Project dependence conflict detection method and device, equipment, storage medium and product

Abstract

The invention provides a project dependence conflict detection method and device, equipment, a storage medium and a product, and relates to the field of financial science and technology or other related fields. The method comprises the following steps: acquiring a dependency tree of a project, and extracting component identifiers of dependency components of the dependency tree and dependency relationships among the dependency components; an original directed graph is generated based on the component identifier of each dependent component and the dependency relationship between the dependent components, the original directed graph comprises nodes and edges, the nodes represent the dependent components, and the edges represent the dependency relationship between the dependent components; performing dependency analysis and vulnerability level analysis on each dependency component to obtain a node attribute of each dependency component and an edge attribute between the dependency components; marking the original directed graph based on the node attributes and the edge attributes to obtain a relational network graph; and performing dependency conflict detection on each dependency component of the project to obtain a dependency conflict detection result. According to the method provided by the invention, visual display of dependency conflict detection is realized.

Description

Technical Field

[0001] This application relates to the field of financial technology or other related fields, and in particular to a method, apparatus, device, storage medium and product for detecting project dependency conflicts. Background Technology

[0002] In modern software development, the number of dependent components (such as JAR files) that a project relies on is constantly increasing, and the dependency relationships are becoming increasingly complex. Developers face multiple challenges when maintaining such projects. For example, when the same type of dependent component is simultaneously imported by multiple different versions of other dependent components, multi-level transitive dependencies may lead to version conflicts.

[0003] In existing technologies, a dependency tree structure is mainly used to display the direct and transitive dependencies of a project. However, the dependency tree can only show the dependency relationships between dependent components and cannot identify the specific path of version conflicts. Developers need to manually trace these paths, making it difficult to quickly locate conflicts.

[0004] Therefore, there is an urgent need for a project dependency conflict detection method to help developers quickly perform conflict detection. Summary of the Invention

[0005] This application provides a method, apparatus, device, storage medium, and product for detecting project dependency conflicts, in order to solve the technical problem in the prior art that the specific path of version conflict cannot be identified, requiring developers to manually trace it, making it difficult to quickly locate the conflict.

[0006] Firstly, this application provides a method for detecting project dependency conflicts, including:

[0007] Obtain the project's dependency tree, and extract the component identifiers of each dependent component in the dependency tree and the dependency relationships between each dependent component;

[0008] Based on the component identifiers of each dependent component and the dependency relationships between each dependent component, an original directed graph is generated. The original directed graph includes nodes and edges. The nodes in the original directed graph are used to represent each dependent component, and the edges in the original directed graph are used to represent the dependency relationships between each dependent component.

[0009] Dependency analysis and vulnerability level analysis are performed on each of the dependent components to obtain the node attributes of each dependent component and the edge attributes between each dependent component;

[0010] Based on the node attributes and edge attributes, the original directed graph is labeled to obtain a relational network graph;

[0011] Based on the aforementioned relationship network diagram, dependency conflict detection is performed on each dependent component of the project to obtain dependency conflict detection results.

[0012] Secondly, this application provides a project dependency conflict detection device, comprising:

[0013] The acquisition module is used to acquire the project's dependency tree and extract the component identifiers of each dependent component in the dependency tree and the dependency relationships between each dependent component;

[0014] The processing module is used to generate an original directed graph based on the component identifiers of each dependent component and the dependency relationships between the dependent components. The original directed graph includes nodes and edges. The nodes in the original directed graph are used to represent each dependent component, and the edges in the original directed graph are used to represent the dependency relationships between the dependent components.

[0015] The processing module is also used to perform dependency analysis and vulnerability level analysis on each of the dependent components to obtain the node attributes of each dependent component and the edge attributes between each dependent component.

[0016] The processing module is also used to annotate the original directed graph based on the node attributes and edge attributes to obtain a relational network graph;

[0017] The detection module is used to perform dependency conflict detection on each dependent component of the project based on the relationship network graph, and obtain the dependency conflict detection results.

