Managing different software dependencies associated with source code

• US 9,760,349 B1
• Filed: 11/09/2016
• Issued: 09/12/2017
• Est. Priority Date: 11/09/2016
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Chen, Huamin, Vyas, Jay
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US15/347,355
• Time in Patent Office: 307 Days
• Field of Search: 717124-129, 717140-143, 717153-155
• CPC Class Codes: G06F 8/433 Dependency analysis; Data or control flow analysis
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

Software dependencies can be managed by a system. For example, the system can determine multiple dependencies associated with source code for software. A dependency can be a segment of program code that is separate from the source code and to be incorporated into the source code. The system can determine multiple attributes associated with the multiple dependencies. Each attribute can be associated with a respective dependency and indicate if the respective dependency is at least one of (i) an essential dependency that is necessary to create executable code from the source code, (ii) a nonessential dependency that is unnecessary to create the executable code from the source code, or (iii) an expiring dependency for which there is a newer version of the dependency available that is incompatible with the source code. The system can sort the multiple dependencies based on the multiple attributes.

Claims

1. A method comprising:

determining, by a processing device, a plurality of dependencies associated with source code for software, a dependency being a segment of program code that is separate from the source code and to be incorporated into the source code for providing the software with particular functionality;

categorizing, by the processing device, the plurality of dependencies into a plurality of categories, each dependency of the plurality of dependencies being categorized as at least one of (i) an essential dependency that is necessary to create executable code from the source code,

(ii) a nonessential dependency that is unnecessary to create the executable code from the source code, or

(iii) an expiring dependency for which there is a newer version of the dependency available that is incompatible with the source code, wherein at least one dependency in the plurality of dependencies is categorized as the essential dependency by;

generating a modified version of the source code by removing a reference to the at least one dependency from the source code, and

based on a compiler being unable to create the executable code from the modified version of the source code,

determining that the at least one dependency is to be categorized as the essential dependency; and

sorting, by the processing device, the plurality of dependencies based on the plurality of categories.

2. The method of claim 1, further comprising sorting the plurality of dependencies based on the plurality of categories by arranging (i) expiring dependencies as having higher priority than essential dependencies, and (ii) essential dependencies as having higher priority than nonessential dependencies.

3. The method of claim 1, wherein the software comprises a plurality of software applications, and further comprising sorting the plurality of dependencies by ranking each respective dependency of the plurality of dependencies based on a number of software applications in the plurality of software applications that rely on the respective dependency.

4. The method of claim 1, further comprising categorizing the at least one dependency as the essential dependency by:

initiating compilation of the modified version of the source code into the executable code.

5. The method of claim 1, further comprising categorizing a particular dependency of the plurality of dependencies as the expiring dependency by:

generating an altered version of the source code by updating the source code to reference the newer version of the particular dependency;

initiating compilation of the altered version of the source code into the executable code; and

based on a compiler being unable to create the executable code from the altered version of the source code, determining that the particular dependency is to be categorized as the expiring dependency.

6. The method of claim 5, further comprising:

outputting a notification indicating that the particular dependency is expiring based on determining that the particular dependency is categorized as the expiring dependency.

7. The method of claim 1, further comprising determining the plurality of dependencies associated with the source code by recursively analyzing each dependency of the plurality of dependencies to identify additional dependencies.

8. A non-transitory computer readable medium comprising program code that is executable by a processing device for causing the processing device to:

determine a plurality of dependencies associated with source code for software, a dependency being a segment of program code that is separate from the source code and to be incorporated into the source code for providing the software with particular functionality;

categorize the plurality of dependencies into a plurality of categories, each dependency of the plurality of dependencies being categorized as at least one of (i) an essential dependency that is necessary to create executable code from the source code,

(ii) a nonessential dependency that is unnecessary to create the executable code from the source code, or

(iii) an expiring dependency for which there is a newer version of the dependency available that is incompatible with the source code, wherein at least one dependency in the plurality of dependencies is categorized as the essential dependency by;

generating a modified version of the source code by removing a reference to the at least one dependency from the source code, and

based on a compiler being unable to create the executable code from the modified version of the source code,

determining that the at least one dependency is to be categorized as the essential dependency; and

sort the plurality of dependencies based on the plurality of categories.

9. The non-transitory computer readable medium of claim 8, further comprising program code that is executable by the processing device for causing the processing device to sort the plurality of dependencies by arranging (i) expiring dependencies as having higher priority than essential dependencies, and (ii) essential dependencies as having higher priority than nonessential dependencies.

