Abstract: Disclosed herein are techniques for analyzing software build changes. Techniques include accessing first executable code associated with a first version; accessing second executable code associated with a second version; determining a code delta between the first executable code and the second executable code, the code delta being based on a change of at least one first element of code in the first executable code to at least one second element of code in the second executable code; determining a software vulnerability associated with at least one of the at least one first element of code or the at least one second element of code; and generating a report including a pairing of an indicator of the software vulnerability with an indicator of at least one of the at least one first element of code or the at least one second element of code.

Abstract: Disclosed herein are techniques for shrinking security patches. Techniques include accessing executable code; scanning the executable code for an indicator of 3rd-party code associated with a software vulnerability; identifying, based on the scanning, the indicator of 3rd-party code; determining, based on the scanning, that the executable code includes a local fix patching the software vulnerability or that the executable code is not configured to rely on the 3rd-party code; and based on the determination that the executable code includes a local fix patching the software vulnerability or that the executable code is not configured to rely on the 3rd-party code, performing at least one of: generating a security patch file that does not patch the software vulnerability; or removing, from a security patch file, a patch associated with the software vulnerability, thereby reducing a size of the security patch file.