Abstract: In some implementations, a computing device determines that project code in a development system references an older version of a component in a third-party library, determines that the older version of the component has a vulnerability, determines that a newer version of the component in the third-party library addresses the vulnerability, determines code changes associated with the fix commit, determines a subset of the code changes associated with the fix commit that addresses the vulnerability, creates a patch based on the subset of the code changes associated with the fix commit, and applies the patch to the older version of the component to create a patched component. The subset of the code changes is determined by identifying a minimum amount of code that addresses the vulnerability and provides support for the fix commit.

Abstract: In some implementations, a server determines that project code in a development system references an older version of a component in a third-party library and that a newer version of the component has a fix commit that addresses a vulnerability in the older version. The system determines a subset of code changes associated with the fix commit that addresses the vulnerability. The system submits, via a network, a pull request to create a branch in a developer platform. In the branch: a patch is created based on the subset of the code changes associated with the fix commit, the patch is applied to the older version of the component to create a patched component, and after the patch is successfully validated in the branch, the patched component and information associated with the patch is uploaded to a registry to enable a software developer to download and use the patched component.

Abstract: In some implementations, a computing device determines that project code in a development system references an older version of a component in a third-party library, determines that the older version of the component has a vulnerability, determines that a newer version of the component in the third-party library addresses the vulnerability, determines code changes associated with the fix commit, determines a subset of the code changes associated with the fix commit that addresses the vulnerability, creates a patch based on the subset of the code changes associated with the fix commit, applies the patch to the older version of the component to create a patched component, validates the patch, and based on successfully validating the patch, builds the patched component and uploads the patched component and information associated with the patch to a registry to enable a software developer to download the patched component.

Abstract: In some implementations, a computing device determines that project code in a development system references an older version of a component in a third-party library, determines that the older version of the component has a vulnerability, determines that a newer version of the component in the third-party library addresses the vulnerability, determines code changes associated with the fix commit, determines a subset of the code changes associated with the fix commit that addresses the vulnerability, creates a patch based on the subset of the code changes associated with the fix commit, applies the patch to the older version of the component to create a patched component, validates the patch, and based on successfully validating the patch, builds the patched component and uploads the patched component and information associated with the patch to a registry to enable a software developer to download the patched component.

Abstract: A non-transitory computer-readable media, method, and server for detecting and addressing vulnerabilities are described. For example, a server receives a security advisory of a vulnerability of a function in a third-party library, accesses a version control system of the third-party library to identify fix commits that address the vulnerability, determines files corresponding to functions in the third-party library that include the vulnerability, performs a comparison before and after a code change was made to the files, identifies functions that included the vulnerability and have been modified to address the vulnerability, performs a search for component versions that include the individual functions that included the vulnerability, generates an enriched vulnerability description that includes identifiers of package versions that include: fixed versions and vulnerable versions of the functions, and modifies project code in a development system to use the fixed versions of the functions.

Abstract: A non-transitory computer-readable media, method and server for detecting and addressing vulnerabilities in a third-party code are described. In some examples, a server receives a security advisory that includes a description of a vulnerability and accesses a version control system (VCS) used by a third-party library to determine additional resources related to the vulnerability. The server determines a set of code changes performed by the project maintainers in the VCS, identifies one or more fix commits that address the vulnerability, and identifies one or more functions with the vulnerability that have been changed by the fix commits. The server performs a search for components and component versions that include the one or more functions with the vulnerability and generates an enriched vulnerability description that includes identifiers of package versions that include fixed versions of the one or more functions and vulnerable version of the one or more functions.

Abstract: In some examples, a server receives a security advisory that includes a description of a vulnerability and accesses a version control system (VCS) used by a third-party library to determine additional resources related to the vulnerability. The server determines a set of code changes performed by the project maintainers in the VCS, identifies one or more fix commits that address the vulnerability, and identifies one or more functions with the vulnerability that have been changed by the fix commits. The server performs a search for components and component versions that include the one or more functions with the vulnerability and generates an enriched vulnerability description that includes identifiers of package versions that include fixed versions of the one or more functions and vulnerable version of the one or more functions. Project code in a development system is modified to use the fixed versions of the one or more functions.