PatchWave combines static analysis and agents to auto-review Dependabot PRs
blimmer · hn · 2026-10-20
A GitHub App that pairs static analysis with specialized agents to analyze Dependabot PRs and optionally auto-merge safe ones.
- Pain point: Dependabot PRs get ignored or eat senior-engineer time; rising CVE volume makes fast security merges critical
- Pipeline: pulls changelog, version diffs, security advisories, CI results → agent analyzes the codebase in an isolated sandbox using structural code search, type checkers, and the project's toolchain, producing a report per PR
- If CI fails, a fix agent automatically updates API usage, fixes linting, etc.
- Optional auto-merge aligned with user-defined policies
- Co-founder previously ran a freelance business charging hourly for exactly this work
More from coding & agent
- Claude cut a 2.6-hour video export to 20 minutes — but only after being told to rebuild the server — byhewar · 2026-10-23
- 3 flight-booking rules my AI agent checks that I'd never do by hand — Efistoffeles · 2026-10-23
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23
- How do you audit AI agent decisions in regulated workflows? A field survey — Ok_Way_1993 · 2026-10-23