# US 12,602,490 B2 · Automated back-propagation of a fix using a reproducible build, test, and validation process to create a patched artifact > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,490 B2 - Document ID: US12602490B2 - Status: Granted - Kind: B2 - Application number: 19/270,079 - Filed: 2025-07-15 - Published: 2025-11-13 - Granted: 2026-04-14 - Earliest claimed: 2023-06-12 - Assignees: Endor Labs Inc - Applicants: Endor Labs Inc - Inventors: Henrik Plate; Sebastian Cai; Dimitrios Styliadis; Alexandre Wilhelm - Web page: https://patentgrep.com/patent/US12602490B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/565: {by checking file integrity} - G06F 21/70: Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some implementations, a computing device determines that project code in a development system references an older version of a component in a third-party library, determines that the older version of the component has a vulnerability, determines that a newer version of the component in the third-party library addresses the vulnerability, determines code changes associated with the fix commit, determines a subset of the code changes associated with the fix commit that addresses the vulnerability, creates a patch based on the subset of the code changes associated with the fix commit, applies the patch to the older version of the component to create a patched component, validates the patch, and based on successfully validating the patch, builds the patched component and uploads the patched component and information associated with the patch to a registry to enable a software developer to download the patched component. ## Claims ### Claim 1 A computer-implemented method comprising: determining, by one or more processors, that project code in a development system references an older version of a component in a third-party library; determining, by the one or more processors, that the older version of the component has a vulnerability; determining, by the one or more processors, that a newer version of the component in the third-party library has a fix commit that addresses the vulnerability; determining, by the one or more processors, code changes associated with the fix commit; determining, by the one or more processors, a subset of the code changes associated with the fix commit that addresses the vulnerability; submitting, by the one or more processors through a communication network, a pull request to create a branch in a developer platform; creating, in the branch by the one or more processors, a patch based on the subset of the code changes associated with the fix commit; applying, in the branch by the one or more processors, the patch to the older version of the component to create a patched component; validating, in the branch, the patch by the one or more processors; and based on successfully validating the patch, uploading, by the one or more processors, the patched component and information associated with the patch to a registry to enable a software developer to download and use the patched component. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein validating the patch by the one or more processors comprises: executing a set of test cases on a first build that includes the older version of the component to create first test results; determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component; executing the set of test cases on a second build that includes the patched component to create second test results; and determining that the second test results indicate that the set of test cases did not exploit the vulnerability in the patched component. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, further comprising: initiating a process to create the first build using a build file comprising build rules and build options; based on the process to create the first build failing, modifying the build file to create a modified build file; and re-initiating the process to create the first build using the modified build file. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: providing sufficient details in the information associated with the patch to enable the software developer to reproducibly build the patch. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: performing change impact analysis on the patched component; and determining, based on the change impact analysis, that the patched component does not introduce a breaking change. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the information associated with the patch comprises: information identifying the older version of the component in the third-party library; information identifying the vulnerability; information identifying files used; information related to a build file; information related to build options; one or more configuration details; or any combination thereof. ### Claim 7 A server comprising: one or more processors; and one or more non-transitory computer readable media storing instructions executable by the one or more processors to perform operations comprising: determining that project code in a development system references an older version of a component in a third-party library; determining that the older version of the component has a vulnerability; determining that a newer version of the component in the third-party library has a fix commit that addresses the vulnerability; determining code changes associated with the fix commit; determining a subset of the code changes associated with the fix commit that addresses the vulnerability; submitting, via a communication network, a pull request to create a branch in a developer platform; creating, in the branch, a patch based on the subset of the code changes associated with the fix commit; applying, in the branch, the patch to the older version of the component to create a patched component; validating, in the branch, the patch; and based on successfully validating the patch, building and uploading the patched component and information associated with the patch to a registry to enable a software developer to download and use the patched component. ### Claim 