Component dependency relationship query method and device

Abstract

The invention discloses a component dependency relationship query method and device, and belongs to the technical field of information. The method comprises the following steps: querying a component dependency information set based on a plurality of components to determine at least one target dependency information in the component dependency information set; and based on the at least one piece of target dependency information, determining a dependency relationship among the plurality of components. Wherein the target dependency information comprises the dependency relationship of at least one component in the multiple components, the multiple components come from the component library, the component dependency information set comprises multiple pieces of dependency information, and each piece of dependency information in the multiple pieces of dependency information corresponds to one component with dependency in the component library. According to the method, the dependency relationship among the to-be-queried components is queried in the target dependency information related to the to-be-queried components, and the query operation is prevented from being executed in the dependency information irrelevant to the to-be-queried components, so that the quantity of the dependency information needing to execute the query operation is reduced, and the query efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of information technology, and in particular to a method and apparatus for querying component dependencies. Background Technology

[0002] Java is an object-oriented programming language. In Java software development (referred to as Java development), a project refers to a complete software application or a software system containing a set of related applications. A project can be implemented by calling and / or integrating multiple components. A component is a reusable software module with independent functionality. Because there are complex dependencies between components (such as open-source components) called and / or integrated during Java development, and these dependencies are closely related to the project's build, compile, and vulnerability remediation strategies, it is necessary to determine the dependencies between the various components in the project.

[0003] Currently, software composition analysis (SCA) tools can be used to scan the software code of a project to obtain a list of components contained in the project, and then the dependencies between the components in the list can be determined by querying a dependency knowledge base.

[0004] However, the number of components that Java can call and / or integrate is extremely large (currently exceeding ten million). The dependencies between these components are complex and there are many nested relationships. Therefore, the amount of data in the dependency knowledge base representing the dependencies between components is very large, resulting in low efficiency in querying the dependencies between components in the dependency tree. Summary of the Invention

[0005] This application provides a method and apparatus for querying component dependencies, which can improve the efficiency of querying dependencies between components.

[0006] The technical solution provided in this application is as follows:

[0007] Firstly, this application provides a method for querying component dependencies. The method includes: querying a set of component dependency information based on multiple components to determine at least one target dependency in the set; and determining the dependency relationships between the multiple components based on the at least one target dependency. The target dependency information includes the dependency relationship of at least one component among the multiple components. The multiple components come from a component library, and the set of component dependency information includes multiple dependency entries, each of which corresponds to a component in the component library that has a dependency on it. For the first dependency entry corresponding to the first component in the component library that has a dependency, the first dependency entry includes a dependency path indicating the dependency relationship of the first component on other components in the component library.

[0008] This application's method first determines the target dependency information related to the multiple components to be queried, and then queries the dependency relationships between the multiple components in the target dependency information. This avoids performing query operations in dependency information unrelated to the multiple components to be queried. Therefore, compared with related technologies that query dependency relationships in the full dependency tree of the component library, this application reduces the amount of data that needs to be queried, thereby improving the efficiency of querying component dependency relationships. In addition, compared with the dependency tree that records the full dependency relationships between components in the component library, the amount of data recording the dependency relationships of a component to other components in the dependency information corresponding to a certain component in the component dependency information set is usually far less than the data volume of the aforementioned full dependency tree. Therefore, compared with querying component dependency relationships in the full dependency tree, this application can also improve the efficiency of querying component dependency relationships by querying dependency relationships in dependency information with a smaller amount of data.

[0009] In one possible design approach, when the first dependency information is represented in the form of a dependency tree, the first component is the root node of the dependency tree.

[0010] In this design approach, the first dependency information includes dependency paths indicating the dependencies of the first component on other components in the component library, but excludes dependency paths indicating the dependencies of other components in the component library on the first component. Thus, the first dependency information can also be understood as indicating the dependencies between the first component and other components that the first component needs to call and / or integrate when implementing its own functionality. Therefore, the first dependency information can be called the dependency information of the first component; that is, the first dependency information corresponds to the first component.

[0011] In another possible design approach, if a duplicate first dependency exists in the dependencies of other components in the first component's dependency library, then the target dependency path in the first dependency information retains the first dependency, while other dependency paths in the first dependency information besides the target dependency path do not retain the first dependency. Specifically, the dependency path in the target dependency path that indicates the first dependency is the shortest of all dependency paths in the first dependency information that indicate the first dependency.

[0012] In this possible design, the dependency information is reduced in size by deduplicating the dependency relationships recorded in the dependency information. This results in the component dependency information set composed of deduplicated dependency information having less data (or smaller size) than a single full dependency tree. This reduces the performance requirements of the query device and makes the solution provided in this application more universal.

[0013] In another possible design approach, the above-mentioned querying of a set of component dependency information based on multiple components to determine at least one target dependency information in the set of component dependency information includes: querying the set of component dependency information based on the identifiers of multiple components; when it is determined that any one of the multiple components is the starting point of the dependency path included in the second dependency information in the set of component dependency information, the second dependency information is determined as the target dependency information.

[0014] This possible design allows for querying dependency information related to multiple components in the component dependency information set.

[0015] In another possible design approach, when there are multiple target dependency information entries, the above-mentioned determination of the dependency relationship between multiple components based on at least one target dependency information entry includes: for a first target dependency information entry among the multiple target dependency information entries, obtaining the intersection corresponding to the first target dependency information entry, where the intersection corresponding to the first target dependency information entry refers to the intersection of all components on the dependency path in the first target dependency information entry and the intersection between multiple components, and the first target dependency information entry is any target dependency information entry among the at least one target dependency information entry; based on the intersection corresponding to the multiple target dependency information entries, determining whether there is a second target dependency information entry among the multiple target dependency information entries, where the intersection corresponding to the second target dependency information entry is a subset of the intersection corresponding to the other target dependency information entries, and the intersection corresponding to the other target dependency information entries includes the component located at the starting position of the dependency path in the second target dependency information entry, and the other target dependency information entries are target dependency information entries among the multiple target dependency information entries other than the second target dependency information entry; if there is a second target dependency information entry among the multiple target dependency information entries, determining the dependency relationship between multiple components based on the other target dependency information entries.

[0016] The intersection of the target dependency information represents the set of components to be queried included in the dependency path of that target dependency information. Therefore, when the set of components to be queried included in the dependency path of the second target dependency information is a subset of the set of components to be queried included in the dependency paths of other target dependency information, the dependency relationships between the components to be queried obtained by the query device through traversing other target dependency information include the dependency relationships between the components to be queried obtained through traversing the second target dependency information. Therefore, if the query device performs traversal queries on both the second and other target dependency information, it will generate redundant operations. Therefore, based on the above two possible designs, when the query device determines that the second target dependency information exists in multiple target dependency information, it can determine the dependency relationships between multiple components to be queried based on the other target dependency information, without needing to traverse the second target dependency information. This reduces the number of dependency information that the query device ultimately needs to traverse, or in other words, it reduces the number of dependency trees / sub-dependency trees that the query device ultimately needs to traverse. Furthermore, this possible design improves the speed at which the query device queries the dependency relationships between components to be queried.

[0017] In another possible design approach, the above-mentioned determination of the dependency relationship between multiple components based on other target dependency information includes: for the third target dependency information in the other target dependency information, traversing the dependency path in the third target dependency information based on the identifier of multiple components to determine the dependency relationship between the components that belong to the dependency path in the third target dependency information, wherein the third target dependency information is any target dependency information in the other target dependency information.

[0018] This possible design achieves the goal of querying the dependencies of the component to be queried within a single target dependency information.

[0019] In another possible design approach, for the fourth target dependency information in at least one target dependency information, where the fourth target dependency information is any target dependency information in at least one target dependency information, the above-mentioned determination of the dependency relationship between multiple components based on at least one target dependency information includes: traversing the dependency path in the fourth target dependency information based on the identifiers of multiple components to determine the dependency relationship between the components that belong to the dependency path in the fourth target dependency information among the multiple components.

[0020] This possible design achieves the goal of querying the dependencies of the component to be queried within a single target dependency information.

[0021] In another possible design approach, before querying the set of component dependency information based on multiple components, the method further includes: scanning the target software to determine a list of components contained in the target software, the components of the target software being from a component library, the list including the multiple components mentioned above.

[0022] With this possible design, after the SCA tool scans the target software to obtain a list of components included in the target software, the application can query the dependencies of the components in the list, thereby automating the component analysis of the target software.

[0023] In another possible design approach, the above method also includes: outputting the dependencies between multiple components.

[0024] In another possible design approach, the above method is applied to a server that provides a component dependency query service. Before querying the set of component dependency information based on multiple components, the above method also includes receiving multiple components sent by the query client.

[0025] With this possible design, the method provided in this application can be deployed on a server as a query service.

[0026] In another possible design approach, the component is a component from a Java open-source component library.

[0027] Secondly, this application provides a component dependency query apparatus, comprising: a query unit, configured to query a set of component dependency information based on multiple components to determine at least one target dependency information in the set of component dependency information; and a determination unit, configured to determine the dependency relationship between multiple components based on the at least one target dependency information. The target dependency information includes the dependency relationship of at least one component among the multiple components. The multiple components are from a component library, and the set of component dependency information includes multiple dependency information entries, each of which corresponds to a component in the component library that has a dependency on it. For the first dependency information corresponding to the first component in the component library that has a dependency on it, the first dependency information includes a dependency path indicating the dependency relationship of the first component on other components in the component library.

