cve-fix

Automating CVE remediation from a Jira ticket requires pulling vulnerability context, scanning the repository to confirm exploitability, and applying targeted dependency updates. It ultimately generates a draft PR with strategy rationale and updates the Jira status.

Applying dependency updates safely requires a multi-strategy approach, attempting lowest-risk options first. It tries direct updates, then transitive updates, overrides, and optional major bumps, ensuring deterministic phase execution with safety guardrails and verification scans.

Automated CVE patching supports Go, Node.js, Python, Java, Rust, and Ruby ecosystems. It applies ecosystem-specific dependency fixes and uses tools like govulncheck, npm, and pip-audit to verify vulnerability remediation.

Backporting dependency fixes to release branches is supported after creating an initial draft PR. The workflow generates reviewable PRs with logged strategy rationale and can propagate validated dependency updates to designated release branches.

If a repository scan confirms a CVE is not exploitable, the workflow generates VEX justification and updates the Jira ticket status. This ensures accurate vulnerability tracking and closes the remediation loop without unnecessary dependency updates.

Validating dependency updates requires specific scanning tools including govulncheck, npm, pip-audit, and skopeo. These dependencies confirm the CVE is gone, verify Go binary scanning, and produce artifacts for auditing and PR justification.