Minimizing Vulnerability Prevalence in Maven Dependencies via Answer Set Programming

Abstract

Software projects rely extensively on third-party libraries, but dependency versions with known vulnerabilities can expose them to security risks. Updating these dependencies is challenging because alternative versions may introduce different transitive dependencies, additional vulnerabilities, or compatibility failures. Moreover, not every dependency for which a vulnerability is reported is necessarily used by the project. We present an approach that uses Answer Set Programming to identify less vulnerable dependency configurations for Apache Maven projects. The approach combines vulnerability information from three security advisories with the resolved dependency tree, alternative dependency subtrees, and the project's callgraph which identifies dependencies reached from the project. Clingo, our solver, then outputs ranked dependency configurations, reducing the number of vulnerabilities while maintaining buildability. We evaluated our approach on twelve open-source Java projects and found that only ten of them actually use dependencies with vulnerabilities. For seven of the remaining ten projects, our approach identifies a buildable configuration with fewer vulnerabilities, reducing their number by 40.3% and their weighted vulnerability score by 41.4%. We also show that our approach is feasible in practice, yielding a median runtime of 15 and 2 minutes overall and for the optimization step only, respectively.