[0028] In one possible design approach, when the first dependency information is represented in the form of a dependency tree, the first component is the root node of the dependency tree.

[0029] In another possible design approach, if a duplicate first dependency exists in the dependencies of other components in the first component's dependency library, then the target dependency path in the first dependency information retains the first dependency, while other dependency paths in the first dependency information besides the target dependency path do not retain the first dependency. Specifically, the dependency path in the target dependency path that indicates the first dependency is the shortest of all dependency paths in the first dependency information that indicate the first dependency.

[0030] In another possible design approach, the query unit is specifically used to: query a set of component dependency information based on the identifiers of multiple components; when it is determined that any one of the multiple components is the starting point of the dependency path included in the second dependency information in the set of component dependency information, the second dependency information is determined as the target dependency information.

[0031] In another possible design approach, when there are multiple target dependency information entries, the determining unit is specifically used for: obtaining the intersection of the first target dependency information among the multiple target dependency information entries; the intersection of the first target dependency information entries refers to the intersection of all components on the dependency path in the first target dependency information entry and the intersection between multiple components; the first target dependency information entry is any target dependency information entry in at least one target dependency information entry; determining whether there is a second target dependency information entry among the multiple target dependency information entries based on the intersection of the multiple target dependency information entries; the intersection of the second target dependency information entry is a subset of the intersection of the other target dependency information entries, and the intersection of the other target dependency information entries includes the component located at the starting position of the dependency path in the second target dependency information entry; the other target dependency information entry is the target dependency information entry other than the second target dependency information entry among the multiple target dependency information entries; if the second target dependency information entry exists among the multiple target dependency information entries, determining the dependency relationship between multiple components based on the other target dependency information entries.

[0032] In another possible design approach, a determining unit is used to traverse the dependency paths in the third target dependency information based on the identifiers of multiple components to determine the dependency relationships between components that belong to the dependency paths in the third target dependency information, where the third target dependency information is any target dependency information in the other target dependency information.

[0033] In another possible design approach, for at least one fourth target dependency information, where the fourth target dependency information is any one of the at least one target dependency information, the determining unit is used to traverse the dependency paths in the fourth target dependency information based on the identifiers of multiple components, so as to determine the dependency relationships between the components that belong to the dependency paths in the fourth target dependency information among the multiple components.

[0034] In another possible design, the apparatus further includes a scanning unit for scanning the target software to determine a list of components contained in the target software before querying a set of component dependency information based on multiple components. The components contained in the target software are from a component library, and the list includes the aforementioned multiple components.

[0035] In another possible design, the above device further includes an output unit for outputting the dependencies between multiple components.

[0036] In another possible design, the above-mentioned device is deployed on a server that provides a component dependency query service. The device further includes a receiving unit for receiving multiple components sent by the query client before querying the set of component dependency information based on multiple components.

[0037] In another possible design approach, the component is a component from a Java open-source component library.

[0038] Thirdly, this application provides a component dependency query apparatus. The apparatus includes: a memory, a communication interface, and one or more processors. The one or more processors receive or transmit data through the communication interface, and are configured to read program instructions stored in the memory to execute the method provided by the first aspect and any possible design scheme within the first aspect.

[0039] Fourthly, this application provides a computer-readable storage medium that is a non-volatile computer-readable storage medium, the computer-readable storage medium including computer program instructions, which, when executed by a processor, a computing device including a processor, or a computer system, perform the methods provided by the first aspect and any possible design of the first aspect.

[0040] Fifthly, this application provides a computer program product containing instructions that, when executed by a processor, a computing device including a processor, or a computer system, cause the processor, the computing device including a processor, or the computer system to perform the methods provided by the first aspect and any possible design of the first aspect.

[0041] Sixthly, this application provides a chip that includes a processor for running program instructions or code. The chip or a device including the chip can be used to perform methods provided by the first aspect and any possible design embodiment within the first aspect. Exemplarily, the chip further includes an input interface, an output interface, and a memory. The chip's input interface, output interface, processor, and memory are connected via internal interconnection paths. The memory in the chip stores program instructions or code executed by the processor, and the input and output interfaces are used for communication and connection between the chip and other chips or devices.

[0042] It is understood that any of the component dependency query devices, computer-readable storage media, computer program products or chips provided above can be applied to the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0043] In this application, the names of the aforementioned component dependency query devices, etc., do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may appear under other names. As long as the functions of each device or functional module are similar to those in this application, they all fall within the protection scope of this application. Attached Figure Description

[0044] Figure 1 This is a schematic diagram illustrating an application scenario of the method provided in the embodiments of this application;

[0045] Figure 2 This is a schematic diagram illustrating an exemplary application scenario of the method provided in the embodiments of this application;

[0046] Figure 3 This is a schematic diagram illustrating another exemplary application scenario of the method provided in the embodiments of this application;

[0047] Figure 4 This is a schematic diagram illustrating another exemplary application scenario of the method provided in the embodiments of this application;

[0048] Figure 5 This is a schematic diagram illustrating another exemplary application scenario of the method provided in the embodiments of this application;

[0049] Figure 6 This is a schematic diagram illustrating another exemplary application scenario of the method provided in the embodiments of this application;

[0050] Figure 7 This is a schematic diagram of a full dependency tree provided in an embodiment of this application;

[0051] Figure 8 This is a schematic diagram of a sub-dependency tree extracted from the full dependency tree according to an embodiment of this application;

[0052] Figure 9 This is a schematic diagram illustrating a method for deduplicating dependency information according to an embodiment of this application;

[0053] Figure 10 This is a schematic diagram illustrating another method for deduplicating dependency information provided in an embodiment of this application;

[0054] Figure 11 This is a schematic diagram illustrating another method of deduplicating dependency information provided in an embodiment of this application;

[0055] Figure 12 This is a schematic diagram illustrating another method of deduplicating dependency information provided in an embodiment of this application;

[0056] Figure 13 This is a flowchart illustrating a method for querying component dependencies provided in an embodiment of this application;

[0057] Figure 14 This is a schematic diagram illustrating a process of querying target dependency information in a set of component dependency information based on multiple components, provided in an embodiment of this application.

[0058] Figure 15 This is a schematic diagram illustrating a process for determining the dependency relationships between multiple components to be investigated based on target dependency information, as provided in an embodiment of this application.

[0059] Figure 16 This is a flowchart illustrating another method for querying component dependencies provided in an embodiment of this application;

[0060] Figure 17 This is a flowchart illustrating another method for querying component dependencies provided in an embodiment of this application;

[0061] Figure 18 This is a schematic diagram of an intersection matching result provided in an embodiment of this application;

[0062] Figure 19 This is a schematic diagram illustrating an exemplary process for querying component dependencies provided in an embodiment of this application;

[0063] Figure 20 This is a schematic diagram of the structure of a component dependency query device provided in an embodiment of this application;

[0064] Figure 21 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0066] To facilitate understanding, the technologies and background involved in the embodiments of this application will be explained below.

[0067] 1) Components

[0068] A component is a reusable software module with independent functionality. Key characteristics of components include independence, reusability, encapsulation, and substitutability. These features allow components to be used in different systems and environments, thereby improving software development efficiency, reducing code duplication, and providing good isolation and flexibility. For example, a component can take the form of a class, interface, or package. By providing specific functionalities or features, a component can be called and / or integrated by other programs or systems. For instance, a calculator class that includes operations such as addition, subtraction, multiplication, and division can be called and reused by other programs, encapsulating these operations.

[0069] In Java development, the components that Java can call and / or integrate generally come from component libraries, such as open-source component libraries. By calling and / or integrating components, Java can build complete applications or software systems consisting of a set of related applications; such applications or software systems can be called projects.

[0070] For example, Java development can be based on a Maven repository. A Maven repository is a simple file system that stores all Maven artifacts, such as dependencies, plugins, and projects.

[0071] 2) SCA

[0072] SCA (Software Compatibility Analysis) is a technology used to identify and analyze various software components used in a software system. By examining source code, binary files, and other data, SCA can identify components that are called and / or integrated in the software and collect relevant information such as component names, version numbers, license types, and security vulnerabilities.

[0073] In related technologies, when it is necessary to determine the dependencies between various components called and / or integrated in a Java-based project, the query device can first scan the project's software code using an SCA tool to obtain a list of components included in the project. Then, it can determine the dependencies between the components in the list by querying a dependency knowledge base. This dependency knowledge base is a knowledge base that includes the dependencies between various components in a component library. Here, the component library is a library that provides components for project development. For example, the component library is an open-source Java component library.

[0074] Because the component library contains a massive number of components (currently exceeding ten million), and the dependencies between these components are complex, with various nested structures and numerous instances of repeated nesting, the dependency tree data representing the dependencies between components in the dependency knowledge base is enormous. A dependency tree is a data structure used to display the dependencies between modules and / or components in a project. For example, a JSON file representing a dependency tree of components in a commonly used component library can be tens of gigabytes (GB) in size. JSON (JavaScript Object Notation) is a commonly used file format. Therefore, when a query device traverses this dependency tree to find dependencies between components, it needs to spend a considerable amount of time traversing the tree to ensure high accuracy of the query results, making the process of querying component dependencies within this dependency tree inefficient.

