Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is responsive to Applicant’s reply filed on 06/29/2026
Claims 1 – 20 are pending and have been examined; wherein claims 1, 3 – 9, and 11 – 20 have been amended.
Claims 1 – 20 are being finally rejected.
Response to Amendment
Claim objections and 35 USC 112(b) rejections for claims 1 – 20 are withdrawn in view of Applicant’s amendments.
35 USC 101 rejections for claims 1 – 20 remain.
Response to Arguments
Applicants’ arguments with respect to claims 1 – 20 have been considered but are moot in view of the new ground(s) of rejection.
Applicant's arguments filed 06/29/2026 have been fully considered but they are not persuasive.
Regarding 35 USC 101 rejections, Applicant argues “The claimed invention is firmly rooted in computer technology and improves the functioning of software security systems. As described in the specification (e.g., steps 302-306 and 210-216), the claimed operations correspond to identifying impacted version ranges, analyzing coded differences between versions, and generating fixes based on those differences, including using machine-learning techniques. These operations enable automated identification and application of precise fixes across large-scale codebases, which is not practically performed mentally and represents a technological improvement in vulnerability elimination.” (Remark; p. 10: last half paragraph – p. 11: first half paragraph.)
Examiner respectfully disagrees. As discussed in section 35 USC 101 below, the steps of “identifying impacted version ranges, analyzing coded differences between versions, and generating fixes based on those differences” can still be performed by human observation and evaluation to identify versions of software with and without weakness, and with an aid of paper and pen human can also write codes to fix the weakness.
Furthermore, MPEP 2106.05(a) states:
“I. IMPROVEMENTS TO COMPUTER FUNCTIONALITY
…
It is important to note that in order for a method claim to improve computer functionality, the broadest reasonable interpretation of the claim must be limited to computer implementation. That is, a claim whose entire scope can be performed mentally, cannot be said to improve computer technology …
Examples that the courts have indicated may not be sufficient to show an improvement in computer-functionality:
…
iii. Mere automation of manual processes, such as using a generic computer to process an application for financing a purchase, Credit Acceptance Corp. v. Westlake Services, 859 F.3d 1044, 1055, 123 USPQ2d 1100, 1108-09 (Fed. Cir. 2017) …” (emphasis added.)
Per MPEP 2106.05(a), limitations of claims that can be performed mentally, they are themselves not considered as improvement in computer functionality. And, automation, as alleged by Applicant, is not indication of the improvement in computer functionality either. In other words, claims 1 – 20 remain rejected under 35 USC 101.
Claim Objections
Claims 1 – 20 are objected to because of the following informalities:
Claim 1
Line 11; insert comma after “the software component”; and
After “each”, insert --version of the second set of versions--
Lines 14 – 15; should remove phrase “each version of the first set of version comprising the weakness,”. The phrase is redundant because it is already mentioned in line 8.
Line 18; insert --, the generating-- before “comprising”
Claims 2 – 3 and 10
These claims are dependent claims of claim 1; therefore, they inherit issues of claim 1.
Claim 4
Line 2; insert --the-- before “determining”.
Claim 5
Line 2; insert --the-- before “determining”.
Claim 6
Line 2; insert --the-- before “determining”.
Claim 7
Line 5; insert --the-- before “generating the fix from””.
Claim 8
Line 2; insert --the-- before “identifying”, and
after “identifying”, insert --, based on the source code repository,--
Line 3; remove “that comprise the weakness”
Claim 9
Line 2; insert --the-- before “identifying”, and
Line 3; remove “that comprise the weakness”
Claim 11
Line 2; insert --the-- before “identifying”
after “identifying”, insert --, based on the source code repository,--
Line 3; remove “that comprise the weakness”
Claim 12
Line 2; insert --the-- before “identifying”, and
Line 3; remove “that comprise the weakness”
Claim 13
Line 3; after “perform”, insert --operations comprising--
Line 13; insert comma after “the software component”; and
After “each”, insert --version of the second set of versions—
Lines 16 – 17; remove phrase “each version of the first set of version comprising the weakness,”. The phrase is redundant because it is already mentioned in line 10.