[0018] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0019] The memory stores computer-executed instructions;

[0020] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0022] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0023] The project dependency conflict detection method, apparatus, device, storage medium, and product provided in this application obtain the project's dependency tree, extract the component identifiers of each dependent component and the dependency relationships between them, generate an original directed graph based on these identifiers and relationships, including nodes and edges, perform dependency analysis and vulnerability level analysis on each dependent component to obtain node attributes and edge attributes, annotate the original directed graph to obtain a relationship network graph, and perform dependency conflict detection on each dependent component based on this network graph to obtain the conflict detection results. By analyzing the dependency relationships and vulnerability levels between dependent components and linking dependencies, other edge attributes, and node attributes through the relationship network graph, the project achieves a visual representation of dependency conflict detection, solving the problem of invisible conflict paths caused by dependency tree-based dependency detection. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0025] Figure 1 A flowchart illustrating a project dependency conflict detection method provided in this application embodiment. Figure 1 ;

[0026] Figure 2 A schematic diagram illustrating the generation of a relationship network graph provided in an embodiment of this application;

[0027] Figure 3 A flowchart illustrating a project dependency conflict detection method provided in this application embodiment. Figure 2 ;

[0028] Figure 4 A flowchart illustrating a project dependency conflict detection method provided in this application embodiment. Figure 3 ;

[0029] Figure 5 A schematic diagram of a project dependency conflict detection device provided in an embodiment of this application;

[0030] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0031] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0032] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0033] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0034] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0035] It should be noted that the project dependency conflict detection method, apparatus, equipment, storage medium and product provided in this application can be used in the field of fintech, or in any field other than fintech. The application field of the project dependency conflict detection method, apparatus, equipment, storage medium and product in this application is not limited.

[0036] "Multiple" refers to two or more, and other quantifiers are similar. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following objects have an "or" relationship.

[0037] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, products, or apparatus.

[0038] It should be noted that, in the embodiments of this application, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0039] First, let me explain the terms used in this application:

[0040] Dependency tree: Displays all dependent components in the project and their dependencies.

[0041] A directed graph is a graph consisting of a set of vertices and a set of directed edges, where each edge connects an ordered pair of vertices.

[0042] In modern software development, the number of dependent components (such as JAR files) that a project relies on is constantly increasing, and the dependency relationships are becoming increasingly complex. Developers face multiple challenges when maintaining such projects.

[0043] In existing technologies, direct and transitive dependencies of a project are mainly displayed through a tree-like structure of dependency trees. However, dependency trees can only show the dependency relationships between dependent components and cannot identify the specific paths of version conflicts, requiring developers to manually trace them, making it difficult to quickly locate conflicts. Multi-level transitive dependencies are prone to version conflicts, and traditional tools cannot intuitively display the conflict paths; class conflicts require developers to manually investigate, which is inefficient.

[0044] The project dependency conflict detection method provided in this application aims to solve the above-mentioned technical problems of the prior art by constructing a project relationship network diagram to detect project dependency conflicts.

[0045] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0046] Figure 1 A flowchart illustrating a project dependency conflict detection method provided in this application embodiment. Figure 1 ,like Figure 1 As shown, the method includes:

[0047] S101. Obtain the project's dependency tree, and extract the component identifiers of each dependent component and the dependency relationships between each dependent component.

[0048] Among them, dependent components can be, for example, JAR packages. Component identifiers are attributes used to uniquely identify dependent components, including organization identifier, project identifier, and version identifier (groupId:artifactId:version), such as org.springframework:spring-core:5.3.10.

[0049] The dependencies between components can be, for example, that component A directly depends on component B, component B directly depends on component C, or component A directly depends on component D, and component D directly depends on component C. The relationship between component A and component C is a transitive dependency. A, B, C, and D are the component identifiers of each dependent component.

[0050] The dependency hierarchy structure of the project, i.e., the dependency tree, is generated using a build tool. For example, dependency component A → dependency component B → dependency component C: 1.0, dependency component A → dependency component D → dependency component C: 2.0. 1.0 and 2.0 are versions of dependency component C. The component identifiers of each dependency component in the dependency tree and the dependency relationships between them are then extracted.

[0051] S102. Based on the component identifiers of each dependent component and the dependency relationships between each dependent component, generate the original directed graph, which includes nodes and edges.

[0052] In this graph, nodes represent dependent components, and edges represent the dependencies between these components.

[0053] Using each dependent component as a node and the dependencies between each dependent component as edges, generate the original directed graph.

[0054] S103. Perform dependency analysis and vulnerability level analysis on each dependent component to obtain the node attributes of each dependent component and the edge attributes between each dependent component.

