Introducing Dependency Validation

When Dependabot or Renovate opens a security PR, engineers still have to determine whether the vulnerability affects their application and whether the update fixes it without breaking anything.

That investigation can mean reading advisories, tracing dependency usage, and building a reproduction before deciding how urgently to merge.

We've launched Dependency Validation to do that work. Agents run your application, attempt to reproduce the vulnerability, and test the proposed update. The evidence comes back directly to your pull request.

How it works under the hood

Dependency Validation runs a focused red team assessment using the same agent runtime and sandbox infrastructure as Superagent Red Teaming.

Our Red Teaming product searches for vulnerabilities across your application. Dependency Validation investigates the known vulnerabilities associated with an update. That narrower scope makes it faster and cheaper than a full red team run.

Prepare both versions

Superagent uses GitHub's dependency data to identify affected packages and advisories, including transitive dependencies.

It provisions an isolated sandbox with separate checkouts of the exact base commit and PR head. Each installs its own dependencies using its committed manifests and lockfiles. The agents use your repository's setup instructions and configured environment to run the application.

Reproduce and replay

The investigator agent researches the advisory and upstream fix, traces application inputs into the affected code, and attempts an exploit through an interface such as an HTTP endpoint or CLI command.

When the exploit succeeds on the base version, the agent replays it against the update. A verified fix requires the updated application to block the attack while the relevant functionality still works.

One independent verifier agent then reviews the evidence and reruns material claims. The backend validates the final assessment before publishing it.

Faster merges, less engineering time

Dependency Validation takes the investigation off your engineers' plate. Agents research the advisory, trace the affected code, build a reproduction, and test the update.

That shortens the path from dependency alert to merge decision. Reviewers get application-specific evidence in the PR, so they can spend less time researching vulnerabilities and move working fixes through review faster.

When a vulnerability does not apply, the report explains why. When the update fails application checks, it flags the problem before merge. Engineers can prioritize updates based on demonstrated impact and spend more of their time building the product.

Evidence in your pull request

The GitHub check and PR comment report whether the fix is verified, the vulnerability persists, or evidence establishes that it does not apply.

Missing setup or insufficient evidence stays inconclusive. The linked report contains reproduction commands, observations, and limitations. Results apply to the tested commits and environment; new commits supersede older runs.

Get started

In the Superagent dashboard, open your repository's Dependency validation tab and enable Verify vulnerable dependency updates; see the docs for setup details.