Automatic test generation for impact of patching software package vulnerabilities

A non-transitory computer-readable medium comprising memory with instructions encoded thereon that, when executed by one or more processors, cause the one or more processors to perform operations, the instructions comprising instructions to:

• determine a set of versions of a software package;
• run a test having a plurality of components on each version of the set of versions of the software package;
• generate a matrix comprising a plurality of vectors, each vector corresponding to a given published version of the software package and having a cell for each component of the plurality of components of the test, the cell populated with a result for that component from the test, wherein each vector of the plurality of vectors is different from each other vector of the plurality of vectors;
• identify a patch for a given version of the software package;
• run the test on the patch, an output of the test comprising a vector of results from the test on the patch for each component of the test;
• and
• responsive to determining that the vector of results from the test on the patch matches a given vector corresponding to the given version of the software package, determine that the patch is usable to patch the given version of the software package.

A system comprising:

• memory with instructions encoded thereon;
• and
• one or more processors that, when executing the instructions, are caused to perform operations comprising:
• determining a set of versions of a software package;
• running a test having a plurality of components on each version of the set of versions of the software package;
• generating a matrix comprising a plurality of vectors, each vector corresponding to a given published version of the software package and having a cell for each component of the plurality of components of the test, the cell populated with a result for that component from the test, wherein each vector of the plurality of vectors is different from each other vector of the plurality of vectors;
• identifying a patch for a given version of the software package;
• running the test on the patch, an output of the test comprising a vector of results from the test on the patch for each component of the test;
• and
• responsive to determining that the vector of results from the test on the patch matches a given vector corresponding to the given version of the software package, determining that the patch is usable to patch the given version of the software package.