[0055] Dependency analysis refers to identifying version conflicts, class conflicts, and dependency scopes based on the dependency relationships between dependent components. Vulnerability level analysis refers to determining the vulnerability level of dependent components.

[0056] Node attributes describe node characteristics; these attributes may include, for example, the component identifier of dependent components and the vulnerability level. Edge attributes describe edge characteristics; these attributes may include, for example, the scope of dependencies.

[0057] Dependency analysis is performed on each dependent component to identify version conflicts. The vulnerability level of the dependent component can be determined by obtaining the standard vulnerability level of each dependent component from the vulnerability database, or by using the vulnerability level defined in the project.

[0058] S104. Based on node attributes and edge attributes, the original directed graph is labeled to obtain a relational network graph;

[0059] On the original directed graph, each node and each edge is labeled using the node attributes and edge attributes to obtain a relational network graph.

[0060] Figure 2 This is a schematic diagram illustrating the generation of a relationship network graph provided in an embodiment of this application. Figure 2 (a) in the figure is an original directed graph provided in an embodiment of this application. Figure 2 (b) in this application is a relational network diagram provided in an embodiment. After extracting the component identifiers of each dependent component in the dependency tree and the dependency relationships between each dependent component, an original directed graph is generated based on the component identifiers of each dependent component and the dependency relationships between each dependent component, as shown below. Figure 1 As shown in (a), dependent component A directly depends on dependent component B, dependent component B directly depends on dependent component C, and dependent component A directly depends on dependent component D, and dependent component D directly depends on dependent component C.

[0061] After performing dependency analysis and vulnerability level analysis on each dependent component to obtain the node attributes of each dependent component and the edge attributes between each dependent component, the original directed graph is labeled using the node attributes and edge attributes to obtain a relationship network graph, such as... Figure 2 As shown in (b) of the diagram.

[0062] S105. Based on the relationship network diagram, perform dependency conflict detection on each dependent component of the project and obtain the dependency conflict detection results.

[0063] Among them, the results of dependency conflict detection can be, for example, version conflicts, class conflicts, etc.

[0064] Based on the relational network diagram, dependency conflict detection is performed on each dependent component of the project, and the dependency conflict detection results are visualized and displayed.

[0065] This embodiment provides a project dependency conflict detection method. It obtains the project's dependency tree, extracts the component identifiers of each dependent component and the dependency relationships between them, and generates an original directed graph based on these identifiers and relationships. The original directed graph includes nodes and edges. Dependency analysis and vulnerability level analysis are performed on each dependent component to obtain node attributes and edge attributes between them. Based on these attributes, the original directed graph is labeled to obtain a relationship network graph. Dependency conflict detection is then performed on each dependent component based on this network graph, yielding the conflict detection results. By analyzing the dependency relationships and vulnerability levels between components and linking dependencies, along with other edge and node attributes, through the relationship network graph, a visual representation of the dependency conflict detection is achieved, resolving the issue of invisible conflict paths caused by dependency tree-based dependency detection.

[0066] Figure 3 A flowchart illustrating a project dependency conflict detection method provided in this application embodiment. Figure 2 In this embodiment, node attributes include: conflict status and vulnerability level, and edge attributes include: dependency scope and version arbitration result. Figure 2 Based on the implementation examples, the dependency analysis and vulnerability level analysis performed on each dependent component to obtain the node attributes of each dependent component and the edge attributes between each dependent component are described in detail, such as... Figure 3 As shown, the method includes:

[0067] S301. Obtain the project's dependency tree, and extract the component identifiers of each dependent component and the dependency relationships between each dependent component.

[0068] Step S301 is similar to step S101, and will not be described again here.

[0069] S302. Based on the component identifiers of each dependent component and the dependency relationships between each dependent component, generate the original directed graph, which includes nodes and edges.

[0070] In this graph, nodes represent dependent components, and edges represent dependencies between these components.

[0071] Step S302 is similar to step S102, and will not be described again here.

[0072] S303. Through the conflict relationship resolver and bytecode assembler, perform dependency analysis on each dependent component to determine the conflict status of each dependent component.

[0073] Among them, conflict states include version conflicts and class conflicts.

