Comparisons · Dependency patching

Codicrest vs Dependabot

Codicrest is an always-on AI agent that upgrades the dependency backlog. Dependabot is GitHub’s version-bump bot. Here is what each is good at — and where Dependabot falls short precisely where Codicrest excels.

What GitHub Dependabot does well Where it stops short How Codicrest fills the gap

Section 01 · Where it shines

What GitHub Dependabot does well — and we don't replace.

Five things GitHub Dependabot is best-in-class at — none of which Codicrest replaces.

Native GitHub advisory data, day-one coverage of new CVEs.
Version-introduced recall — knows when a CVE landed in the dep tree.
Native GitHub Actions UX: scheduled runs, PR comments, status checks.
Ecosystem coverage across npm, pip, Maven, Bundler, Cargo, Composer, Hex, Gradle, Go modules, NuGet, Pub, Elm.
Free, zero-config inside any GitHub repo.

Honest framing

If your only goal is "open version bumps for every dep with a published CVE", Dependabot is the right tool — and it has shipped that for years. Codicrest does not try to displace that loop. We pick up where Dependabot stops — four specific gaps AppSec teams hit the moment they need to answer "is the affected code reachable in our repo, and what does the audit trail look like?"

Section 02 · The four gaps

Where Dependabot stops short — four gaps.

AppSec teams we work with consistently list these four lanes — reachability, SBOM, the "bump is not enough" PR, and the multi-repo rollup — as the work GitHub Dependabot leaves them holding. Each is a memo entry below.

Reachability

Whether a vulnerable code path is reachable from your code, not just declared in your dependency tree.

[memo §reachability]

Lists every transitive dependency as equally risky — including ~80% noise on a typical 10k-package tree.
No path-from-entry-point analysis: a vulnerable symbol counts as live even when your code never imports it.
No signal of whether a vulnerable function is called from your tests, your routes, or your background jobs.

SBOM

A machine-readable inventory of every dependency in every shipped build, kept current as code merges.

[memo §sbom]

Generates a per-PR lockfile snapshot — but no per-build SBOM and no signed artefact for downstream tooling.
No CRA-aligned audit-trail export; data is locked inside GitHub-side artifacts, not a queryable audit log.
No SBOM delta on the merged PR — diffs between builds are not machine-queryable.

Patch-ready PRs

Drift-minimal source changes that close CVEs Renovate and Dependabot cannot unpick — ready to merge before standup.

[memo §patches]

Generates version-bump PRs only — humans still triage, draft, and write the test plan when a version bump is not enough.
No test execution against your repo: CI is treated as a downstream problem, not a contract.
Cannot draft the minimal source change when no upstream release is available (e.g. abandoned impacted package or post-EOL runtime).

Multi-repo aggregation

A fleet-wide view of who-uses-what across every repository you ship, rolled up into one picture.

[memo §multi-repo]

Per-repo configuration only — no native fleet view, no team-level rollup, no cross-repo de-dupe of advisories.
NVD/GHSA data is not correlated with repo-level usage; the same transitive dep surfaces ad nauseam across hundreds of PRs.
No org-wide SLA or "mean-time-to-merge" reporting — every team owns its own Dependabot config in isolation.

Section 03 · Codicrest response

How Codicrest fills those gaps.

Each gap gets a paired response below, drawn from the teardown memo. Every Codicrest claim is hyperlinked to the same memo entry rendered further down on this page.

Reachability analysis

Whether a vulnerable code path is reachable from your code, not just declared in your dependency tree.

Codicrest combines your AST, your test surface, and public commit data to score every advisory against reachability. ~90% of the queue drops before a PR is drafted; the surviving ~10% carries a per-call evidence trail — which file imports what, in which version, and why it scores the way it does.

[memo §reachability]

Software Bill of Materials

A machine-readable inventory of every dependency in every shipped build, kept current as code merges.

Every shipped PR attaches an SBOM delta — the exact list of added, removed, and updated packages — plus a CRA-friendly audit entry. Each entry is queryable by advisory ID and links the upstream signal (NVD/GHSA/OSV) to the merge commit that closed it, ready for the auditor and your insurer.

[memo §sbom]

See the SBOM and CRA audit trail — every closed CVE with signed patch evidence and rollback steps — at /app/audit.

Patch-ready PRs beyond version bumps

Drift-minimal source changes that close CVEs Renovate and Dependabot cannot unpick — ready to merge before standup.

For each qualifying signal Codicrest drafts the minimal source change in an isolated sandbox — running your tests + a regression diff with your own repo as the fixture. Failures drop silently; successes open a ready-to-merge PR with the diff, the model reasoning trace, and the SBOM delta attached.

[memo §patches]

Multi-repo aggregation

A fleet-wide view of who-uses-what across every repository you ship, rolled up into one picture.