[0075] Based on this, embodiments of this application provide a method for querying component dependencies. In this method, a component dependency information set used to record dependencies between components in a component library includes multiple dependency information entries, each corresponding to a component in the component library with which it has a dependency. For the first dependency information corresponding to the first component in the component library with which it has a dependency, the first dependency information includes a dependency path indicating the dependency relationship of the first component on other components in the component library. In other words, the component dependency information set records the dependency relationships of each dependent component on other components through multiple dependency information entries. Thus, when querying the dependencies between multiple components to be queried, the querying device can first query the component dependency information set based on these multiple components to determine at least one target dependency information entry in the component dependency information set. The target dependency information includes the dependency relationship of at least one component among the multiple components to be queried. Then, based on the at least one target dependency information entry, the querying device determines the dependencies between the multiple components.

[0076] For a given component, such as the first component, compared to the dependency tree that records all dependencies between components in the component library, the amount of data recording the dependencies of the first component on other components in the first dependency information corresponding to the first component is far less than the amount of data in the aforementioned dependency tree. Therefore, compared to related technologies, the method of this application embodiment first determines the target dependency information related to the multiple components to be queried, and then queries (e.g., traverses) the dependencies between the multiple components to be queried in the target dependency information. This avoids performing query operations in dependency information unrelated to the multiple components to be queried. Thus, compared to related technologies, this application embodiment reduces the amount of dependency information that needs to be queried, thereby improving the efficiency of querying component dependencies.

[0077] refer to Figure 1 , Figure 1 A schematic diagram illustrating an application scenario of the method provided in an embodiment of this application is shown. For example... Figure 1 As shown, this application scenario includes a query device. The query device receives components to be queried, queries the dependencies between components, obtains query results, and outputs the query results. Here, the components to be queried refer to the components whose dependencies are to be queried.

[0078] In one example, the components to be queried can be components specified by the user according to their needs, or some or all of the components in the component list obtained after scanning and analyzing the software code of a project that requires analysis of dependencies between components using an SCA tool. In another example, the query device can be implemented as a binary component analysis security detection tool or an open source governance service tool, etc., and is not limited to these.

[0079] In this embodiment of the application, the query device queries the dependency relationships between the components to be queried based on a pre-configured set of component dependency information.

[0080] In some embodiments, the set of component dependency information may be pre-loaded into the query device.

[0081] Combination Figure 1 ,refer to Figure 2 , Figure 2 This diagram illustrates an exemplary application scenario of the method provided in this application. Figure 2 As shown, the query device has a pre-set set of component dependency information. In this case, the query device with the pre-set set of component dependency information can be deployed on the user's local device or on a server / service platform accessible to the user's device; there is no limitation on this. Thus, after receiving the component to be queried, the query device can query the component based on its own pre-set set of component dependency information, obtain the query results, and output the query results.

[0082] It is understandable that when a query device with a pre-set set of component dependency information is deployed on a server / service platform, the process by which the query device obtains the dependency relationship between components by executing the method provided in the embodiments of this application can be regarded as a service provided by the server / service platform, such as a binary component analysis security detection service or an open source governance service with component dependency query function.

[0083] In one example embodiment, when a query device pre-configured with a set of component dependency information is deployed on a server / service platform, combined with Figure 2 ,refer to Figure 3 , Figure 3 This diagram illustrates another exemplary application scenario of the method provided in the embodiments of this application. For example... Figure 3 As shown, the query device is deployed on a server / service platform. Thus, when a query client deployed on a user device receives a component to be queried, it can communicate with the server / service platform to obtain the query result obtained by the query device on the server / service platform after executing the method provided in this application embodiment, and then output the query result.

[0084] Optionally, the user device deploying the query client can communicate with the server / service platform via a network. For example, when the user device and the server / service platform are deployed on the same user's network, the user device can communicate with the server / service platform through that user's internal network. Alternatively, when the user device and the server / service platform are deployed on different networks, the user device can communicate with the server / service platform via the Internet.

[0085] Optionally, the user equipment can also connect and communicate with the server / service platform via cable.

[0086] In other embodiments, the set of component dependency information may be pre-placed on any device accessible to the querying device.

[0087] Combination Figure 1 ,refer to Figure 4 , Figure 4 This diagram illustrates yet another exemplary application scenario of the method provided in the embodiments of this application. For example... Figure 4 As shown, the query device communicates with a device that has a pre-set set of component dependency information. Thus, when the query device obtains the component to be queried, it accesses the component dependency information set to implement the component dependency query method provided in this embodiment, thereby obtaining and outputting the query results. The communication method between the query device and the device with the pre-set set of component dependency information can be referenced from the communication method between a user device with a query client deployed and a server / service platform described above, and will not be repeated here.

[0088] It is understandable that, in the above Figures 1-4 When the components to be checked are components in the component list obtained after scanning and analyzing the software code of the project using the SCA tool, the operation of scanning and analyzing the software code of the project using the SCA tool (referred to as component acquisition operation) can be performed by the query device described in the embodiments of this application, or by a device configured with the SCA tool (referred to as SCA device).

[0089] refer to Figure 5 , Figure 5 This diagram illustrates yet another exemplary application scenario of the method provided in the embodiments of this application. For example... Figure 5 As shown, the query device is equipped with an SCA tool. In this case, the query device can use the SCA tool to scan and analyze the software code of the project to be queried, thereby obtaining a list of components included in the project. Then, it can use some or all of the components recorded in this list as the components to be queried for dependency queries, and finally output the query results. The project to be queried is the project for which the dependencies between components need to be queried.

[0090] Optionally, the process by which the query device selects some or all of the components recorded in the list as the components to be queried can be achieved through human-computer interaction between the query device and the user. For example, the query device displays the list to the user through an output interface such as a display, and receives the components selected by the user from the list through an input interface such as a keyboard or mouse, thereby determining the components selected by the user as the components to be queried.

[0091] refer to Figure 6 , Figure 6 This diagram illustrates yet another exemplary application scenario of the method provided in the embodiments of this application. For example... Figure 6As shown, the query device communicates with an SCA device equipped with an SCA tool. In this case, the SCA device uses the SCA tool to scan and analyze the software code of the project to be queried, thereby obtaining a list of components included in the project. Then, the SCA device sends some or all of the components recorded in this list as components to be queried to the query device, which then performs dependency queries on the received components and finally outputs the query results.

[0092] Optionally, the process by which the SCA device selects some or all of the components recorded in the list as the components to be searched can be achieved through human-computer interaction between the SCA device and the user. For example, the SCA device displays the list to the user through an output interface such as a display, and receives the components selected by the user from the list through an input interface such as a keyboard or mouse, thereby determining the components selected by the user as the components to be searched.

[0093] It should be understood that the above content is an exemplary description of the application scenarios of the component dependency query method provided in the embodiments of this application, and does not constitute a limitation on the application scenarios of the method. As those skilled in the art know, as business needs change, its application scenarios can be adjusted according to application needs, and the embodiments of this application do not list them one by one.

[0094] This application also provides a component dependency query device, which executes the method provided in this application to query component dependencies. For example, the query device is as described above. Figures 1-6 The query device shown.

[0095] Optionally, the query device can be implemented by a computing device, a cluster of computing devices, or a functional module within a computing device. In one example, the computing device includes, but is not limited to, terminal devices such as general-purpose computers, laptops, and tablets. In another example, the computing device is a device used to implement a server or server cluster.

[0096] The following description, in conjunction with the accompanying drawings, describes the set of component dependency information required in the method provided in the embodiments of this application.

[0097] In this embodiment of the application, the component dependency information set corresponds to the dependency relationship knowledge base in related technologies.

[0098] Specifically, the component dependency information set described in this application embodiment includes multiple dependency information entries, each of which corresponds to a component in the component library that has a dependency on it. Here, a component in the component library that has a dependency on it refers to a component that relies on other components in the component library to implement its own functionality. In other words, when the dependency relationships between components in the component library are represented in the form of a dependency tree, a component in the component library that has a dependency on it refers to a component that is a non-leaf node in the dependency tree.

[0099] For a first component that has dependencies in the component library, the first dependency information corresponding to the first component includes: a dependency path indicating the dependency relationship between the first component and other components in the component library. Optionally, the first component can be any component on the dependency path included in the first dependency information.

[0100] In an exemplary embodiment, when the first dependency information is represented in the form of a dependency tree, the first component is the root node of the dependency tree. In this case, the first dependency information includes dependency paths indicating the dependencies of the first component on other components in the component library, but does not include dependency paths indicating the dependencies of other components in the component library on the first component. Thus, the first dependency information can also be understood as indicating the dependencies between the first component and other components that the first component needs to call and / or integrate when implementing its own functions. Therefore, the first dependency information can be identified through the first component.

[0101] For simplicity, the embodiments of this application will be described below using the example where dependency information is represented by a dependency tree, and the component corresponding to the dependency information is the root node of the dependency tree. In this case, for any dependency information represented by a dependency tree, the dependency information can be identified through the root node of the dependency tree.