[0074] The conflict resolution tool performs dependency analysis on each dependent component. For example, if the relationship is: Dependency component A → Dependency component B → Dependency component C: 1.0, and Dependency component A → Dependency component D → Dependency component C: 2.0, then it detects that dependency component A depends on both versions 1.0 and 2.0 of C, indicating a version conflict. The bytecode scanning analyzer (ASM) identifies potential class conflicts by detecting the same class name in multiple dependent components. Dependency components containing classes with the same name are designated as a set of potential conflicting components. The conflict resolution tool then combines this set with the dependencies between the various dependent components to identify the actual set of conflicting components from this set of potential conflicting components.

[0075] S304. Obtain the vulnerability level of each dependent component from the vulnerability database.

[0076] The vulnerability database is used to store the initial mapping relationship between vulnerability levels and dependent components;

[0077] Based on the vulnerability database and the primary mapping relationship between vulnerability levels and dependent components stored in the vulnerability database, the vulnerability level of each dependent component is determined from the vulnerability database. For example, the vulnerability level of log4j-core:2.14.1 is "high risk".

[0078] S305. Based on the effective stage of the dependency relationship between each dependent component, determine the scope of the dependency relationship between each dependent component;

[0079] The project lifecycle includes multiple phases, such as compilation, testing, runtime, and packaging. Dependency scope refers to the specific stage at which dependencies exist between components.

[0080] For example, for dependency component A → dependency component B → dependency component C:1.0, the dependency scope between A and B is the compilation scope, while for dependency component A → dependency component D → dependency component C:2.0, the dependency scope between A and D is the test scope.

[0081] S306. When the conflict state includes multiple version conflicts of the same component, the version arbitration result of the component shall be determined based on the preset priority rule.

[0082] Among these, the preset priority rules could be, for example, prioritizing the most recently defined version or the first declared version. The version arbitration result refers to the final version determined after the rules have been applied.

[0083] When multiple versions of the same component conflict, the version arbitration result of the component is determined according to the preset priority rules. For example, the version arbitration result of the edge attribute is C:2.0.

[0084] By performing dependency analysis and vulnerability level analysis on each dependent component, the node attributes of each dependent component and the edge attributes between each dependent component were determined, thus realizing structured data mapping.

[0085] S307. Based on the conflict status, vulnerability level, dependency scope, and version arbitration results, label each node and edge of the original directed graph.

[0086] The conflict status, vulnerability level, dependency scope, and version arbitration result are marked on the corresponding nodes and edges of the original directed graph.

[0087] S308. Using the force-directed graph algorithm, the original directed graph with labeled node attributes and edge attributes is laid out to obtain a rearranged directed graph.

[0088] The nodes in the original directed graph are randomly placed, resulting in poor readability. Therefore, the Force-Directed Graph algorithm is adopted to dynamically lay out the nodes by simulating physical forces, so as to lay out the original directed graph with labeled node attributes and edge attributes, and obtain the rearranged directed graph.

[0089] S309. Based on the dependencies between the dependent components and the vulnerability levels of the dependent components, determine the size and color of each node in the original directed graph.

[0090] Conflicting dependencies can be marked with different colors. The size and color of each node in the original directed graph can be determined based on the vulnerability level of the dependent nodes. The vulnerability level is positively correlated with the size and color of each node, that is, the higher the vulnerability level, the larger the size and the darker the color of each node.

[0091] Optionally, conflict states include version conflicts, and the size and color of each node are determined using the following methods:

[0092] Based on the number of edges of each node in the original directed graph, determine the number of times each dependent component is depended on; multiply the number of times the dependent component is depended on by a preset weight coefficient as the size of the node; and determine the color of the corresponding node of the dependent component based on the second mapping relationship between the vulnerability level and color of the dependent component.

[0093] The weighting coefficients are determined based on the risk level of the dependent components.

[0094] The dimensions of the nodes are determined using the following formula:

[0095] Size = Number of times it is depended on × Weighting coefficient, where the weighting coefficient is determined by weighted fusion of the vulnerability levels defined in the vulnerability database and the custom vulnerability levels in the project.

[0096] The color of the corresponding node for a dependent component is determined by a second mapping relationship between color and vulnerability level. For example, secure – green, high risk – red.