Line 20; insert --, the generating-- before “comprising”
Claim 14
Line 2; after “perform”, insert --the operations comprising--
Claim 15
Line 2; after “perform”, insert --the operations of the--
Claim 16
Line 1; insert --the-- before “determining”.
Claim 17
Line 1; insert --the-- before “determining”.
Claim 18
Line 2; after “perform”, insert --the operations comprising--
Line 5; insert --the-- before “generating the fix from”.
Claim 19
Line 2; after “perform”, insert --the operations of the--
Line 3; remove “that comprise the weakness”
Claim 20
Line 12; insert comma after “the software component”; and
After “each”, insert --version of the second set of versions—
Lines 15 – 16; remove phrase “each version of the first set of version comprising the weakness,”. The phrase is redundant because it is already mentioned in line 9.
Line 19; insert --, the generating-- before “comprising”
Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1 – 20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Claim 1
Step 1
The claim is statutory because it is directed to a method.
Step 2A, prong 1
The claim recites limitations
“identifying … a weakness in a software component comprised of a software application …;
Identifying … a first set of versions of the software component, each version of the first set of versions comprises the weakness …;
identifying a second set of versions of the software component each absent the weakness;
determining a code difference between (a) an earliest release date of the second set of versions of the software component and (b) a latest release date of the first set of versions of the software component …;
generating a fix for the weakness … comprising identifying … a portion of the code difference corresponding to a patch for the weakness;
selecting a target software component having a similar weakness”
These limitations directed to concept of collecting and analyzing data (Electric Power Group, LLC v. Alstom S.A., 830 F.3d 1350, 1354-55, 119 USPQ2d 1739, 1742 (Fed. Cir. 2016)). This concept can be reasonably performed mentally through human observation and evaluation.
The steps of “identifying a weakness in a software component …; identifying … a first set of versions of the software component …; identifying a second set of versions …; determining a code difference …; and selecting a target software component having a similar weakness” collect versions of the software component, rely on human mental observation of the versions to identify weakness, the first set of versions, and the second set of versions, human mentally recognitions of code differences between versions of the software component and selecting the target software.
Furthermore, step “generating a fix for the weakness … comprising identifying … a portion of the code difference corresponding to a patch for the weakness” merely generate code by identifying portion of the code difference corresponding to the patch. This step relies on human observation of code difference to identify the portion of the code difference. Then, with an aid of paper and pen, human writes codes to fix the weakness.
Step 2A, prong 2
The claim further recites additional limitations “patching the target software component with the fix.” The additional limitation simply updates the software and is considered as insignificant extra-solution activity within the overall process. Thus, the additional limitations are not indicative of an integration into a practical application.
Next the claim recites additional elements “source code repository and “machine learning model.” These additional elements are recited at high level of generality and used as a tools to perform the limitations.
Steps 2B
The claim as a whole is not amounted to significantly more than the judicial exception and is directed to a mental process. Claim 1 is directed to an abstract idea. Therefore, claim 1 is not patent eligible.
Analyses of claims 2 – 12 as follow:
Claim 2
The claim recites “the fix comprises a plurality of fixes, each fix of the plurality of fixes comprises one or more of a code addition, code deletion, code reordering, or code alteration”
The limitation defines the fix. Thus, the limitation is insignificant extra-solution activity, and it is not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, it does not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 3
The claim recites “… accessing a weakness database and obtaining therefrom a set of weakness and a corresponding set of weak software components; and
… matching entries in a build-list used to build the software application to the corresponding set of weak software components.”
“accessing and obtaining” as mere data gathering constituting and Insignificant Extra-Solution Activity.
