Adversarial exposure · Feedback latency
A bot proposes the dependency update; a human still has to land it
Known-vulnerable dependencies sit in projects for a mean of 512 days before anyone acts, and automated update proposals collapse that to under a day — but only for the quarter that actually get merged, so the control is the bot plus a route to landing, not the bot alone.
Do this firstPin every dependency to an exact version · Every change runs the suite before a human looks at it
The gap this addresses is enormous and almost entirely invisible: 81.5% of systems keep outdated dependencies, and the vulnerable version sits there for well over a year on average.
Automation moves the number hard in one direction and not at all in another. Where a proposed security update gets merged, the median is under a day and most auto-merges complete in minutes. But only about a quarter of bot-created security pull requests are merged at all — 44% are auto-closed, mostly superseded by the next one the bot opened, and 31% simply sit.
So the honest framing is that the bot removes the discovery delay and does nothing about the decision delay. Developers describe the volume as overwhelming and note every one of them triggers a full test run. Pair it with the next control or the noise defeats you.
The decoy
A security advisory feed. Awareness was measured and it is not the bottleneck — 69% of developers whose projects carried a known-vulnerable dependency reported being unaware of it, and of those who did know, many deprioritised the upgrade as extra effort.
Evidence
- Do Developers Update Their Library Dependencies? — II partly self-reported81.5% of systems keep their outdated dependencies. In the follow-up survey, 69% of interviewees said they were unaware of the vulnerability in their own dependency, and those who did know often deprioritised migration as extra effort and added responsibility.
- Dependabot and security pull requests: large empirical study — II partly self-reportedKnown-vulnerable dependency versions sit undetected for a mean of 512 days, median 419. Bot-created security pull requests are merged only 25% of the time — 44% are auto-closed, mostly superseded by a newer one, and 31% remain open — while manually created security pull requests are merged 74% of the time. Where merges happen they are fast: median under a day, and 78% of auto-merges complete in minutes.
Last reviewed 2026-08-19.