[0097] By using a force-directed graph algorithm to ensure a reasonable distribution of nodes, and adjusting the size and color of nodes based on vulnerability levels, a clear representation of node conflict states is achieved.

[0098] S310. Based on the dependency types and version conflict paths corresponding to the dependency relationships between each dependent component, determine the line type and color of each edge in the original directed graph.

[0099] Among them, dependency types include: direct dependency and transitive dependency.

[0100] Based on the dependency types of the dependencies between each dependent component and the version conflict paths corresponding to version conflicts, the line type and color of each edge in the original directed graph are determined. For example, when the dependency type between two dependent components is a direct dependency, its dependency type is a solid line; when the dependency type between two dependent components is a transitive dependency, its dependency type is a dashed line. A bright, thick edge is used to represent a version conflict path, such as red.

[0101] S311. Based on the size and color of each node, as well as the line type and color of each edge, the rearranged directed graph is visualized to obtain a relational network graph.

[0102] Based on the size and color of each node, as well as the line type and color of each edge, the rearranged directed graph is adjusted to obtain a relational network graph.

[0103] By adjusting the size and color of each node, as well as the line type and color of each edge, readers, such as developers, can quickly identify high-risk components and conflicting paths.

[0104] S312. Based on the relationship network diagram, perform dependency conflict detection on each dependent component of the project and obtain the dependency conflict detection results.

[0105] Step S312 is similar to step S105, and will not be described again here.

[0106] This application provides a project dependency conflict detection method. By performing dependency analysis and vulnerability level analysis on each dependent component, it obtains the conflict status, vulnerability level, dependency scope, and version arbitration result. Through dependency analysis and vulnerability level analysis of each dependent component, it determines the node attributes of each dependent component and the edge attributes between them, achieving structured data mapping. Adjusting the size and color of each node, as well as the line type and color of each edge, enables developers to quickly identify high-risk components and conflict paths.

[0107] Figure 4 A flowchart illustrating a project dependency conflict detection method provided in this application embodiment. Figure 3 In this embodiment, this embodiment is in Figure 1 or Figure 3 Based on the implementation examples, a supplementary explanation of a project dependency conflict detection method is provided, such as... Figure 4 As shown, the method includes:

[0108] S401. Extract the identifiers of conflicting nodes, the paths between conflicting nodes, and the conflict types from the dependency conflict detection results;

[0109] The dependency conflict detection results identify the component identifiers, paths between conflicting nodes, and conflict types, such as version conflicts and class conflicts. Version conflicts refer to cross-branch dependencies on different versions of the same component, while class conflicts refer to classes with the same name appearing more than once when the bytecode assembler scans the code.

[0110] S402. Based on the identifiers of conflicting nodes, the paths between conflicting nodes, and the conflict type, generate association information labels that are bound to the visualization of the relationship network graph.

[0111] To more clearly display key parameters such as class conflicts, version conflicts, and high-risk nodes, the complex information presented on the relationship network diagram can be visualized by generating structured association information tags that are bound to the relationship network diagram, based on the identifier of the conflicting nodes, the path between the conflicting nodes, and the conflict type.

[0112] In one possible implementation, the associated information tags include: class conflict tags and version conflict tags, and the method further includes:

[0113] In response to a user's click on a class conflict tag to initiate a class conflict filtering request, a pulse animation is triggered on the target node corresponding to the class conflict filtering request, and the target node and its associated edges are highlighted, while the transparency of other nodes and edges in the relationship network graph is reduced.

[0114] When a user clicks the class conflict tag to initiate a class conflict filtering request, the class conflict filtering request is triggered. Visual enhancements are performed through the graph filter, including pulse animations on the target node, highlighting the target node and its associated edges, and reducing the transparency of other nodes and edges in the relationship network graph.

[0115] For example, when a user clicks the "Class Conflict (10)" label, visual enhancements are performed on the target node and associated edge corresponding to the class conflict (10), such as pulse animation and orange outline, the associated edge is highlighted with an orange gradient, and the transparency of other nodes and edges in the relationship network graph is reduced to 30%.

[0116] In response to a version conflict tracing request initiated by a user clicking the version conflict tag, the target node corresponding to the version conflict tracing request is used as the starting point. A directed graph traversal algorithm is employed to traverse the relational network graph, identify and collapse other nodes and edges in the relational network graph that are not related to the target node.

