A custom Bob mode that triages CVEs, reads migration guides, fixes every breaking call site in parallel, verifies with tests, and hands you a signed-off Upgrade Dossier — all before a human reviews.
Dependabot raises the alert but can't understand whether your code actually reaches the vulnerable path — so engineers ignore or manually triage each one.
Major-version bumps introduce renamed methods, removed helpers, and changed signatures. A plain version bump kills the test suite and the PR rots.
Finding 20 call sites, reading the migration guide, applying each recipe, re-running tests — mechanical work that takes a senior engineer half a day.
Queries the OSV vulnerability database for the current and target versions, maps every import and member usage in the project, and writes a structured triage.json with the exposure verdict.
Opens the official migration PDF (or changelog), extracts every breaking change relevant to the actual usage map, and stores them as machine-readable breaking-changes.json.
Installs the target version, captures the failing test baseline, then writes a plan.md mapping each breaking change to the exact file and line it affects, with a risk level and fix recipe.
Spawns one independent subagent per file group. Each agent applies only its own fixes in isolation — no shared state, no merge conflicts. All agents run concurrently.
Runs the full test suite. Failing file groups are retried once. Any group that still fails is reverted and flagged as residual risk — ensuring the final branch is always green or explicitly documented.
Generates a self-contained dossier.html and pr-body.md from real measured data — CVEs closed, tests before/after, diff, risk summary — ready to attach to the PR.
Presents the full summary and waits. Nothing is committed until a human types approve. Typing reject discards all code changes while preserving all run artefacts.
Full evidence: CVE details, test diff, patch, risk table, and PR body — all in one self-contained file.
Open the real Upgrade Dossier