What it does
Dependency and CVE Upgrade Agent turns a security audit into upgrade proposals you can actually merge. A plain bump bot opens a version-change PR and leaves the breakage to you. This one takes the audit report you supply — vulnerable packages with their current and first-fixed versions, CVE severity and an optional breaking flag — and for each package classifies the semver jump, scores the breaking-change risk, derives the ordered migration steps, and proposes one single-package pull request with a clear verdict on whether it can be auto-merged. One package per PR is a hard guardrail, not a preference. Batched upgrades cannot be reverted individually, and when a batch breaks something you lose the ability to say which bump did it. Each proposal carries the numbers behind the decision: the version range, the jump class, the CVE and severity, whether the change is breaking, a risk score and band, the ordered migration steps, the test outcome, and the merge autonomy — auto-merge, or hold for human review. Major and breaking jumps always route to review, and the agent is explicit that breaking-change detection on a major jump is imperfect rather than pretending otherwise. Each step is callable alone. `score_upgrade_risk` ranks the queue without producing PRs. `classify_semver_jumps` answers which of these are majors. `plan_migrations` gives you just the steps. `summarize_upgrades` returns the headline counts — vulnerable packages, PRs, high and critical CVEs, major jumps, auto-merge candidates — for a status update. Everything numeric is deterministic. The language model narrates only the risk summary: which PRs are safe, which need eyes, and in what order to merge them. Advisory and changelog text is sanitised before it reaches the model and anything suspicious is flagged in the report's warnings, because changelogs are third-party text and a natural injection surface. It works with npm and Composer. No connectors, no credentials, no network egress — it runs on the audit you paste in, and opens no pull requests itself. Built for developers and DevOps running a dependency sweep.
Example prompts
- Here is our npm audit output — turn it into upgrade proposals
- Which of these CVE upgrades are safe to auto-merge?
- Which packages need a major version jump?