[0117] Directed graph traversal algorithms can include, for example, breadth-first search and depth-first search. Other nodes unrelated to the target node are those not visited during the traversal.

[0118] Starting with the target node corresponding to the version conflict tracing request, a directed graph traversal algorithm is used to traverse the relational network graph. Every node in the graph that has a dependency relationship with the target node is visited. Nodes not visited are identified as unrelated nodes and are then collapsed. For example, when using breadth-first search, nodes not visited at each level are considered unrelated nodes. Understandably, when there is a dependency relationship between two collapsed nodes, the edges corresponding to that dependency are also collapsed.

[0119] When version conflicts exist in a project, the version arbitration result is determined according to the preset priority rules. This may result in the declared version being greater than the actual imported version. These nodes are downgraded nodes.

[0120] In one possible implementation, the associated information tags include: high-risk node tags and downgraded node tags.

[0121] High-risk nodes refer to nodes with vulnerabilities classified as high-risk.

[0122] When a user clicks on a high-risk node label or a downgraded node label, the high-risk node or downgraded node can be highlighted.

[0123] When a user clicks on an associated information tag, a corresponding request is triggered. Visual enhancements are applied to the target nodes and edges related to the associated information tag, while visual reduction is applied to other irrelevant nodes, thereby improving the readability of the relationship network graph.

[0124] In one possible implementation, the method further includes:

[0125] In response to a user's version upgrade analysis request triggered by a relationship network graph, after obtaining the upgrade version selected by the user, the original directed graph is copied; based on the upgrade version, dependency analysis and vulnerability level analysis are re-performed on each dependent component to annotate the copied original directed graph, resulting in an upgraded relationship network graph; the upgraded relationship network graph is compared with the original relationship network graph, and a difference report is generated based on the comparison results.

[0126] The difference report may include, for example, the type of change. This could include new dependencies added after the upgrade, or risks introduced.

[0127] By comparing the relationship network diagrams before and after the upgrade, a difference report is generated, providing guidance for developers to test the upgraded project.

[0128] In one possible implementation, bytecode comparison can be performed on the upgraded project for deep compatibility testing. Deep compatibility testing includes class-level testing, method-level testing, and call chain analysis. Class-level testing checks whether classes removed during the upgrade are still referenced in the project; method-level testing detects changes in parameter types, return values, and anomalies; and call chain analysis determines the location of the calls.

[0129] You can also mark the deep compatibility test results in the network diagram, such as marking "method incompatibility" with a label. Clicking on a risk node will display an impact range matrix, showing the affected classes, problematic methods, and call locations.

[0130] This application provides a project dependency conflict detection method that extracts the identifiers of conflicting nodes, the paths between conflicting nodes, and the conflict types from the dependency conflict detection results. Based on the identifiers of conflicting nodes, the paths between conflicting nodes, and the conflict types, it generates association information tags that are bound to the visualization of the relationship network graph. This transforms the complex information presented on the relationship network graph into structured association information tags, thereby improving the readability of the dependency conflict detection results.

[0131] Figure 5 This is a schematic diagram of the structure of a project dependency conflict detection device provided in an embodiment of this application, as shown below. Figure 5 As shown, the project dependency conflict detection device 50 provided in this embodiment includes:

[0132] The acquisition module 501 is used to acquire the project's dependency tree and extract the component identifiers of each dependent component and the dependency relationships between each dependent component.

[0133] The processing module 502 is used to generate an original directed graph based on the component identifiers of each dependent component and the dependency relationships between each dependent component. The original directed graph includes nodes and edges. The nodes in the original directed graph are used to represent each dependent component, and the edges in the original directed graph are used to represent the dependency relationships between each dependent component.

[0134] The processing module 502 is also used to perform dependency analysis and vulnerability level analysis on each dependent component to obtain the node attributes of each dependent component and the edge attributes between each dependent component.

[0135] The processing module 502 is also used to annotate the original directed graph based on node attributes and edge attributes to obtain a relational network graph;

[0136] The detection module 503 is used to perform dependency conflict detection on each dependent component of the project based on the relationship network graph, and obtain the dependency conflict detection results.

