Source Code Import Parsing for Complete Workspace Dependency Graphs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Version-control systems using mono repositories often fail to account for transitive dependencies, which are not declared in manifest files, leading to incomplete dependency lists and hidden, third-party-controlled dependencies, posing challenges for developers.

Innovation Solution

A system that parses source code files to identify and extract all dependencies, including transitive ones, using a bundler for enhanced performance and concurrency, generating a dependency graph for comprehensive dependency analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If dependency declarations in manifest files are used to create dependency graphs, then the dependency graph creation process is simple, but transitive dependencies are not captured leading to incomplete dependency information

Engineering Contradiction:

Improveease of creating dependency graphVSAvoidcompleteness of dependency information

Core Design Contradiction:

Ease of manufactureVSLoss of information

Solution Approach 1:

The system segments the dependency analysis into two parts: first parsing manifest files for direct dependencies, then separately analyzing source code files to identify transitive dependencies. This segmentation allows the system to capture both declared and implicit dependencies without overwhelming complexity

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary parsing of source code files to identify import statements and dependency patterns before finalizing the dependency graph. This preliminary action ensures that transitive dependencies are captured early in the process

Inventive Principle:

Principle #10Preliminary action

2Loss of information

If source code parsing is performed to identify all dependencies including transitive ones, then complete dependency information is obtained, but the processing time and computational resources increase

Engineering Contradiction:

Improvecompleteness of dependency informationVSAvoidprocessing time for dependency analysis

Core Design Contradiction:

Loss of informationVSLoss of time

Solution Approach 1:

The system applies partial action by focusing source code parsing only on files that are likely to contain dependency declarations (such as JavaScript, TypeScript, and module files). This selective approach captures transitive dependencies without unnecessarily processing all files in the repository

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The system uses an intermediary approach by first extracting direct dependencies from manifest files, then using this information to guide and constrain the source code parsing process. This intermediary step reduces the scope of source code analysis needed

Inventive Principle:

Principle #24Intermediary (Mediator)

3Device complexity

If transitive dependencies are hidden in third-party packages, then the dependency list remains manageable, but security vulnerabilities and control issues arise

Engineering Contradiction:

Improvemanageability of dependency listVSAvoidsecurity and control over dependencies

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The system extracts transitive dependencies from third-party packages by analyzing source code import statements and resolving them against the monorepo structure. This extraction brings hidden dependencies into the visible dependency graph, allowing developers to review and manage them

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system provides feedback to developers by generating a comprehensive dependency graph that includes transitive dependencies, highlighting packages that may pose security risks or control issues. This feedback enables informed decisions about dependency management

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12373178B2Determining dependencies in workspaces

Publication Date: 2025.07.29 JPMORGAN CHASE BANK NA

AI summary

Implementations generally relate to dependencies in workspaces. In some implementations, a method includes receiving one or more file types. The file types refer to source code files that contain source code. The method further includes fetching the source code files from a repository. The method further includes parsing the source code files resulting in parsed source code. The method further includes identifying import declarations in the parsed source code and extracting dependency information from the import declarations.