AI-Driven Dependency
Remediation:
Beyond npm audit fix.

The Problem with Blind Upgrades

npm audit fix and its equivalents (pip install --upgrade, go get -u) follow a simple rule: find the lowest version that resolves the CVE, upgrade to it. The approach fails in three common ways:

• Major version jumps — the fix requires upgrading from v2 to v3, which has breaking API changes. Your code breaks silently if tests are incomplete.
• Transitive dependency conflicts — upgrading package A conflicts with the version of package B required by package C. The lockfile becomes inconsistent.
• The vulnerability is in an unused code path — the fix is unnecessary and introduces risk for zero security benefit.

The AI Approach to Dependency Remediation

An AI-driven dependency remediation engine evaluates several dimensions before proposing a fix:

1. Reachability analysis — is the vulnerable function actually called from your code? If not, the risk is near-zero and the fix can be deprioritised.
2. Breaking change detection — parse the changelog and release notes of the target version. Identify API removals, signature changes, and behaviour changes that affect your usage.
3. Usage pattern analysis — scan your codebase for all imports and usages of the vulnerable package. Map which breaking changes affect which usages.
4. Compatibility scoring — calculate a confidence score for the upgrade: "This upgrade requires changing 3 call sites but no API changes affect your usage. Confidence: high."
5. Fix strategy selection — choose from: bump version, pin to safe minor version, apply patch directly to vendored copy, replace with alternative library.

Breaking Change Analysis in Practice

For a lodash 4.17.15 → 4.17.21 upgrade, the analysis is simple: no API changes, identical usage. Confidence: very high. For an express 4.x → 5.x upgrade, the analysis is complex:

• Callback-style route handlers are removed
• app.del() is removed, use app.delete()
• Error-handling middleware signature changed
• Promise rejection handling changed

The AI engine scans your codebase, identifies which of these breaking changes affect your code, generates the necessary call site migrations, and produces a combined PR: version bump + migration code changes + updated tests.

Upgrade Strategies

Four strategies, chosen by the AI based on analysis:

• Clean bump — no API changes, no call site modifications needed. Auto-merge safe for tested packages.
• Bump + migrate — breaking changes exist but affected call sites can be auto-migrated. PR includes both changes.
• Patch (backport) — upgrade is impractical but a security patch can be applied to the current version. Useful for pinned major versions.
• Replace — the package is abandoned, the vulnerability is unfixable, and an alternative library exists. AI generates the migration to the alternative.

Dependency Remediation at Scale

At 100+ repositories, manual dependency management is impossible. AI remediation enables:

• Batch processing — identify the same vulnerability across 50 repos, generate 50 upgrade PRs simultaneously
• Consistency enforcement — ensure all repos are on the same pinned safe version of shared internal packages
• Prioritisation — CVSS × EPSS × reachability score determines which repos get remediation first
• Rollup PRs — group all dependency fixes for a repo into a single PR rather than 20 separate ones