Upgrade vulnerable dependencies via automated pull request
Devin opened a PR on a Spring Boot and Next.js sample app upgrading dependencies to fix listed CVEs, including 103 npm vulnerabilities on the frontend. ·
Done withDevin
- What they did
- Requested by a user in a Devin session, Devin audited the Spring Boot backend and Next.js frontend and pushed two commits. These upgraded Spring Boot, sqlite-jdbc, Gradle, Next.js, React, axios and marked. It also fixed plaintext password storage, a hardcoded JWT secret and wildcard CORS, and adapted code to SWR v2 and React 18. It left a human checklist for manual testing.
- How it went
- Frontend npm vulnerabilities fell from 103 (10 critical) to 2 (0 critical). The PR was closed unmerged, superseded by #366. Devin's own review flagged an XSS regression: the marked sanitize option was dropped with no replacement.
- Worth knowing
- Library upgrades can silently drop safety options such as marked's sanitize. Check for that, and set JWT_SECRET before deploying. The PR also notes JaCoCo coverage failed at 33%, a pre-existing condition.
Try it yourself with Devin
In my repo [repo URL], upgrade the vulnerable dependencies in [frontend/backend/both] to fix the known CVEs reported by [npm audit / Dependabot / scanner name]. Make sure the build and existing tests still pass after the upgrades. Open a pull request listing which vulnerabilities were fixed, which remain, and any breaking changes you had to handle. Don't merge it.
Want help getting this working? Join the Vibe Coding Academy ↗ Run by Alex Finn, who also runs this site.
Source: github.com · Apr 29, 2026
Related use cases
Hand narrow code changes to Devin for pull requests
A team used Devin for a month on small fixes like chart formatting and API edge cases, with tests and PRs; a complex full-stack task went poorly.
Build a name-and-face quiz site from a spreadsheet
Scott Wu had Devin build and deploy a mobile-friendly React quiz from a TSV of speaker names and photos, plus a QR-code site to share it.
Hunt jobs, tailor resumes and apply automatically
An agent called Resume finds and ranks jobs around schedule and pay wants, drafts tailored resumes and submits applications; the author reports 3 interviews and 1 offer.
Build a C compiler with a team of parallel agents
Anthropic's engineering write-up on tasking Opus 4.6 agent teams with building a C compiler.
Test API endpoints in Postman and report results
@ai_for_success used Comet to generate test payloads from context, run API endpoint tests in Postman and produce a final report.
Turn Sentry bug reports into fix pull requests
Sentry's Seer passes root cause analysis and issue context to a Cursor Cloud Agent, which writes the fix and opens a pull request in the user's repo.
Get 5 like this every morning
The best things people got an AI agent to do, each with the prompt to try it.