Back-Propagated Component Patching for Vulnerable Legacy Libraries

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Developers face challenges in efficiently and reliably updating third-party components to address security vulnerabilities without introducing breaking changes, especially when dealing with older, unsupported versions.

Innovation Solution

An automated process is employed to identify and apply a subset of code changes from a newer version of a component to an older, unsupported version, ensuring the patch addresses vulnerabilities without introducing breaking changes, and validating the patched component through testing and call graph analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a developer upgrades to a newer version of a third-party component to fix a vulnerability, then the vulnerability is addressed, but breaking changes or functional issues may be introduced

Engineering Contradiction:

Improvevulnerability fixVSAvoidbreaking changes

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the code changes from the newer version into a separate patch file, isolating only the vulnerability-fixing changes from the full upgrade. This allows applying minimal necessary changes to the older component version, fixing vulnerabilities without introducing breaking changes from the complete newer version.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts only the specific code changes needed to address the vulnerability from the newer version's full codebase. By taking out just the essential fix changes and applying them as a patch to the older version, the solution achieves vulnerability remediation while avoiding unnecessary breaking changes present in the complete newer version.

Inventive Principle:

Principle #2Taking out (Extraction)

2Ease of operation

If a developer manually reviews and applies patches to older component versions, then customization control is maintained, but the process is time-consuming and error-prone

Engineering Contradiction:

Improvepatch application controlVSAvoidpatch review time

Core Design Contradiction:

Ease of operationVSLoss of time

Solution Approach 1:

The patent implements automated patch generation where the system automatically analyzes the newer version's code changes, identifies vulnerability-related changes, generates patch files, and validates the patches against test cases. This self-service automation eliminates manual review and application time while maintaining control through automated validation.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent performs preliminary automated analysis of the newer version's code changes to identify and extract only the vulnerability-fixing changes before patch generation. This preliminary action filters and prepares the patch content in advance, ensuring only necessary changes are included and reducing subsequent manual review requirements.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If a developer applies all changes from a newer component version, then the vulnerability is fixed, but the component size and complexity increase

Engineering Contradiction:

Improvevulnerability addressVSAvoidcomponent size

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent extracts only the specific code changes from the newer version that are necessary to address the vulnerability, excluding unrelated changes. This extraction results in a minimal patch that fixes the vulnerability without increasing component size with unnecessary new code or features.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments the code changes into a separate patch file containing only vulnerability-related modifications. This segmentation allows applying only the essential fix changes to the older component, maintaining minimal impact on component size while achieving complete vulnerability remediation.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12602490B2Automated back-propagation of a fix using a reproducible build, test, and validation process to create a patched artifact

Publication Date: 2026.04.14 ENDOR LABS INC

AI summary

In some implementations, a computing device determines that project code in a development system references an older version of a component in a third-party library, determines that the older version of the component has a vulnerability, determines that a newer version of the component in the third-party library addresses the vulnerability, determines code changes associated with the fix commit, determines a subset of the code changes associated with the fix commit that addresses the vulnerability, creates a patch based on the subset of the code changes associated with the fix commit, applies the patch to the older version of the component to create a patched component, validates the patch, and based on successfully validating the patch, builds the patched component and uploads the patched component and information associated with the patch to a registry to enable a software developer to download the patched component.