“matching” relies on human observation and judgment; thus, it covers performance of the limitation in the mind.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 4
The claim recites limitations “determining the code difference between a plurality of the second set of versions of the software component … and the first set of versions of the software component …”
The limitations determine code difference. The limitations rely on human observation and judgment; thus, it covers performance of the limitation in the mind.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 5
The claim recites limitations “determining a plurality of code differences between the plurality of the second set of versions … and the first set of versions of the software component …”
The limitations determine code differences. The limitations rely on human observation and judgment; thus, it covers performance of the limitation in the mind.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 6
The claim recites limitations “determining a plurality of code differences between the earliest release date of the second set of versions of the software component … and the latest release date of the first set of versions …”
The limitations determine code differences. The limitations rely on human observation and judgment; thus, it covers performance of the limitation in the mind.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 7
The claim recites limitations “analyzing each of the plurality of code differences to determine a probability of resolving the weakness; and
… generating the fix utilizing the one of the plurality of code differences having the highest probability of resolving the weakness.”
The limitations analyze code differences and generate the fix. The limitations rely on human observation and judgment of data, and human generating code by use of paper and pen. Thus, it covers performance of the limitation in the mind.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 8
The claim recites limitations “performing static application security testing (SAST) on each version of the superset of versions of the software component … and obtaining a weakness presence indicator from the SAST.”
The limitations scan and analyze version of software component to gather data. The limitations rely on human observation, evaluation, and judgment of data. Thus, it covers performance of the limitation in the mind.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 9
The claim recites limitations “performing static application security testing (SAST) on each version of the superset of versions of the software component … and obtaining a weakness presence indicator from the SAST.”
The limitations scan and analyze version of software component to gather data. The limitations rely on human observation, evaluation, and judgment of data. Thus, it covers performance of the limitation in the mind.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 10
The claim recites limitations “upon generating the fix from the code difference, performing static application security testing (SAST) and obtaining a weakness resolution indicator from the SAST; and
upon the weakness resolution indicator being above a previously determined threshold, patching the software component with the fix.”
The limitations scan and analyze the fix to gather data. The limitations rely on human observation, evaluation, and judgment of data. Thus, it covers performance of the limitation in the mind.
The limitations further patch the software component. This is just an insignificant extra-solution activity.
In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 11
The claim recites limitations “identifying a comment associated therewith and indicating the weakness is present.”
The limitations identify comment and recognize weakness. The limitations rely on human observation, evaluation, and judgment of data. Thus, it covers performance of the limitation in the mind. In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claim 12
The claim recites limitations “identifying a comment associated therewith and indicating the weakness is absent.”
The limitations identify comment and recognize weakness. The limitations rely on human observation, evaluation, and judgment of data. Thus, it covers performance of the limitation in the mind. In other words, they are not integrated into a practical application because they do not impose any meaningful limits on practicing the abstract idea. So, they do not include any additional element that is sufficient to amount to significantly more than the judicial exception.
Claims 13 and 20
Step 1
Claim 13 is statutory because it is directed to a device.
Claim 20 is statutory because it is directed to a product.
Steps 2A, prongs 1 and 2
These claims recite limitations in the same manner as claim 1; therefore, they are rejected for the same reasons.
Furthermore, they recite additional elements “a processor, a memory, and a non-transient computer readable medium.” These additional elements are recited at high level of generality and used as tools to perform the limitations. Thus, the additional elements are not indicative of an integration into a practical application.
Step 2B
Claims 13 and 20, each as a whole, are not amounted to significantly more than the judicial exception. Claims 13 and 20 are directed to an abstract idea. Therefore, claims 13 and 20 are not patent eligible.
Claims 14 – 19 recite limitations in the same manner as claims 3 – 8 respectively; therefore, they are also rejected for the same reasons.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CUONG V LUU whose telephone number is (571)270-1733. The examiner can normally be reached 6:30 AM - 3:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hyung S. Sough can be reached at (571) 272-6799. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CUONG V LUU/Examiner, Art Unit 2192
/S. Sough/SPE, Art Unit 2192
Prosecution Insights