[0102] This application does not specifically limit the form in which dependency information in the component dependency information set is expressed. For example, the component dependency information set described in this application can be represented by a data table including multiple data rows, where one row of data in the data table records one dependency information in the component dependency information set. As another example, the dependency information in the component dependency information set described in this application can also be represented in the form of a dependency tree.

[0103] Furthermore, components on the dependency paths in the dependency information provided in this application embodiment can be represented by component identifiers (IDs). In one example, the component ID is the component's gav coordinates in the component library, where gav is an abbreviation for group ID, artifact ID, and version. In another example, the component ID is the component's name or any predefined character / string, etc.

[0104] Optionally, the component dependency information set described in the embodiments of this application can be configured based on a dependency knowledge base in related technologies.

[0105] In one possible implementation, for the dependency knowledge base in related technologies that includes a full dependency tree for recording dependencies between components in a component library, this embodiment of the application can divide the full dependency tree into multiple sub-dependency trees, using each node except the root node and leaf nodes as the root node, thereby obtaining the dependency information included in the component dependency information set described in this embodiment of the application. All dependencies between components in the component library can be represented by one or more full dependency trees. It should be understood that different full dependency trees are independent of each other and do not have the same nodes.

[0106] Furthermore, when the dependency information described in the embodiments of this application is represented in the form of a dependency tree, one of the plurality of sub-dependency trees corresponds to one dependency information described in the embodiments of this application. When the dependency information described in the embodiments of this application is represented by data rows in a data table, the descriptive information used to describe the dependency relationship represented by a sub-dependency tree is one dependency information described in the embodiments of this application.

[0107] It should be noted that, for the second component in the component library that serves as the root node of the aforementioned full dependency tree, the second dependency information corresponding to the second component indicates that the second component depends on all other components in the component library except for the second component, or indicates that there are no components in the component library that depend on the second component.

[0108] As can be seen in the embodiments of this application, one dependency information corresponds to a sub-dependency tree or a full dependency tree. Therefore, the dependency path in the dependency information is actually the branch path from the root node to each leaf node in the sub-dependency tree or full dependency tree corresponding to the dependency information.

[0109] The following example uses a component library (denoted as component library 700) including components A, B, C, D, E, F, G, H, I, and J to illustrate how the dependency information described in the embodiments of this application is obtained from the full dependency tree 700 representing the dependencies between the components in component library 700. (See reference...) Figure 7 , Figure 7 A schematic diagram of the full dependency tree 700 is shown. (See diagram below.) Figure 7 As shown, Figure 7 In the component library 700, nodes A through J represent components A through J respectively. Arrows between nodes indicate dependencies between components; for example, an arrow between node A (representing component A) and node B (representing component B) indicates that component A depends on component B. Based on the full dependency tree 700, this embodiment can divide the full dependency tree 700 into several parts, with each node (excluding the root node A and all leaf nodes, including nodes B, C, E, and H) as the root node. Figure 8The four sub-dependency trees shown are identified by their root nodes as sub-dependency trees B, C, E, and H.

[0110] In one possible scenario, the dependency information in the component dependency information set described in this embodiment is represented in the form of a dependency tree. In this case, sub-dependency trees B, C, E, and H are the four dependency information entries in the component dependency information set corresponding to the component library 700. Furthermore, the component dependency information set also includes the dependency information corresponding to component A, which is the root node in the full dependency tree 700. This dependency information indicates that component A depends on all other components in the component library 700 besides component A, or indicates that there are no components in the component library 700 that depend on component A; that is, this dependency information is the full dependency tree 700.

[0111] In another possible scenario, the component dependency information set described in this application embodiment is represented in the form of a data table. In this case, when the component ID is the component's gav coordinates in the component library, combined with... Figure 7 and Figure 8 As shown in Table 1, the component dependency information set corresponding to component library 700 includes 5 data rows, with each data row corresponding to one dependency information. Dependency information 1 includes dependency paths obtained based on the various branch paths of the full dependency tree 700. Dependency information 2 to 5 includes dependency paths obtained sequentially based on the various branch paths of sub-dependency trees B, C, E, and H. In Table 1, “A”, “B”, “C”, “D”, “E”, “F”, “G”, “H”, “I”, and “J” represent components A to J, respectively. In the dependency relationships recorded in Table 1, “gav”:“a” represents the gav coordinates of component A, and “dep” represents the dependency.

[0112] Table 1

[0113]

[0114] Optionally, to facilitate finding dependency information related to the component to be queried in the component dependency information set, when the component dependency information set is represented in the form of a data table, the dependency information may include, in addition to the dependency path, the root node of the sub-dependency tree corresponding to the dependency information and the set of nodes included in the sub-dependency tree, denoted as the node set. For simplicity, since the dependency information already includes the root node of the sub-dependency tree corresponding to the dependency information, the node set here can be the set of nodes in the sub-dependency tree excluding the root node. Referring to Table 1 and Table 2, Table 2 shows the dependency information contained in another component dependency information set provided in the embodiments of this application. It can be seen that the root node and node set shown in Table 2 constitute the set of all nodes included in the sub-dependency tree / dependency tree corresponding to the dependency information.

[0115] Table 2

[0116]

[0117] As can be seen, the depths of sub-dependency trees B, C, E, and H are all less than that of the full dependency tree 700. Therefore, compared to the data volume of the full dependency tree 700, the data volume of the dependency information corresponding to the sub-dependency trees in the dependency information described in this embodiment is less. Consequently, when querying component dependencies, compared to traversing the data of the full dependency tree to query the dependencies between the components to be queried, the query speed is significantly improved by traversing the dependency information corresponding to the sub-dependency trees containing the components to be queried. That is, querying the dependencies of components to be queried using the component dependency information set described in this embodiment can improve query speed.

[0118] In other embodiments, since the component dependency information set provided in this application includes not only dependency information corresponding to the full dependency tree but also multiple dependency information corresponding to multiple sub-dependency trees, the performance requirements of the query device are high when using this component dependency information set to query the dependency relationship between the components to be queried. For example, the query device needs to be configured with sufficient storage resources (including but not limited to cache, memory, etc.). However, in practice, there are generally many duplicate nested components in the component library. Therefore, this application embodiment can deduplicate the dependency relationships recorded in the dependency information, so that the component dependency information set composed of the deduplicated dependency information has less data volume (or size) than a single full dependency tree without losing the dependency relationships. This can reduce the performance requirements of the query device, thereby making the solution provided in this application embodiment more universal.

[0119] Specifically, taking the first dependency information as an example, if there is a duplicate first dependency relationship in the dependency relationship of other components in the first component dependency component library corresponding to the first dependency information, the first dependency relationship is retained in the target dependency path in the first dependency information, and the first dependency relationship is not retained in other dependency paths in the first dependency information except for the target dependency path.

[0120] In this context, the dependency path indicating the first dependency relationship in the target dependency path is the shortest among all dependency paths indicating the first dependency relationship in the first dependency information. In this embodiment, the length of a dependency path is measured by the number of components included in the dependency path. For example, if a dependency path has 2 components, its length is 2. Or, if a dependency path has 4 components, its length is 4.

[0121] The first example uses Java development based on a Maven library as an example, refer to... Figure 9 , Figure 9 This diagram illustrates a method for deduplicating dependency information according to an embodiment of this application. Figure 9 In dependency information 900 shown in (a), component "io-netty:netty-codec:4.1.94.final" (denoted as component codec) calls components "io-netty:netty-common:4.1.94.final" (denoted as component common), "io-netty:netty-buffer:4.1.94.final" (denoted as component buffer), and "io-netty:netty-transport:4.1.94.final" (denoted as component transport). Specifically, component buffer calls component common, component transport calls component common, component buffer, and component "io-netty:netty-resolver:4.1.94.final" (denoted as component resolver), and component resolver calls component common. For clarity, Figure 9 The dependency information illustrated in (a) can be displayed as follows: Figure 9 The dependency tree 910 is shown in (b) of the diagram.

[0122] Depend on Figure 9As can be seen from (b) above, for dependency 1: "Component codec depends on component common", dependency 1 exists in the four dependency paths of dependency tree 910. The four dependency paths are dependency path 1: component codec → component common, dependency path 2: component codec → component buffer → component common, dependency path 3: component codec → component transport → component common, and dependency path 4: component codec → component transport → component resolver → component common. The arrows indicate dependencies. Since dependency paths 1 through 4 all indicate dependency 1, and the length of dependency path 1 is 2, the lengths of dependency paths 2 through 3 are 3, and the length of dependency path 4 is 4, meaning dependency path 1 is the shortest of dependency paths 1 through 4, dependency path 1 is the target dependency path mentioned above. Therefore, this embodiment retains dependency 1 in dependency path 1 but not in dependency paths 2 through 4. In other words, this embodiment can delete the node representing component common in dependency paths 2 through 4, i.e., delete... Figure 9 The node with black background and white text shown in (b) is shown in the image.

