Automate Snyk fixes and PR creation

Use an agent to turn Snyk tickets into dependency updates and draft pull requests, while leaving merges for a person.

Done with Claude CodeCursor· Intermediate· Nov 2026

What they did
At CertifyOS, a developer set up a Claude Code and Cursor flow for Snyk vulnerability tickets. The agent reads each ticket, figures out which package needs changing, updates the dependency files and lockfiles, then opens a pull request and follows CI. A human still handles the merge decision.
How it went
The developer said weekly remediation work fell from 6–7 hours to about 1–1.5 hours. The process kept a manual approval step in place, so every dependency change still got reviewed before merge.
Tips
Keep the final merge outside the agent’s control so a person can verify security fixes before they land. Make the agent stop and show the planned changes before it opens any PRs or touches production paths.

Try it yourself with Claude Code

You are helping triage Snyk vulnerability tickets for [repo path]. Review the open tickets in [Snyk project or queue], identify the dependency change needed for each one, and update the relevant dependency files and lockfiles. Run [test command] to check the change, then draft a separate pull request for each fix with a short explanation of what was updated and why. Watch the CI status for each PR and summarize any failures or needed follow-up. Before you create or open the first pull request, pause and show me the planned changes for approval. Do not merge anything.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on news.ycombinator.com ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.