8 (depends on 7) The server of claim 7, wherein validating the patch comprises: executing a set of test cases on a first build that includes the older version of the component to create first test results; determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component; executing the set of test cases on a second build that includes the patched component to create second test results; and determining that the second test results indicate that the set of test cases did not exploit the vulnerability in the patched component. ### Claim 9 (depends on 8) The server of claim 8, the operations further comprising: initiating a process to create the first build using a build file comprising build rules and build options; based on the process to create the first build failing, modifying the build file to create a modified build file; and re-initiating the process to create the first build using the modified build file. ### Claim 10 (depends on 7) The server of claim 7, the operations further comprising: providing sufficient details in the information associated with the patch to enable the software developer to reproducibly build the patch. ### Claim 11 (depends on 7) The server of claim 7, wherein validating the patch comprises: executing a set of test cases on a first build that includes the older version of the component to create first test results; determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component; executing the set of test cases on a second build that includes the patched component to create second test results; determining that the second test results indicate that the set of test cases exploited the vulnerability in the patched component; modifying the patch to create a modified patch; executing the set of test cases on a third build that includes the modified patch to create third test results; and determining that the third test results indicate that the set of test cases did not exploit the vulnerability in the modified patch. ### Claim 12 (depends on 7) The server of claim 7, wherein the information associated with the patch comprises: information identifying the older version of the component in the third-party library; information identifying the vulnerability; information identifying files used; information related to a build file; information related to build options; one or more configuration details; or any combination thereof. ### Claim 13 (depends on 7) The server of claim 7, the operations further comprising: performing change impact analysis on the patched component; determining, based on the change impact analysis, that the patch introduces a breaking change; modifying the patch to create a modified patch; and performing the change impact analysis using the modified patch. ### Claim 14 One or more non-transitory computer readable media capable of storing instructions executable by one or more processors to perform operations comprising: determining that project code in a development system references an older version of a component in a third-party library; determining that the older version of the component has a vulnerability; determining that a newer version of the component in the third-party library has a fix commit that addresses the vulnerability; determining code changes associated with the fix commit; determining a subset of the code changes associated with the fix commit that addresses the vulnerability; submitting, through a communication network, a pull request to create a branch in a developer platform; creating, in the branch, a patch based on the subset of the code changes associated with the fix commit; applying, in the branch, the patch to the older version of the component to create a patched component; validating, in the branch, the patch; and based on successfully validating the patch, building and uploading the patched component and information associated with the patch to a registry to enable a software developer to download and use the patched component. ### Claim 15 (depends on 14) The one or more non-transitory computer readable media of claim 14, wherein validating the patch comprises: executing a set of test cases on a first build that includes the older version of the component to create first test results; determining that the first test results indicate that the set of test cases exploited the vulnerability in the older version of the component; executing the set of test cases on a second build that includes the patched component to create second test results; and determining that the second test results indicate that the set of test cases did not exploit the vulnerability in the patched component. ### Claim 16 (depends on 15) The one or more non-transitory computer readable media of claim 15, the operations further comprising: initiating a process to create the first build using a build file comprising build rules and build options; based on the process to create the first build failing, modifying the build file to create a modified build file; and re-initiating the process to create the first build using the modified build file. ### Claim 17 (depends on 15) The one or more non-transitory computer readable media of claim 15, the operations further comprising: providing sufficient details in the information associated with the patch to enable the software developer to reproducibly build the patch. ### Claim 18 (depends on 14) The one or more non-transitory computer readable media of claim 14, the operations further comprising: performing change impact analysis on the patched component; and determining, based on the change impact analysis, that the patched component does not introduce a breaking change. ### Claim 19 (depends on 14) The one or more non-transitory computer readable media of claim 14, wherein the information associated with the patch comprises: information identifying the older version of the component in the third-party library; information identifying the vulnerability; information identifying files used; information related to a build file; information related to build options; one or more configuration details; or any combination thereof.