerabilities and a severity of the vulnerabilities addressed by upgrading to the upgrade candidate are determined, and a risk-benefit score associated with each upgrade candidate is determined. The upgrade candidates are prioritized based on the associated risk-benefit score to create prioritized upgrade candidates that are provided to a software developer.

Identifying an update of a code dependency to use based on risk and benefit trade-offs

In some implementations, a package is selected and a set of dependencies associated with the package are determined. Individual dependencies in the set of dependencies are used to create a set of partial call graphs that are stitched together to create a complete call graph of the package. A set of upgrade candidates for a dependency is determined. For an upgrade candidate, issues associated with upgrading the package to use the upgrade candidate are determined, a state of a dependency graph associated with upgrading are determined, diamond dependencies in the dependency graph are determined, a number of vulnerabilities and a severity of the vulnerabilities addressed by upgrading to the upgrade candidate are determined, and a risk-benefit score associated with each upgrade candidate is determined. The upgrade candidates are prioritized based on the associated risk-benefit score to create prioritized upgrade candidates that are provided to a software developer.

Determining call graphs to identify which update of a code dependency to use

A computer-implemented method, a non-transitory computer-readable media, and a server for identifying an update of a code dependency to use based on risk and benefit trade-offs are described. In some examples, a package is selected from a database and a set of dependencies associated with the package are determined from third-party libraries. A set of upgrade candidates for a particular dependency is determined. For an upgrade candidate, issues associated with upgrading the package to use the upgrade candidate are determined, a state of a dependency graph associated with upgrading are determined, diamond dependencies in the dependency graph are determined, a number of vulnerabilities and a severity of the vulnerabilities addressed by upgrading to the upgrade candidate are determined, and a risk-benefit score associated with each upgrade candidate is determined. Each of the upgrade candidates are prioritized based on the associated risk-benefit score to create prioritized upgrade candidates that are then provided to a software developer.

Growing community of inventors

Palo Alto, CA, United States of America

Philip Hamer