An information processing apparatus including: a library information extraction unit that extracts library information from design specification information; a dependency relation information generation unit that generates dependency relation information based on the library information and a source code; a vulnerability program determination unit that determines whether or not the library information includes a vulnerability program; a dependency relation determination unit that, if the library information includes the vulnerability program and a version upgrade of the vulnerability program is necessary, determining whether or not there is a dependency relation between a library corresponding to the vulnerability program and another library; and an output information generation unit that, if it is determined that there is no dependency relation between the library and another library, generating output information indicating that it is possible to perform a version upgrade of the library corresponding to the vulnerability program.