Update vulnerable packages and open a pull request

Devin reviewed a mixed backend and frontend project, applied security-related dependency upgrades, and prepared a PR with the changes.

Done with Devin· Intermediate· Apr 2026

What they did
In a Devin session, a user asked for help with dependency risk in a sample project that had both server-side and client-side code. Devin inspected the app, then made two commits that moved key libraries forward, including Spring Boot, sqlite-jdbc, Gradle, Next.js, React, axios, and marked. While doing that, it also rewrote parts of the app to match SWR v2 and React 18, replaced plaintext password handling, removed a hardcoded JWT secret, and tightened the CORS rules. Devin finished by adding a checklist for human testing.
How it went
The frontend’s npm audit count dropped from 103 vulnerabilities, with 10 marked critical, to 2 vulnerabilities and none critical. The pull request was closed without merging because it was overtaken by #366. Devin’s review also noted a new XSS issue: marked’s sanitize option disappeared without a replacement.
Tips
When upgrading libraries, check for security options that may vanish or change behavior, not just version numbers. Also set JWT_SECRET before deployment, and remember that failing coverage, like the reported 33% JaCoCo result, may predate the upgrade.

Try it yourself with Devin

Inspect my [repository/path] and update the dependencies in [frontend/backend/both] so they address the vulnerabilities reported by [scanner/audit tool]. If any framework or library upgrade changes APIs or security defaults, adapt the code accordingly and list those changes in the summary. Stop before any irreversible action, such as deleting files, pushing to protected branches, submitting releases, or merging, and ask me to approve first. When finished, open a pull request that states which issues were fixed, which ones still remain, and what manual checks I should run next.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on github.com ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.