[0123] Similarly, by Figure 9 As can be seen from (b) above, for dependency 2: "Component codec depends on component buffer", dependency 2 exists in two dependency paths of dependency tree 910. The two dependency paths are dependency path 5: component codec → component buffer → component common, and dependency path 6: component codec → component transport → component buffer. Since the length of the dependency path indicating dependency 2 in dependency path 5 is 2, while the length of dependency path 6 indicating dependency 2 is 3, that is, the length of the dependency path indicating dependency 2 in dependency path 5 is less than the length of dependency path 6 indicating dependency 2, this embodiment retains dependency 2 in dependency path 5 but not in dependency path 6. That is, this embodiment can delete the node representing component buffer in dependency path 6, i.e., delete... Figure 9 The node with black text on a striped background shown in (b) is an example.

[0124] Furthermore, in this embodiment of the application, the nodes representing the component "common" in dependency paths 2 to 4, and the node representing the component "buffer" in dependency path 6, can be deleted to obtain the dependency information 920 after deduplication of the dependency information 900, as detailed below. Figure 9 As shown in (c) in the figure.

[0125] Similarly, when Figure 9 When dependency tree 910 shown in (b) is a full dependency tree, then the sub-dependency tree 9101 extracted with the node representing the component transport in dependency tree 910 as the root node is as follows: Figure 10 As shown in (a) above, and based on the deduplication method described in the embodiments of this application, a node representing component common in sub-dependency tree 9101 can be deleted, thereby obtaining the following... Figure 10 The deduplication dependency information 9102 shown in (b) is not described in detail here.

[0126] As can be seen, the process of deduplicating dependency information is essentially pruning duplicate branches in the dependency tree corresponding to the dependency information; this process can also be called dependency tree pruning. Furthermore, the deduplication principle in the first example can be understood as "shortest path preservation."

[0127] In addition, from Figure 9 It can be seen that after deduplicating dependency information 900, dependency relationship 3 was lost: component transport depends on component common. However, from... Figure 10 It can be seen that after pruning the sub-dependency tree 9101 with component transport as the root node, dependency relationship 3 is retained in the corresponding dependency information 9102. That is to say, in this embodiment, after deduplication of a single dependency information, some dependency relationships may be lost, but the dependency relationships of the root node component on other components will not be lost, and the aforementioned lost dependency relationships will exist in other dependency information. Therefore, the component dependency information set described in this embodiment contains the accurate dependency relationships of all components in the component library.

[0128] In the second example, combined Figure 9 or Figure 10 The pruning and deduplication process shown in the embodiments of this application is as follows: Figure 7 After performing pruning and deduplication on the full dependency tree 700 shown, we can obtain... Figure 11 The deduplicated dependency tree 1100 is shown below. Figure 11 As shown, the deduplicated dependency tree 1100, compared to the full dependency tree 700, removes the node G representing component G and the node D representing component D. That is, after deduplication, the full dependency tree 700 loses the dependency relationship between component E and component G, and the dependency relationship between component H and component D. However, the dependency information provided in this embodiment also includes information extracted from the full dependency tree 700, such as... Figure 8 The sub-dependency tree shown represents the dependency relationships, while Figure 8 Even after pruning, the sub-dependency tree E still includes the dependency relationship where component E calls component G, and... Figure 8Even after pruning, the sub-dependency tree H still includes the dependency relationship between component H and component D. Therefore, after pruning and deduplication of the dependency information obtained from the full dependency tree and the sub-dependency tree extracted from the full dependency tree in this embodiment, the dependency relationship between each component in the component library can still be accurately indicated. That is, the component dependency information set provided in this embodiment can guarantee the correctness of the dependency relationship between each component in the component library.

[0129] As can be seen, the method described in this application embodiment extracts sub-dependency trees from the full dependency tree by taking each node in the full dependency tree (excluding the root node and leaf nodes) as the root node, and after deduplicating the full dependency tree and each sub-dependency tree, the original dependency relationships are not lost. That is, the component dependency information set described in this application embodiment contains all the dependency relationships of all components in the component library.

[0130] Furthermore, in this embodiment, the volume of the component dependency information set composed of deduplicated dependency information is significantly reduced compared to the volume of the full dependency tree. In one example, Figure 9 After deduplication of dependency information 900 shown in (a), the original dependency information 900, which included nested dependencies between 9 components, can have 4 components removed, meaning nearly half the number of components are removed. In another example, experimental data shows that the full dependency tree in related technologies is on the order of tens of gigabytes. The solution provided in this application extracts sub-dependency trees from the full dependency tree and deduplicates the dependency information corresponding to the full dependency tree and all sub-dependency trees. When the component dependency information set composed of the deduplicated dependency information is represented in the form of a data table as shown in Table 2, the size of the component dependency information set is on the order of hundreds of megabytes (mbytes). This greatly saves the storage resources required to store the component dependency information set.

[0131] The third example uses a key file used in Java development, such as the pom file, as an example. Figure 12 , Figure 12 This illustration shows yet another method for deduplicating dependency information according to an embodiment of this application. Figure 12 In the dependency relationships shown in the pom file, with <groupid> 1 <groupid> 、 <artifactid> 1 <artifactid>as well as <version> 1 <version>The identified component 1201 was called twice consecutively. <groupid> 2 <groupid> 、 <artifactid> 2 <artifactid>as well as <version> 2 <version>The identified component is 1202. It is understood that components defined earlier in the pom file and subsequently called have higher priority, while components called later have lower priority. Based on this, the dependency information in this embodiment retains the first called component among the repeatedly called components in the pom file, while deleting the remaining components among the repeatedly called components. For example, this embodiment will... Figure 12 In the dependency relationship shown, the component 1202 that is called later is deleted to remove duplicates. In this way, the dependency information obtained is the deduplicated dependency information.

[0132] The process of querying the dependencies between components based on the component dependency information set described above is described below.

[0133] refer to Figure 13 , Figure 13 The illustration shows a flowchart of a component dependency query method provided in an embodiment of this application. Optionally, this method can be applied to... Figures 1-6 The application scenario is shown, and the query is executed by the query device within it. For example... Figure 13 As shown, the method includes the following steps 101 to 102.

[0134] Step 101: The query device queries the component dependency information set based on multiple components to determine at least one target dependency information in the component dependency information set. The target dependency information includes the dependency relationship of at least one component among the multiple components.

[0135] The component dependency information set is the set of component dependency information configured based on the process described above, and will not be repeated here.

[0136] Multiple components originate from a component library, and these multiple components represent a large number of components to be queried; therefore, they can also be referred to as multiple components to be queried. The components to be queried refer to the components whose dependencies are to be queried. In one example, the components to be queried can be components specified by the user according to their requirements, or they can be some or all of the components in the component list obtained after scanning and analyzing the software code of a project where the dependencies between components need to be analyzed using an SCA tool. In another example, the query device can be implemented as a binary component analysis security detection tool or an open-source governance service tool, etc., and is not limited to these.

[0137] In an exemplary embodiment, the querying device may first scan (e.g., using an SCA tool) the target software to determine a list of components contained in the target software. The target software is any application or software system whose dependencies on its calls and / or integration components need to be analyzed and queried. The components contained in the target software are from a component library, and the list of components contained in the target software includes multiple components to be queried.

[0138] The target dependency information includes the dependency relationships of at least one of the multiple components. It can also be understood as the dependency information related to the multiple components to be investigated mentioned above.

[0139] Optionally, the process by which the query device queries a set of component dependency information based on multiple components to determine at least one target dependency in the set of component dependency information can be achieved through... Figure 14 Steps 101a to 101b shown are implemented.

[0140] Step 101a: The query device queries the set of component dependency information based on the identifiers of multiple components.

[0141] The query device can traverse the dependency paths included in each dependency information entry in the component dependency information set based on the identifier of each of the multiple components to be queried, in order to find the dependency information to which the dependency path originating from any of the multiple components to be queried belongs. The starting point of the dependency path included in the dependency information is the root node of the dependency tree corresponding to that dependency information.

[0142] In one example, when the component dependency information set is recorded in the form shown in Table 2 above, the query device can traverse the root node of each dependency information in the component dependency information set based on the identifiers of multiple components to be queried, in order to find the dependency information to which the root node belongs to the dependency path of any of the multiple components to be queried.

[0143] Step 101b: When the query device determines that any one of the multiple components is the starting point of the dependency path included in the second dependency information in the component dependency information set, the query device determines the second dependency information as the target dependency information.

[0144] It can be understood that the component located at the starting point of the dependency path included in the second dependency information is the root node of the dependency tree corresponding to the second dependency information.

[0145] For example, when the component dependency information set is recorded in the form shown in Table 2 above, after the query device traverses the root node of each dependency information in the component dependency information set based on the identifiers of multiple components to be queried, if it is determined that any one of the multiple components to be queried is the root node of the second dependency information record in the component dependency information set, then the query device determines the second dependency information as a target dependency information.

[0146] It is understandable that the query device can find at least one second dependency information in the component dependency information set based on multiple components to be queried, so the number of target dependency information is at least one.

[0147] Step 102: The query device determines the dependency relationships between multiple components based on at least one target dependency information.

[0148] In the first possible implementation, the query device first removes duplicate second target dependency information from at least one target dependency information based on multiple components to be queried, and then determines the dependency relationship between multiple components to be queried based on other target dependency information in at least one target dependency information besides the second target dependency information.