[0137] In one possible implementation, node attributes include conflict state and vulnerability level, edge attributes include dependency scope and version arbitration result, and processing module 502 is further used to perform dependency analysis on each dependent component through a conflict relationship resolver and a bytecode assembler scanner to determine the conflict state of each dependent component; obtain the vulnerability level of each dependent component from a vulnerability database, which is used to store the first mapping relationship between vulnerability levels and dependent components; determine the dependency scope of the dependency relationship between each dependent component based on the effective stage of the dependency relationship between each dependent component; and determine the version arbitration result of the component based on a preset priority rule when the conflict state includes multiple version conflicts of the same component.

[0138] In one possible implementation, the conflict state includes version conflict. The processing module 502 is further used to label each node and edge of the original directed graph based on the conflict state, vulnerability level, dependency scope, and version arbitration result. A force-directed graph algorithm is used to lay out the original directed graph with labeled node and edge attributes, resulting in a rearranged directed graph. The size and color of each node in the original directed graph are determined based on the dependency relationships between dependent components and the vulnerability levels of each dependent component. The line type and color of each edge in the original directed graph are determined based on the dependency types of the dependency relationships between dependent components and the version conflict path corresponding to the version conflict. Based on the size and color of each node, and the line type and color of each edge, the rearranged directed graph is visualized to obtain a relationship network graph.

[0139] In one possible implementation, the processing module 502 is further configured to determine the number of times each dependent component is depended upon based on the number of edges of each node in the original directed graph; multiply the number of times the dependent component is depended upon by a preset weight coefficient as the size of the node, the weight coefficient being determined based on the risk level of the dependent component; and determine the color of the corresponding node of the dependent component based on a second mapping relationship between the vulnerability level of the dependent component and its color.

[0140] In one possible implementation, the detection module 503 is further configured to extract the identifiers of conflicting nodes, the paths between conflicting nodes, and the conflict type from the dependency conflict detection results; and generate association information tags that are bound to the visualization of the relationship network graph based on the identifiers of conflicting nodes, the paths between conflicting nodes, and the conflict type.

[0141] In one possible implementation, class conflict tags and version conflict tags,

[0142] The detection module 503 responds to the class conflict filtering request initiated by the user clicking the class conflict label, and is also used to trigger the pulse animation of the target node corresponding to the class conflict filtering request, highlight the target node and the associated edges on the target node, and reduce the transparency of other nodes and edges in the relationship network graph.

[0143] The detection module 503 responds to the version conflict tracing request initiated by the user clicking the version conflict label. It is also used to traverse the relationship network graph with the target node corresponding to the version conflict tracing request as the starting point, and to identify and collapse other nodes and edges in the relationship network graph that are not related to the target node.

[0144] In one possible implementation, the detection module 503, in response to a version upgrade analysis request triggered by a user through a relational network graph, is further configured to, after obtaining the upgrade version selected by the user, copy the original directed graph; based on the upgrade version, re-perform dependency analysis and vulnerability level analysis on each dependent component to annotate the copied original directed graph, thereby obtaining the upgraded relational network graph; compare the upgraded relational network graph with the original relational network graph, and generate a difference report based on the comparison results.

[0145] This embodiment provides a project dependency conflict detection device that can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0146] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 6As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the electronic device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus.

[0147] In a specific implementation, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to perform the above-described method.

[0148] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0149] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0150] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0151] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0152] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0153] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0154] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0155] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application.

[0156] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0157] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0158] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0159] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0160] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0161] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0162] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting project dependency conflicts, characterized in that, include: Obtain the project's dependency tree, and extract the component identifiers of each dependent component in the dependency tree and the dependency relationships between each dependent component; Based on the component identifiers of each dependent component and the dependency relationships between each dependent component, an original directed graph is generated. The original directed graph includes nodes and edges. The nodes in the original directed graph are used to represent each dependent component, and the edges in the original directed graph are used to represent the dependency relationships between each dependent component. Dependency analysis and vulnerability level analysis are performed on each of the dependent components to obtain the node attributes of each dependent component and the edge attributes between each dependent component; Based on the node attributes and edge attributes, the original directed graph is labeled to obtain a relational network graph; Based on the aforementioned relationship network diagram, dependency conflict detection is performed on each dependent component of the project to obtain dependency conflict detection results.

