For every finding, Depi generates a candidate patch and brings it to you. Swipe through them: it's a match, it's not, or ask for a different one. The matches ship themselves. Ten minutes a week, your upstream stays clean.
Each finding shows up as a candidate: what's wrong, what the fix does, and the exact change. You don't write it. You don't research it. You just decide.
Why: A maintainer account upstream of axios is showing takeover signals. This pins you off the auto-update path while it gets investigated.
Why: release.yml runs pull_request_target with the default write token. This drops it to read-only, so a forked PR can no longer push to your repo.
Why: The Rollup TOCTOU bug reaches this build through Vite. Public disclosure is days out; an override locks the fixed version in now.
Every finding comes with a candidate patch already written, pinned versions, scoped names, the smallest change that closes the path. Linked to the finding that triggered it.
Open the inbox, ten minutes a week. Match the ones you want, pass the ones you don't, ask for a different mitigation when it's close but not right.
Matches open as PRs in GitHub or GitLab, respecting your branch protection and reviewers. CI runs, you merge. Nothing bypasses your process.
Book a demo and watch candidate fixes show up against your own dependency tree.