[0149] In an exemplary embodiment, when there are multiple pieces of target dependency information, the query device determines the dependency relationship between multiple components to be queried based on at least one piece of target dependency information through the following process: Figure 15 Steps 102a to 102c shown are implemented.

[0150] Step 102a: The query device obtains the intersection corresponding to each target dependency information. The intersection corresponding to the target dependency information refers to the intersection between all components on the dependency path in the target dependency information and multiple components to be queried.

[0151] For a first target dependency among multiple target dependency information, the first target dependency information is any one of the target dependency information from at least one target dependency information. In this case, the query device can obtain the intersection corresponding to the first target dependency information. The intersection corresponding to the first target dependency information refers to the intersection between all components on the dependency path in the first target dependency information and multiple components to be queried. Alternatively, the intersection corresponding to the first target dependency information can also be understood as the set of components to be queried included on the dependency path in the first target dependency information.

[0152] For example, taking the component dependency information set recorded in the form shown in Table 2 above as an example, the query device can find the intersection of the node set recorded in the first target dependency information and multiple components to be queried, and the intersection is the intersection corresponding to the first target dependency information.

[0153] Step 102b: The query device determines whether there is a second target dependency information among the multiple target dependency information based on the intersection of the multiple target dependency information.

[0154] Specifically, the intersection of the second target dependency information is a subset of the intersection of the other target dependency information, and the intersection of the other target dependency information includes the component located at the starting point of the dependency path in the second target dependency information. Here, the other target dependency information refers to the target dependency information other than the second target dependency information among multiple target dependency information.

[0155] Step 102c: If a second target dependency exists among multiple target dependency information, the query device determines the dependency relationship between multiple components based on other target dependency information.

[0156] As shown in step 102b, the set of components to be queried included in the dependency path of the second target dependency information is a subset of the set of components to be queried included in the dependency path of other target dependency information. Therefore, the dependency relationships between the components to be queried obtained by the query device through traversing other target dependency information include the dependency relationships between the components to be queried obtained through traversing the second target dependency information. Thus, if the query device performs traversal queries on both the second target dependency information and other target dependency information, it will generate redundant operations. Therefore, when the query device determines that the second target dependency information exists in multiple target dependency information, it can determine the dependency relationships between multiple components to be queried based on other target dependency information, without needing to traverse and query the second target dependency information. This reduces the number of dependency information that the query device ultimately needs to traverse, or in other words, it reduces the number of dependency trees / sub-dependency trees that the query device ultimately needs to traverse. That is, the process described in steps 102a to 102c can improve the speed at which the query device queries the dependency relationships between components to be queried.

[0157] For example, for the third target dependency information in other target dependency information, the query device traverses the dependency paths in the third target dependency information based on the identifiers of multiple components to be queried, in order to determine the dependency relationships between the components to be queried that belong to the dependency paths in the third target dependency information. Here, the third target dependency information is any target dependency information in the other target dependency information.

[0158] In the second possible implementation, the query device can directly traverse each target dependency information in the at least one target dependency information obtained in step 101, thereby determining the dependency relationship between multiple components to be queried.

[0159] For example, for the fourth target dependency information in at least one target dependency information, where the fourth target dependency information is any target dependency information in at least one target dependency information, the query device determines the dependency relationship between multiple components based on the at least one target dependency information, including: the query device traverses the dependency path in the fourth target dependency information based on the identifiers of multiple components to be queried, so as to determine the dependency relationship between components belonging to the dependency path in the fourth target dependency information among the multiple components to be queried.

[0160] The method described in steps 101-102 enables the querying of dependencies between components based on the component dependency information set provided in this embodiment. Since the dependency information in the component dependency information set provided in this embodiment has less data than the full dependency tree, compared to related technologies, the method in this embodiment, when querying dependencies with less data in dependency information related to the component to be queried, takes significantly less time to query the full dependency tree with a large amount of data than to query the dependency information related to the component to be queried. Therefore, the method described in this embodiment improves the efficiency of querying component dependencies. Furthermore, this embodiment first determines the dependency information related to the component to be queried before traversing and querying this dependency information. This avoids performing traversal and query operations on dependency information unrelated to the component to be queried, thus reducing the number of dependency information requiring query operations compared to related technologies, thereby further improving query efficiency. Furthermore, the method provided in this embodiment can quickly query dependencies between any components, and the query time does not increase linearly with the number of components to be queried.

[0161] Furthermore, since the component dependency information set formed by deduplicating dependency information in this embodiment has less data volume than a single full dependency tree without losing dependency relationships, it reduces the performance requirements of the query device when querying the dependency relationship of the component to be queried based on the component dependency information set provided in this embodiment, thus making the solution provided in this embodiment more universal. In other words, the method provided in this embodiment does not rely on big data platforms and graph databases, making it suitable for use in scenarios with limited device performance resources (such as storage resources).

[0162] Optionally, in other embodiments, after the querying device executes step 102 and finds the dependencies between multiple components to be queried, such as... Figure 16 As shown, the query device also performs step 103.

[0163] Step 103: The query device outputs the dependencies between multiple components.

[0164] For example, the query device outputs the dependencies between multiple components to be queried to the user through the output interface of its own device (such as a display, speaker, etc.).

[0165] In some other embodiments, since the number of components in the current component library is extremely large (exceeding ten million), the full dependency tree representing the dependencies of components in the component library is also very large. Consequently, the number of sub-dependency trees extracted from the full dependency tree based on the design of this application embodiment is also very large, that is, the number of dependency information entries described in this application embodiment is very large. Based on this, refer to Figure 17 , Figure 17 This illustration shows a flowchart of another component dependency query method provided in an embodiment of this application. Optionally, this method can be applied to... Figures 1-6 The application scenario is shown, and the query is executed by the query device within it. For example... Figure 17 As shown, the method includes the following steps 201 to 204.

[0166] Step 201: The query device queries a first subset of the component dependency information set based on multiple components to determine at least one target dependency information in the first subset of the component dependency information set. The target dependency information includes the dependency relationship of at least one component among the multiple components.

[0167] The first subset includes partial dependency information from the component dependency information set. Specifically, in this step, the query device determines at least one target dependency from the partial dependency information in the component dependency information set that includes the dependency relationship of the component to be queried.

[0168] The query device queries a first subset of the component dependency information set based on multiple components to determine at least one target dependency in the first subset of the component dependency information set. For a detailed description of the query device querying a component dependency information set based on multiple components to determine at least one target dependency in the component dependency information set in step 101, it will not be repeated here.

[0169] Step 202: The query device obtains the intersection corresponding to each target dependency information.

[0170] The intersection of target dependency information refers to the intersection between all components on the dependency path in the target dependency information and multiple components to be queried.

[0171] For a detailed explanation of step 202, please refer to the description of step 102a above, which will not be repeated here.

[0172] Step 203: The query device determines whether a third component exists among the multiple components to be queried based on the intersection of each target dependency information. The third component does not exist in the dependency information of any target dependency information.

[0173] It can be understood that the third component is a component among the components to be queried whose dependency information containing the dependency relationship of the third component has not yet been found in the component dependency information set. In other words, the query device has not yet found target dependency information containing the dependency relationship of the third component for the third component.

[0174] Therefore, if the query device determines that there is no third component among the multiple components to be queried, it means that the query device has found the target dependency information containing the dependencies of all the components to be queried. At this time, the query device executes step 204.

[0175] If the query device determines that a third component exists among the multiple components to be queried, it means that the query device has not yet found target dependency information containing the dependency relationship of the third component. At this time, the query device queries the second subset of the component dependency information set based on the identifier of the third component to determine at least one target dependency information in the second subset of the component dependency information set, and then executes steps 202 to 203 again, repeating this process until the condition for executing step 204 is met, or until all dependency information in the component dependency information set has been traversed based on the identifier of the third component. The second subset of the component dependency information set includes the dependency information in the component dependency information set other than the first subset.

[0176] Step 204: The query device determines the dependency relationships between multiple components based on at least one target dependency information.

[0177] For a detailed explanation of step 204, please refer to the relevant description of step 102 above, which will not be repeated here.

[0178] Of course, the query device can also directly execute step 204 after step 201, and when it is determined based on the dependency relationship determined in this execution of step 204 that there are still components to be queried whose dependency relationship has not been queried, the query device will execute steps 201 and 204 again for the components to be queried whose dependency relationship has not been queried and another subset of the component dependency information set excluding the first subset, which will not be described in detail here.

[0179] The methods described in steps 201 to 204 enable the querying of dependencies between components by retrieving dependency information multiple times from a component dependency information set containing a large amount of dependency information. Alternatively, this can be understood as retrieving dependency information related to the component in question multiple times from a component dependency information set containing a large amount of dependency information. This way, the dependencies between components may be obtained after retrieving only a portion of the dependency information in the component dependency information set, thus improving query efficiency.

[0180] To enhance understanding of the methods provided in the embodiments of this application, the embodiments of this application will be further described below with reference to specific examples.