2. The method according to claim 1, characterized in that, The node attributes include: conflict status and vulnerability level; the edge attributes include: dependency scope and version arbitration result; the dependency analysis and vulnerability level analysis performed on each dependent component yields the node attributes of each dependent component and the edge attributes between each dependent component, including: The conflict relationship resolver and bytecode assembler are used to perform dependency analysis on each dependent component and determine the conflict status of each dependent component. The vulnerability level of each dependent component is obtained from the vulnerability database, which is used to store the first mapping relationship between vulnerability levels and dependent components; Based on the effective stage of the dependency relationship between the dependent components, the dependency scope of the dependency relationship between the dependent components is determined; When the conflict state includes multiple version conflicts of the same component, the version arbitration result of the component is determined based on a preset priority rule.

3. The method according to claim 2, characterized in that, The conflict states include version conflicts. The annotation of the original directed graph based on the node attributes and edge attributes to obtain a relational network graph includes: Based on the conflict status, vulnerability level, dependency scope, and version arbitration results, each node and edge of the original directed graph is labeled. The force-directed graph algorithm is used to lay out the original directed graph labeled with the node attributes and edge attributes to obtain a rearranged directed graph; Based on the dependencies between the dependent components and the vulnerability levels of each dependent component, the size and color of each node in the original directed graph are determined. Based on the dependency types of the dependencies between the dependent components and the version conflict paths corresponding to the version conflicts, the line type and color of each edge in the original directed graph are determined. Based on the size and color of each node, as well as the line type and color of each edge, the rearranged directed graph is visualized to obtain a relational network graph.

4. The method according to claim 3, characterized in that, The step of determining the size and color of each node in the original directed graph based on the dependencies between the dependent components and the vulnerability levels of each dependent component includes: Based on the number of edges of each node in the original directed graph, determine the number of times each dependent component is depended upon; The size of the node is the product of the number of times the dependent component is depended on and a preset weight coefficient, where the weight coefficient is determined based on the risk level of the dependent component. Based on the second mapping relationship between the vulnerability level and color of the dependent component, the color of the corresponding node of the dependent component is determined.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: Extract the identifiers of conflicting nodes, the paths between conflicting nodes, and the conflict types from the dependency conflict detection results; Based on the identifiers of the conflicting nodes, the paths between the conflicting nodes, and the conflict type, associated information tags are generated that are linked to the visualization of the relationship network graph.

6. The method according to claim 5, characterized in that, The associated information tags include: class conflict tags and version conflict tags, and the method further includes: In response to a user's click on the class conflict tag to initiate a class conflict filtering request, a pulse animation is triggered on the target node corresponding to the class conflict filtering request, and the target node and its associated edges are highlighted, while the transparency of other nodes and edges in the relationship network graph is reduced. In response to a version conflict tracing request initiated by a user clicking the version conflict tag, the target node corresponding to the version conflict tracing request is used as the starting point. A directed graph traversal algorithm is then used to traverse the relationship network graph to identify and collapse other nodes and edges in the relationship network graph that are not related to the target node.

7. The method according to any one of claims 1-4, characterized in that, The method further includes: In response to a version upgrade analysis request triggered by a user through the relationship network graph, after obtaining the upgrade version selected by the user, the original directed graph is copied. Based on the upgraded version, dependency analysis and vulnerability level analysis are re-performed on each dependent component to annotate the copied original directed graph and obtain the upgraded relationship network graph. The upgraded relationship network diagram is compared with the original relationship network diagram, and a difference report is generated based on the comparison results.

8. A project dependency conflict detection device, characterized in that, include: The acquisition module is used to acquire the project's dependency tree and extract the component identifiers of each dependent component in the dependency tree and the dependency relationships between each dependent component; The processing module is used to generate an original directed graph based on the component identifiers of each dependent component and the dependency relationships between the dependent components. The original directed graph includes nodes and edges. The nodes in the original directed graph are used to represent each dependent component, and the edges in the original directed graph are used to represent the dependency relationships between the dependent components. The processing module is also used to perform dependency analysis and vulnerability level analysis on each of the dependent components to obtain the node attributes of each dependent component and the edge attributes between each dependent component. The processing module is also used to annotate the original directed graph based on the node attributes and edge attributes to obtain a relational network graph; The detection module is used to perform dependency conflict detection on each dependent component of the project based on the relationship network graph, and obtain the dependency conflict detection results.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 7.

Images