Patterns
Pattern: dependency-cve-burndown
A CVE advisory landing at 3am shouldn't sit unread until Monday. This kit scans the dependency graph daily, ranks findings by severity, reachability,…
A CVE advisory landing at 3am shouldn't sit unread until Monday. This kit scans the dependency graph daily, ranks findings by severity, reachability, and exposure, and drafts the smallest credible patch for the highest-risk reachable one — verified by build, tests, and a fresh security scan. It never applies a major or breaking upgrade, touches production, or accepts risk without asking first.
Quick facts
| Field | Value |
|---|---|
| Category | F · Security |
| Heartbeat | schedule |
| Cadence | daily |
| Level | L1 (report-only, drafts-not-applies) |
| Cost | Medium |
| Group | B — Forward Future Loop Library |
The six parts
| Part | This kit |
|---|---|
| Heartbeat | schedule — daily |
| Body | reads the dependency graph and CVE advisories; drafts a patch in a throwaway worktree and re-runs build + tests + scan there; writes only cve-burndown-report.md, its own state file, and the run log |
| Spine | dependency-cve-burndown-state.md — per-CVE reachability assessment, patch draft, verification result, and risk decisions |
| Stopping condition | the source's own, verbatim: "no exploitable high or critical dependency CVE remains without an explicit decision" |
| Checker | build + tests + a fresh security scan, re-run after every candidate patch |
| Human gate | the source's own explicit gate — "ask before major or breaking upgrades, production changes, or accepting risk" |
The three valid stops
- Success — no exploitable high or critical CVE remains without an explicit decision, the source's own spec, verbatim.
- Limit — 20 runs or 300k tokens.
- No progress — 3 consecutive beats with no ranking change → log and stop. Findings blocked on a human decision are correctly flagged, not a stall.
Source: Loop #7, "The dependency-CVE burndown loop," from Forward Future's Loop Library, original prompt by hungtv27, used near-verbatim. Full attribution: resources/sources.md.