.png&w=256&q=75)
🤓 Latest Submissions
Mergeable
The problem. Every engineering team has the same graveyard: a queue of red Dependabot pull requests. Bots are great at bumping a version number, but the moment an upgrade contains a breaking change, CI fails and the PR stalls. Someone now has to work out whether the upgrade even matters (is there a CVE? are we exposed?), read a long migration guide, hunt down every affected call site, fix them one by one, re-run the tests and then convince a reviewer it is safe. It is slow, boring and error-prone, so it gets postponed — and known vulnerabilities stay in production because "the upgrade is breaking". Security debt compounds quietly. The solution. Mergeable is a Bob-native upgrade workflow that owns the hard part the bots skip: the migration. Point it at a failing dependency upgrade and it runs a seven-step pipeline: 1. Triage — queries the OSV vulnerability database for the current and target versions and maps every real usage of the package with an AST-based scanner. 2. Read the docs — ingests the official migration guide (even as a PDF) and extracts a structured list of breaking changes, each with a detection rule and a before/after fix recipe. It keeps only the changes that match real call sites. 3. Plan— installs the target version, captures the failing baseline, and writes a change plan: breaking change → file:line → fix, grouped by file with a risk level. 4. Fix in parallel — spawns one subagent per file group; each only sees and edits its own slice. 5. Verify — runs the test suite; failures go back to the owning subagent (max two retries), and any group that still fails is reverted and reported as residual risk. 6. Evidence — generates the Upgrade Dossier: a self-contained HTML report with CVEs closed, tests before/after, every breaking change linked to the exact diff, residual risk and a reviewer checklist. 7. Human gate — stops. Nothing is committed or pushed without explicit approval. Real result. On our demo service (an Express 4 REST API with 33 tests), bumping Express 4.17.1 → 5.1.0 crashes the app before a single test can run. Mergeable read the 26-page official migration guide, identified 9 relevant breaking changes out of 33 in the guide, fixed 20 call sites across 3 files, closed 2 CVEs (CVE-2024-43796, CVE-2024-29041) and brought the suite from 0 to 33 passing in 9 minutes 37 seconds — without touching a single test. Every number in the dossier comes from real tool output; the workflow is instructed never to invent data. Why it matters. Mergeable doesn't replace Dependabot or Renovate; it finishes their job. Teams patch vulnerabilities faster, reviewers get an auditable report instead of a mystery diff, and the same mode runs headlessly in GitHub Actions on every Dependabot PR via Bob Shell. The architecture is ecosystem-agnostic (OSV covers npm, PyPI, Maven, Go and more); the hackathon build targets Node.js.
27 Sep 2026
