SSilva034747 (Community Member) asked a question.
How does Veracode SCA determine whether a library update will break or not our code?
Using the agent-based scan SCA scanner, Veracode indicates (as one of the columns) whether a library update could break our code:
- How does it do know?
- What is the confidence level (I'd like to propose to the development team we apply updates to all that SCA scanner indicates as not breaking the code, but we need understand the potential impact).
Thanks in advance.
.png){kind=logo}
Hello @SSilva034747 (Community Member) ,
I was able to find the answers to your question/s.
It is determined by doing a static analysis over the difference between the versions, the details are described in our FSE paper - https://dl.acm.org/doi/10.1145/3236024.3275535
I have also provided the pdf - http://asankhaya.github.io/pdf/Efficient-Static-Checking-of-Library-Updates.pdf
Thank you for your patience,
@Steven D., Veracode Support (Veracode)