[Alpha] Assess breaking-change risk for a library upgrade with the AI Assistant

Use the AI Assistant to assess the potential breaking-change risk of upgrading a software library from its current version to a proposed target version.

Splunk Secure Application integrates with the AI Assistant to help you evaluate a proposed library upgrade before making the change. The assessment provides an initial risk level, explains the semantic versioning signal, and summarizes likely compatibility changes that might require validation.

Attention:

Alpha features described in this document are provided by Splunk to you "as is" without any warranties, maintenance and support, or service-level commitments. Splunk makes this alpha feature available in its sole discretion and may discontinue it at any time. These documents are not yet publicly available and we ask that you keep such information confidential. Use of alpha features is subject to the Splunk Pre-Release Agreement for Hosted Services.

Before you begin, make sure that:

  • The Splunk Observability Cloud AI Assistant is available in your realm, active for your organization, and accessible to you.
  • You have the required Splunk Secure Application entitlement and access to the Application Security UI.

Limitations

The AI Assistant assesses one specified library and version transition at a time. The assessment uses existing AI model knowledge. It doesn't use live release notes, change logs, migration guides, package registries, web searches, your source code, or your dependency graph.

The assessment doesn't provide migration steps or code-change instructions, and it doesn't guarantee that an upgrade is safe for your application. Results can be incomplete or outdated, particularly for recent releases or less common packages. Verify the assessment against the library publisher's documentation and test the upgrade in a non-production environment.

This Alpha experience is limited to breaking-change assessment. It doesn't support vulnerability discovery or prioritization, broader library discovery or recommendations, or attack analysis.

Sample prompts

You can request a breaking-change assessment from anywhere the AI Assistant is available. Include the library name, current version, and target version in your prompt.

Goal Sample prompt
Assess the potential breaking-change risk of an upgrade. Assess breaking changes for library library-name from version current-version to target-version.
Ask what compatibility changes to expect. What breaking changes should I expect if I upgrade library-name from current-version to target-version?
Request an initial upgrade-risk assessment. Assess the risk of upgrading library-name from current-version to target-version.

If your prompt omits one or more required values, the AI Assistant asks you for the missing information and retains the values you already provided.

Access the AI Assistant in Splunk Secure Application

To access the AI Assistant, select its icon from the toolbar on the right side. You can access the AI Assistant from anywhere its icon is available. This workflow explains how to access it from the Application Security vulnerability details page and start an assessment with a suggested prompt.

  1. Select APM.
  2. Under Application Security, select Runtime vulnerabilities, then select a vulnerability to open its details page.
  3. Open the AI Assistant and set Use page context to the active position.
  4. Select Assess a library upgrade for breaking changes.

With Use page context active, the AI Assistant can use the affected library, current version, and recommended fix version when those values are available on the page. If a required value isn't available, the AI Assistant asks you to provide it.

Review the assessment returned by the AI Assistant. The assessment can include:

  • A risk level of NONE, LOW, MEDIUM, HIGH, or UNKNOWN.
  • Whether the proposed change is a major, minor, or patch version change and what that signal implies.
  • Likely removed or renamed APIs.
  • Likely method-signature, behavior, or default-setting changes.
  • Likely removal of deprecated APIs.
  • Likely changes to supported language or runtime versions.

If the result is UNKNOWN, or if the upgrade could have a significant impact, consult the library publisher's official changelog or migration guide. Always validate the upgrade in a non-production environment before deploying it to production.