[0181] In the first example, combined Figure 7 , Figure 8 And the examples described in Table 2, and assuming that the components to be investigated include component B, component E, component F, component H, component I, and component J. Reference Figure 16 The query device first executes step 101 to identify dependency information 2, dependency information 4, and dependency information 5 from the component dependency information set shown in Table 2 as target dependency information. Next, the query device queries the node set (corresponding to...) of dependency information 2. Figure 7 The intersection of the set of nodes in the sub-dependency tree B and the component to be searched is matched to obtain... Figure 18 The intersection result 1 shown in (a) is: components B, E, F, and I displayed in white text on a black background. Similarly, the query device queries the set of nodes corresponding to dependency information 4. Figure 7 The intersection of the set of nodes in the sub-dependency tree E and the component to be searched is matched to obtain... Figure 18 The intersection result 2 shown in (b) is component E and component I displayed in black text on a white background. The query device queries the set of nodes corresponding to dependency information 5. Figure 7 The intersection of the set of nodes in the sub-dependency tree H and the component to be searched is matched to obtain... Figure 18 The intersection result 3 shown in (c) is: component H and component J displayed in black background with white text.

[0182] Next, the query device determines that intersection result 2 is a subset of intersection result 1. Therefore, the query device can determine that the query result obtained by traversing dependency information 4 based on the component to be queried is a subset of the query result obtained by traversing dependency information 2 based on the component to be queried. In this case, the query device ignores dependency information 4 and, based on the component to be queried, traverses the dependency paths of dependency information 2 and dependency information 5 respectively to obtain the dependency relationships of the component to be queried: component B → component F, component B → component E → component I, component H → component J. Then, the query device outputs the queried dependency relationships.

[0183] In the second example, refer to Figure 19 , Figure 19 This illustration shows an exemplary process for querying component dependencies according to an embodiment of this application. Figure 19 As shown, the query device can scan the target software using SCA tools or by calling open-source governance services to obtain a list of the components contained in the target software. Then, the query device determines the components from the list based on user requirements. Figure 19 The component to be queried is shown, and based on the component dependency information set provided in the embodiments of this application, the dependency relationship of the component to be queried is queried, and the queried dependency relationship of the component to be queried is output, as specifically as follows. Figure 19 The dependencies of the components to be investigated are shown. It should be understood that... Figure 19 The dependencies of the components to be investigated are shown through multi-level nested paths.

[0184] The above mainly describes the solution provided by the embodiments of this application from a methodological perspective.

[0185] To achieve the above functions, refer to Figure 20 , Figure 20 This diagram illustrates the structure of a component dependency query apparatus according to an embodiment of this application. The component dependency query apparatus 2000 is used to execute the component dependency query method described above, for example, to execute... Figures 13-17 The method shown in the figure. The component dependency query device 2000 may include a query unit 2001 and a determination unit 2002.

[0186] Query unit 2001 is used to query a set of component dependency information based on multiple components to determine at least one target dependency information in the set of component dependency information. Determination unit 2002 is used to determine the dependency relationships between multiple components based on at least one target dependency information. The target dependency information includes the dependency relationships of at least one component among the multiple components. The multiple components come from a component library, and the set of component dependency information includes multiple dependency information entries, each of which corresponds to a component in the component library that it depends on. For the first dependency information corresponding to the first component in the component library that it depends on, the first dependency information includes a dependency path indicating the dependency relationship of the first component on other components in the component library.

[0187] As an example, combined Figure 13 The query unit 2001 can be used to execute step 101, and the determination unit 2002 can be used to execute step 102.

[0188] Optionally, when representing the first dependency information in the form of a dependency tree, the first component is the root node of the dependency tree.

[0189] Optionally, if a duplicate first dependency exists in the dependencies of other components in the first component's dependency library, the first dependency will be retained in the target dependency path of the first dependency information, while other dependency paths in the first dependency information besides the target dependency path will not retain the first dependency. Specifically, the dependency path in the target dependency path that indicates the first dependency is the shortest of all dependency paths in the first dependency information that indicate the first dependency.

[0190] Optionally, the query unit 2001 is specifically used to: query a set of component dependency information based on the identifiers of multiple components; when it is determined that any one of the multiple components is the starting point of the dependency path included in the second dependency information in the set of component dependency information, the second dependency information is determined as the target dependency information.

[0191] As an example, combined Figure 14 The query unit 2001 can be used to execute steps 101a to 101b.

[0192] Optionally, when there are multiple target dependency information entries, the determining unit 2002 is specifically used to: for the first target dependency information among the multiple target dependency information entries, obtain the intersection corresponding to the first target dependency information, where the intersection corresponding to the first target dependency information entry refers to the intersection of all components on the dependency path in the first target dependency information entry and the intersection between multiple components, and the first target dependency information entry is any target dependency information entry in at least one target dependency information entry; based on the intersection corresponding to the multiple target dependency information entries, determine whether there is a second target dependency information entry among the multiple target dependency information entries, where the intersection corresponding to the second target dependency information entry is a subset of the intersection corresponding to other target dependency information entries, and the intersection corresponding to other target dependency information entries includes the component located at the starting position of the dependency path in the second target dependency information entry, and the other target dependency information entries are target dependency information entries other than the second target dependency information entry among the multiple target dependency information entries; if there is a second target dependency information entry among the multiple target dependency information entries, determine the dependency relationship between multiple components based on the other target dependency information entries.

[0193] As an example, combined Figure 15 The determination unit 2002 can be used to execute steps 102a to 102c.

[0194] Optionally, the determining unit 2002 is used to, for the third target dependency information in other target dependency information, traverse the dependency paths in the third target dependency information based on the identifiers of multiple components to determine the dependency relationships between components belonging to the dependency paths in the third target dependency information. The third target dependency information is any target dependency information in other target dependency information.

[0195] Optionally, for the fourth target dependency information in at least one target dependency information, where the fourth target dependency information is any target dependency information in at least one target dependency information, the determining unit 2002 is used to traverse the dependency paths in the fourth target dependency information based on the identifiers of multiple components, so as to determine the dependency relationship between the components that belong to the dependency paths in the fourth target dependency information among the multiple components.

[0196] Optionally, the component dependency query apparatus 2000 further includes a scanning unit for scanning the target software to determine a list of components contained in the target software before querying the set of component dependency information based on multiple components. The components contained in the target software come from a component library, and the list includes the aforementioned multiple components.

[0197] Optionally, the component dependency query device 2000 further includes an output unit for outputting the dependencies between multiple components.

[0198] As an example, combined Figure 16 The output unit can be used to execute step 103.

[0199] Optionally, the component dependency query device 2000 is deployed on a server that provides component dependency query services. The component dependency query device 2000 also includes a receiving unit, which is used to receive multiple components sent by the query client before querying the component dependency information set based on multiple components.

[0200] Optionally, the component is a component from a Java open-source component library.

[0201] For a detailed description of the above-mentioned optional methods, please refer to the foregoing method embodiments, which will not be repeated here. Furthermore, the explanation of any of the component dependency query devices 2000 provided above, as well as the description of their beneficial effects, can be found in the corresponding method embodiments described above, and will not be repeated here.

[0202] Those skilled in the art will readily recognize that, based on the units and algorithm steps described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is implemented in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0203] It should be noted that, Figure 20 The module / unit division shown is illustrative and represents only one logical functional division; in actual implementation, other division methods are possible. For example, two or more functions can be integrated into a single processing module. These integrated modules can be implemented either in hardware or as software functional modules.

[0204] This application provides a computing device for implementing some or all of the functions in the component dependency query method provided in this application. For example, the component dependency query device described above is implemented as this computing device.

[0205] Figure 21 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Figure 21 As shown, the computing device 2100 includes a processor 2101, a memory 2102, a communication interface 2103, and a bus 2104. The processor 2101, memory 2102, and communication interface 2103 are interconnected via the bus 2104. The computing device 2100 also includes an input / output interface 2105, which is interconnected with the processor 2101, memory 2102, and communication interface 2103 via the bus 2104.

[0206] Processor 2101 may include a general-purpose processor and / or a dedicated hardware chip. A general-purpose processor may include a central processing unit (CPU), a microprocessor, or a graphics processing unit (GPU). A CPU may be a single-core processor or a multi-core processor. A dedicated hardware chip is a high-performance processing hardware module. Dedicated hardware chips include at least one of the following: digital signal processing (DSP), data processing unit (DPU), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, neural processing unit (NPU), tensor processing unit (TPU), artificial intelligence (AI) chip, or network processor (NP). Processor 2101 may also be an integrated circuit chip with signal processing capabilities. In the implementation process, some or all of the functions of the method provided in the embodiments of this application can be accomplished by the integrated logic circuit of the hardware in the processor 2101 or by instructions in the form of software.

[0207] Memory 2102 is used to store computer programs, including an operating system 2102a and executable code (i.e., program instructions) 2102b. Memory 2102 may be, for example, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, or other types of static storage devices capable of storing static information and instructions; or, for example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), or synchronous linked dynamic random access memory (SDRAM). DRAM (SLDRAM) or other types of dynamic storage devices capable of storing information and instructions, such as read-only optical discs or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired executable code in the form of instructions or data structures and accessible by a computer, but not limited thereto. For example, memory 2102 is used to store the component dependency information set mentioned above. Memory 2102 may exist independently and be connected to processor 2101 via bus 2104. Alternatively, memory 2102 and processor 2101 may be integrated together. Memory 2102 can store executable code. When the executable code stored in memory 2102 is executed by processor 2101, processor 2101 performs some or all of the functions of the component dependency query method provided in the embodiments of this application. The implementation of processor 2101 performing this process is described in the relevant descriptions in the foregoing embodiments. The memory 2102 may also include software modules and data required by other running processes, such as the operating system.

