Quack Patch (Early Access)

Quack Patch assists developers in automatically generating code patches for package managers to address vulnerabilities in third-party components identified by Black Duck Software Composition Analysis (SCA). It effectively detects transitive dependencies lacking a direct upgrade path through their parent dependencies and creates patches that include dependency overrides for these components. Utilizing Large Language Models (LLMs), Quack Patch sends the original source file along with upgrade guidance to the LLM gateway, resulting in a patch that is applicable to the source file. The generated patches are saved in the quack-patch directory located within the scan output directory.

• Quack Patch works only with Black Duck SCA (online mode) using the Rapid or Stateless Scan workflow.

• Supported package manager and config file types:

  • Maven (Supported Files: pom.xml)

  • Gradle (Supported Files: build.gradle, build.gradle.kts)

  • NuGet (Supported Files: Directory.Packages.props, packages.config, *.csproj)

  • NPM (Supported Files: package.json)

  • Yarn (Supported Files: package.json)

  • PNPM (Supported Files: package.json)

• An internal LLM Gateway compatible with OpenAI API standards or OpenAI Platform. Supported LLM models:

  • Claude Sonnet 4

  • GPT-4

  • Gemini 2.5 Pro

  Note: Other LLM models compatible with OpenAI API standards may be used but results will vary by model capabilities.

• Target project must have policies configured in Black Duck SCA to guide component upgrade generation.

  • Components violating policies due to vulnerabilities will be considered for upgrade guidance.

• Set the scan mode to RAPID or STATELESS using the detect.blackduck.scan.mode property: --detect.blackduck.scan.mode=RAPID.

• Enable Quack Patch with the detect.quack.patch.enabled property: --detect.quack.patch.enabled=true.

• Set the LLM Gateway URL with the detect.llm.api.endpoint property: --detect.llm.api.endpoint=https://your-llm-gateway.com.

• Set the LLM Gateway API key with the detect.llm.api.key property: --detect.llm.api.key=your-llm-api-key.

• Set the LLM model with the detect.llm.name property: --detect.llm.name=gpt-4.

• (Optional) Set the detect.quack.patch.output.path property to specify a custom directory for generated patches. If the directory doesn't exist, Detect tries to create it and fails if unable to create the output directory. The default is the quack-patch folder located within the scan output directory. If the same custom path is specified across multiple runs, patch files from previous runs may remain in the directory. Review summary.json to identify the patch files from the latest run.

Using detect.sh script:

./detect.sh --blackduck.url=https://your-blackduck-url.com \
    --blackduck.api.token=your-api-token \
    --detect.cleanup=false \
    --detect.blackduck.scan.mode=RAPID \
    --detect.quack.patch.enabled=true \
    --detect.llm.api.endpoint=https://your-llm-gateway.com \
    --detect.llm.api.key=your-llm-api-key \
    --detect.llm.name=gpt-4

Using detect jar distribution:

java -jar detect.jar --blackduck.url=https://your-blackduck-url.com \
    --blackduck.api.token=your-api-token \
    --detect.cleanup=false \
    --detect.blackduck.scan.mode=RAPID \
    --detect.quack.patch.enabled=true \
    --detect.llm.api.endpoint=https://your-llm-gateway.com \
    --detect.llm.api.key=your-llm-api-key \
    --detect.llm.name=gpt-4

Output patches appear in the quack-patch folder inside the scan output directory or a custom output directory if set via the detect.quack.patch.output.path property.

For example, runs/<timestamped-directory>/scan/quack-patch/.

/runs/2026-01-22-15-40-43-082
├── scan
│   └── quack-patch
│       ├── 3grh7-build.gradle.modified                     # Modified build.gradle file with overrides
│       ├── 3grh7-build.gradle.patch                        # Patch file containing the changes
│       ├── 3grh7-transitive-upgrade-guidance.txt           # Extracted component upgrade guidance
│       ├── invokedDetectorsAndTheirRelevantFiles.json      # List of invoked package managers and associated source files
│       ├── rapidFullResults.json                           # Full rapid scan results
│       └── summary.json                                    # Summary of the patches generated through Quack Patch

Apply the patch to the original source file using the patch command. For example, with a Gradle build file:

cd /path/to/your/project
patch -p0 < /path/to/scan/quack-patch/3grh7-build.gradle.patch

Alternatively, apply the patch using the git command. For example, with a Gradle build file:

cd /path/to/your/project
git apply /path/to/scan/quack-patch/3grh7-build.gradle.patch

• Quack Patch is in beta and may miss some edge cases. Review generated patches before applying them.

• Patch effectiveness varies with the LLM model and input data quality.

• Ensure build source files contain no sensitive information, as they are sent to the LLM gateway.

• Quack Patch focuses on generating dependency overrides and may not handle complex scenarios with multiple interdependent components or custom build configurations.

• Define the detect.llm.api.key value via environment variable to avoid exposing it in command line history.

• Comply with your organization's policies on AI-generated content and data privacy when using Quack Patch.