Codicrest aggregates every dependency edge across all the repositories your team ships into one fleet view — so the same advisory surfaces once with the list of affected repos, the SBOM delta per affected repo, and the EOD pipeline summary. Per-repo PRs are still opened; the queue is never duplicated and never re-tasked by humans.

[memo §multi-repo]

Section 04 · The teardown memo

The memo, on one page.

Every Codicrest claim above pulls from this memo (last updated 2026-08-18). The four gap-specific entries cover reachability, SBOM, patch-ready PRs beyond version bumps, and multi-repo aggregation. The overview entry covers what GitHub Dependabot does well.

01 · Where Dependabot wins

[memo §overview]

Five things Dependabot is genuinely best-in-class at — none of which Codicrest replaces.

What GitHub Dependabot does well

Native GitHub advisory data, day-one coverage of new CVEs.
Version-introduced recall — knows when a CVE landed in the dep tree.
Native GitHub Actions UX: scheduled runs, PR comments, status checks.
Ecosystem coverage across npm, pip, Maven, Bundler, Cargo, Composer, Hex, Gradle, Go modules, NuGet, Pub, Elm.
Free, zero-config inside any GitHub repo.

02 · Reachability analysis

[memo §reachability]

Whether a vulnerable code path is reachable from your code, not just declared in your dependency tree.

What GitHub Dependabot does well

Day-one coverage of new advisories via the GitHub advisory database.

Where it stops short

Lists every transitive dependency as equally risky — including ~80% noise on a typical 10k-package tree.
No path-from-entry-point analysis: a vulnerable symbol counts as live even when your code never imports it.
No signal of whether a vulnerable function is called from your tests, your routes, or your background jobs.

Codicrest response

Codicrest combines your AST, your test surface, and public commit data to score every advisory against reachability. ~90% of the queue drops before a PR is drafted; the surviving ~10% carries a per-call evidence trail — which file imports what, in which version, and why it scores the way it does.
[memo §reachability]

03 · Software Bill of Materials

[memo §sbom]

A machine-readable inventory of every dependency in every shipped build, kept current as code merges.

Where it stops short

Generates a per-PR lockfile snapshot — but no per-build SBOM and no signed artefact for downstream tooling.
No CRA-aligned audit-trail export; data is locked inside GitHub-side artifacts, not a queryable audit log.
No SBOM delta on the merged PR — diffs between builds are not machine-queryable.

Codicrest response

Every shipped PR attaches an SBOM delta — the exact list of added, removed, and updated packages — plus a CRA-friendly audit entry. Each entry is queryable by advisory ID and links the upstream signal (NVD/GHSA/OSV) to the merge commit that closed it, ready for the auditor and your insurer.
[memo §sbom]

04 · Patch-ready PRs beyond version bumps

[memo §patches]

Drift-minimal source changes that close CVEs Renovate and Dependabot cannot unpick — ready to merge before standup.

Where it stops short

Generates version-bump PRs only — humans still triage, draft, and write the test plan when a version bump is not enough.
No test execution against your repo: CI is treated as a downstream problem, not a contract.
Cannot draft the minimal source change when no upstream release is available (e.g. abandoned impacted package or post-EOL runtime).

Codicrest response

For each qualifying signal Codicrest drafts the minimal source change in an isolated sandbox — running your tests + a regression diff with your own repo as the fixture. Failures drop silently; successes open a ready-to-merge PR with the diff, the model reasoning trace, and the SBOM delta attached.
[memo §patches]

05 · Multi-repo aggregation

[memo §multi-repo]

A fleet-wide view of who-uses-what across every repository you ship, rolled up into one picture.

Where it stops short

Per-repo configuration only — no native fleet view, no team-level rollup, no cross-repo de-dupe of advisories.
NVD/GHSA data is not correlated with repo-level usage; the same transitive dep surfaces ad nauseam across hundreds of PRs.
No org-wide SLA or "mean-time-to-merge" reporting — every team owns its own Dependabot config in isolation.

Codicrest response

Codicrest aggregates every dependency edge across all the repositories your team ships into one fleet view — so the same advisory surfaces once with the list of affected repos, the SBOM delta per affected repo, and the EOD pipeline summary. Per-repo PRs are still opened; the queue is never duplicated and never re-tasked by humans.
[memo §multi-repo]

Try it on a stack you actually care about

Design-partner onboarding is open this quarter.

See the teardown above pay off on a CVE you care about — drop your email and we'll send a 30-minute walkthrough on a stack of your choice.

Read the full memo as one page — jump to the memo block.

[memo §reachability][memo §sbom][memo §patches][memo §multi-repo]

Get early access See pricing Back to overview Compare to Renovate →

or email us directly → codicrest@polsia.app