Comprehensive software supply chain analysis

A method comprising:

• identifying, by a microprocessor, a current version of an external component that is used in a first software application;
• identifying, by the microprocessor, a new version of the current version of the external component;
• in response to identifying the new version of the current version of the external component, implementing, by the microprocessor, the following actions:
• identify changes to Application Programming Interfaces (APIs) in the new version of the current version of the external component by comparing APIs in the new version to APIs in the current version of the external component to provide a first impact score;
• identify new vulnerabilities in the new version of the current version of the external component by comparing vulnerabilities in the new version against vulnerabilities in the current version of the external component to provide a second impact score;
• and
• determining, by the microprocessor, a quality history associated with the new version of the current version of the external component to provide a third impact score, the quality history comprising, over a selected time period, one or more of a number of code changes, bug fixes, performance changes, and vulnerabilities;
• generating, for display in a user interface, a composite score based on results of the actions, the composite score being based on the first, second, and third impact scores;
• in response to the generated user interface display comprising the composite score receiving a selected version from the current version or the new version of the external component;
• and
• incorporating the selected version into a subsequent build of the first software application.

A non-transitory computer readable medium having stored thereon instructions that cause a processor to execute a method, the method comprising instructions to:

• identify a current version of an external component that is used in a first software application;
• identify a new version of the current version of the external component;
• in response to identifying the new version of the current version of the external component, implement the following actions:
• identify changes to Application Programming Interfaces (APIs) in the new version of the current version of the external component by comparing APIs in the new version to APIs in the current version of the external component to provide a first impact score;
• identify new vulnerabilities in the new version of the current version of the external component by comparing vulnerabilities in the new version against vulnerabilities in the current version of the external component to provide a second impact score;
• and
• determine a quality history associated with the new version of the current version of the external component to provide a third impact score, the quality history comprising, over a selected time period, one or more of a number of code changes, bug fixes, performance changes, and vulnerabilities;
• generate, for display in a user interface, a composite score based on results of the actions, the composite score being based on the first, second, and third impact scores;
• and
• incorporate, in response to the generated user interface display comprising the composite score, a selected version from the current version or the new version of the external component into a subsequent build of the first software application.