[0208] As an example, combined Figure 20 The functions implemented by the query unit 2001 and the determination unit 2002 in the component dependency query device 2000 can all be achieved through... Figure 21 The processor 2101 executes Figure 21 The program code is implemented in memory 2102.

[0209] The communication interface 2103 uses a transceiver module, such as, but not limited to, a transceiver, to enable communication with other devices or communication networks. For example, the communication interface 2103 can be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, or other devices with network access capabilities. The communication interface 2103 includes a receiving unit for receiving data / messages and a sending unit for sending data / messages.

[0210] Bus 2104 is any type of communication bus used to interconnect internal devices (e.g., memory 2102, processor 2101, communication interface 2103) of computing device 2100. For example, a system bus. This embodiment illustrates the interconnection of the aforementioned devices within computing device 2100 via bus 2104. Optionally, the aforementioned devices within computing device 2100 can also communicate with each other using other connection methods besides bus 2104; for example, the aforementioned devices within computing device 2100 can be interconnected via internal logic interfaces.

[0211] Input / output interface 2105 is used to realize human-computer interaction between the user and computing device 2100. For example, it enables text or voice interaction between the user and computing device 2100. Input / output interface 2105 includes an input interface for the user to input information to computing device 2100, and an output interface for the computing device 2100 to output information to the user. As an example, the input interface includes, but is not limited to, a touchscreen, keyboard, mouse, or microphone, and the output interface includes, but is not limited to, a display screen, speaker, etc. The touchscreen, keyboard, or mouse is used to input text / image information, the microphone is used to input voice information, the display screen is used to output text / image information, and the speaker is used to output voice information.

[0212] It should be noted that the aforementioned devices can be disposed on separate chips, or at least partially or entirely on the same chip. Whether to dispose of the devices independently on different chips or integrate them on one or more chips often depends on the needs of the product design. This application does not limit the specific implementation of the aforementioned devices. Furthermore, the descriptions of the processes corresponding to the various figures above each have their own emphasis; for parts of a process not described in detail in one figure, please refer to the relevant descriptions of other processes.

[0213] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. The computer program product providing the program development platform includes one or more computer instructions. When these computer program instructions are loaded and executed on the computing device 2100, they implement, in whole or in part, some or all of the functions of the component dependency query method provided in the embodiments of this application.

[0214] Furthermore, computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium stores computer program instructions that provide a program development platform.

[0215] This application also provides a computer-readable storage medium, which is a non-volatile computer-readable storage medium. The computer-readable storage medium includes computer program instructions. When the computer program instructions are executed by a processor, a computing device including the processor, or a computer system, the processor, the computing device including the processor, or the computer system performs a component dependency query method as provided in this application.

[0216] This application also provides a computer program product containing instructions that, when executed by a processor, a computing device including a processor, or a computer system, cause the processor, the computing device including a processor, or the computer system to implement the component dependency query method provided in this application.

[0217] A computer system is a system with computational processing capabilities. A computer system generally includes a processor and memory. The processor retrieves and executes instructions stored in memory to enable the computer system to implement the component dependency query method described above. Optionally, a computer system may also include at least one of an input interface or an output interface. The processor, memory, input interface, and output interface of the computer system are interconnected through internal connection paths.

[0218] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware, or by a program instructing the relevant hardware to implement them. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0219] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0220] This application also provides a chip that includes a processor for running program instructions or code. The chip or a device containing the chip can be used to execute the component dependency query method provided in this application. Exemplarily, the chip further includes an input interface, an output interface, and a memory. The chip's input interface, output interface, processor, and memory are connected via internal interconnection paths. The memory in the chip stores program instructions or code executed by the processor, and the input and output interfaces are used for communication between the chip and other chips or devices.

[0221] In the embodiments of this application, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The term "at least one" refers to one or more, and the term "multiple" refers to at least two, unless otherwise expressly defined.

[0222] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0223] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0224] It should be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0225] It should be understood that the term "comprising" (also known as "includes", "including", "comprises" and / or "comprising") as used in this specification specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0226] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0227] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the concept and principles of this application should be included within the protection scope of this application.

[0228] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.< / version> < / version> < / artifactid> < / artifactid> < / groupid> < / groupid> < / version> < / version> < / artifactid> < / artifactid> < / groupid> < / groupid>

Claims

1. A method for querying component dependencies, characterized in that, include: Based on multiple components, query a set of component dependency information to determine at least one target dependency information in the set of component dependency information, wherein the target dependency information includes the dependency relationship of at least one component among the multiple components; Based on the at least one target dependency information, the dependency relationships between the plurality of components are determined; The plurality of components are from a component library. The component dependency information set includes multiple dependency information entries. Each dependency information entry corresponds to a component in the component library that has a dependency on it. For the first dependency information corresponding to the first component in the component library that has a dependency on it, the first dependency information includes a dependency path used to indicate the dependency relationship between the first component and other components in the component library.

2. The method according to claim 1, characterized in that, When the first dependency information is represented in the form of a dependency tree, the first component is the root node of the dependency tree.

3. The method according to claim 1 or 2, characterized in that, If there is a duplicate first dependency in the dependency relationship of the first component to other components in the component library, the first dependency is retained in the target dependency path in the first dependency information, and the first dependency is not retained in other dependency paths in the first dependency information except for the target dependency path. The dependency path in the target dependency path that indicates the first dependency is the shortest of all dependency paths in the first dependency information that indicate the first dependency.

4. The method according to any one of claims 1 to 3, characterized in that, The step of querying a set of component dependency information based on multiple components to determine at least one target dependency information in the set of component dependency information includes: The component dependency information set is queried based on the identifiers of the multiple components; When it is determined that any one of the plurality of components is the starting point of the dependency path included in the second dependency information in the component dependency information set, the second dependency information is determined as the target dependency information.

5. The method according to any one of claims 1 to 4, characterized in that, When there are multiple pieces of target dependency information, determining the dependency relationships between the multiple components based on at least one piece of target dependency information includes: For the first target dependency information in multiple target dependency information, obtain the intersection corresponding to the first target dependency information. The intersection corresponding to the first target dependency information refers to the intersection between all components on the dependency path in the first target dependency information and the multiple components. The first target dependency information is any target dependency information in the at least one target dependency information. Based on the intersection of the multiple target dependency information, it is determined whether there is a second target dependency information among the multiple target dependency information. The intersection of the second target dependency information is a subset of the intersection of the other target dependency information. The intersection of the other target dependency information includes the component located at the starting position of the dependency path in the second target dependency information. The other target dependency information is the target dependency information other than the second target dependency information among the multiple target dependency information. If the second target dependency information exists among the multiple target dependency information, the dependency relationship between the multiple components is determined based on the other target dependency information.

6. The method according to claim 5, characterized in that, Determining the dependencies between the multiple components based on the other target dependency information includes: For the third target dependency information in the other target dependency information, the dependency paths in the third target dependency information are traversed based on the identifiers of the plurality of components to determine the dependency relationships between the components that belong to the dependency paths in the third target dependency information. The third target dependency information is any target dependency information in the other target dependency information.

7. The method according to any one of claims 1 to 4, characterized in that, For the fourth target dependency information in the at least one target dependency information, where the fourth target dependency information is any one of the at least one target dependency information, determining the dependency relationship between the plurality of components based on the at least one target dependency information includes: Based on the identifiers of the multiple components, the dependency paths in the fourth target dependency information are traversed to determine the dependency relationships between the components that belong to the dependency paths in the fourth target dependency information.

8. The method according to any one of claims 1 to 7, characterized in that, Before querying the component dependency information set based on multiple components, the method further includes: Scan the target software to determine a list of components contained in the target software, the components of the target software being from the component library, the list including the plurality of components.

9. The method according to any one of claims 1 to 8, characterized in that, The method further includes: Output the dependencies between the multiple components.

10. A device for querying component dependencies, characterized in that, include: A query unit is configured to query a set of component dependency information based on multiple components, so as to determine at least one target dependency information in the set of component dependency information, wherein the target dependency information includes the dependency relationship of at least one component among the multiple components; A determining unit is configured to determine the dependency relationships between the plurality of components based on the at least one target dependency information; The plurality of components are from a component library. The component dependency information set includes multiple dependency information entries. Each dependency information entry corresponds to a component in the component library that has a dependency on it. For the first dependency information corresponding to the first component in the component library that has a dependency on it, the first dependency information includes a dependency path used to indicate the dependency relationship between the first component and other components in the component library.

11. A component dependency query device, characterized in that, include: The device includes a memory, a communication interface, and one or more processors, the one or more processors receiving or transmitting data through the communication interface, the one or more processors being configured to read program instructions stored in the memory to perform the method as described in any one of claims 1 to 9.

12. A computer program product containing instructions, characterized in that, When the instructions are executed by a processor, the processor or a device including the processor performs the method as described in any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a processor, cause the processor or a device including the processor to perform the method as claimed in any one of claims 1 to 9.

Images