10. The non-transitory computer readable medium of claim 8, wherein the software comprises a plurality of software applications, and further comprising program code that is executable by the processing device for causing the processing device to sort the plurality of dependencies by ranking each respective dependency of the plurality of dependencies based on a number of software applications in the plurality of software applications that rely on the respective dependency.

11. The non-transitory computer readable medium of claim 8, wherein the reference to the at least one dependency is a first reference, and further comprising program code that is executable by the processing device for causing the processing device to determine that a particular dependency of the plurality of dependencies is to be categorized as the nonessential dependency by:

generating an altered version of the source code by removing a second reference to the particular dependency from the source code;

initiating compilation of the altered version of the source code into the executable code;

based on the compiler being able to create the executable code from the altered version of the source code, determining that the particular dependency is to be categorized as the nonessential dependency.

12. The non-transitory computer readable medium of claim 8, further comprising program code that is executable by the processing device for causing the processing device to determine that a particular dependency of the plurality of dependencies is to be categorized as the expiring dependency by:

generating an altered version of the source code by updating the source code to reference the newer version of the particular dependency;

initiating compilation of the altered version of the source code into the executable code; and

based on a compiler being unable to create the executable code from the altered version of the source code, determining that the particular dependency is to be categorized as the expiring dependency.

13. The non-transitory computer readable medium of claim 8, further comprising program code that is executable by the processing device for causing the processing device to:

output a first notification indicating that a particular dependency is expiring based on determining that the particular dependency is categorized as the expiring dependency;

output a second notification indicating that the particular dependency is essential based on determining that the particular dependency is categorized as the essential dependency; and

output a third notification indicating that the particular dependency is nonessential based on determining that the particular dependency is categorized as the nonessential dependency.

14. The non-transitory computer readable medium of claim 8, further comprising program code that is executable by the processing device for causing the processing device to determine the plurality of dependencies associated with the source code by recursively analyzing each dependency of the plurality of dependencies to identify additional dependencies.

15. A system comprising:

a processing device; and

a memory device that includes;

source code for a plurality of software applications; and

instructions that are executable by the processing device for causing the processing device to;

determine a plurality of dependencies associated with the source code, a dependency being a segment of program code that is separate from the source code and to be incorporated into the source code for providing the software with particular functionality;

categorize the plurality of dependencies into a plurality of categories, each dependency of the plurality of dependencies being categorized as at least one of (i) an essential dependency that is necessary to create executable code from the source code, (ii) a nonessential dependency that is unnecessary to create the executable code from the source code, or

(iii) an expiring dependency for which there is a newer version of the dependency available that is incompatible with the source code,

wherein at least one dependency in the plurality of dependencies is categorized as the essential dependency by;

generating a modified version of the source code by removing a reference to the at least one dependency from the source code, and

based on a compiler being unable to create the executable code from the modified version of the source code, determining that the at least one dependency is to be categorized as the essential dependency; and

sort the plurality of dependencies based on the plurality of categories.

16. The system of claim 15, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to sort the plurality of dependencies by arranging (i) expiring dependencies as having higher priority than essential dependencies, and (ii) essential dependencies as having higher priority than nonessential dependencies.

17. The system of claim 15, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to sort the plurality of dependencies by ranking each respective dependency of the plurality of dependencies based on a number of software applications in the plurality of software applications that rely on the respective dependency.

18. The system of claim 15, wherein the reference to the at least one dependency is a first reference, and wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to determine that a particular dependency of the plurality of dependencies is to be categorized as the essential dependency or the nonessential dependency by:

generating an altered version of the source code by removing a second reference to the particular dependency from the source code;

initiating compilation of the altered version of the source code into the executable code;

based on the compiler being able to create the executable code from the altered version of the source code, determining that the particular dependency is to be categorized as the nonessential dependency.

19. The system of claim 15, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to determine that a particular dependency of the plurality of dependencies is to be categorized as the expiring dependency by:

generating an altered version of the source code by updating the source code to reference the newer version of the particular dependency;

initiating compilation of the modified altered version of the source code into the executable code; and

based on a compiler being unable to create the executable code from the altered version of the source code, determining that the particular dependency is to be categorized as the expiring dependency.

20. The system of claim 15, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to:

output a first notification indicating that a particular dependency is expiring based on determining that the particular dependency is categorized as the expiring dependency;

output a second notification indicating that the particular dependency is essential based on determining that the particular dependency is categorized as the essential dependency; and

output a third notification indicating that the particular dependency is nonessential based on determining that the particular dependency is categorized as the nonessential dependency.