dependfixAuto-fix GitHub security alerts

Batch, controllable fixes and automated PR creation for Dependabot / Code Scanning alerts

CLI with zero setup

Four command modes (report-only / fix / fix-and-pr / cleanup-branches), runnable via npx with no dependencies, supports owner / topic multi-repo management.

GitHub Action integration

Wire into CI with a single line: uses: dependfix/dependfix@v1. Supports scheduled, manual and PR-triggered runs with customizable verification commands.

AI breaking-change assessment

Automatically fetch Changelog on major upgrades, multi-provider assessment (DeepSeek / OpenAI), structured patches with safety-gated recommendations.

Local fallback without a token

When GITHUB_TOKEN is missing, automatically fall back to pnpm audit (--alerts-source pnpm-audit) so offline single-host scans work.

Standalone management platform

Nuxt full-stack Web UI: repo / credential management, scan triggering, dashboard, RunDetailDialog, PR Check monitoring; deployable with one Docker command.

Agent Skill / MCP Server

dependfix-remediator skill lets AI assistants (Claude Code / Copilot / Cursor) drive fixes conversationally; MCP Server exposes scan/fix capabilities to AI tools.

Auto-fix frozen-lockfile

Seven categories of pnpm i --frozen-lockfile failures with multi-strategy repair chain (disclosure-driven per docs audit and supply-chain signal).

Security & governance

PR content fingerprint dedup (close old, open new) + no-token-on-disk + minimum-privilege credential injection + egress allowlist audit + dangerous-PR threshold gating.

Architecture & data model

Module boundaries, dependency-group upgrades, dependency graph and execution matrix; system design in architecture docs.

Roadmap

M0-M22 all archived (2026-09-01); current phase tasks and future plans in roadmap and todo.

Standards

10 standards index entry: AI collaboration, development, testing, documentation, security, Git, planning, API and more.

Note: This is the English version of the documentation. Use the language switcher in the nav bar to switch back to the Chinese source of truth at any time.