Mitigating vulnerabilities in a software program based on its usage

A computer-implemented method comprising:

• executing a first version of a software program during a time window;
• while executing the first version of the software program during the time window, generating a software bill of materials (SBOM) for the software program, wherein the SBOM identifies a dependency relied upon by the first version of the software program during the time window;
• determining that the dependency has a vulnerability based on a Common Vulnerabilities and Exposures (CVE) record associated with the dependency;
• obtaining an updated version of the dependency that lacks the vulnerability;
• generating a second version of the software program using the updated version of the dependency to mitigate the vulnerability;
• and
• deploying the second version of the software program and shutting down the first version of the software program.

A non-transitory computer-readable medium comprising program code that is executable by one or more processors for causing the one or more processors to perform operations including:

• executing a first version of a software program during a time window;
• determining a dependency relied upon by the first version of the software program during the time window;
• determining that the dependency has a vulnerability;
• obtaining an updated version of the dependency that lacks the vulnerability;
• generating a second version of the software program using the updated version of the dependency to mitigate the vulnerability;
• and
• deploying the second version of the software program and shutting down the first version of the software program.