mendr
HighHighModerate

svgo 1.3.2 has 3 advisories

mendr-sh/acme-web · all fixed in 2.8.4

One package.
Three ways it ends.

Three real advisories in a real repository. The fixed svgo removed an API the code uses, so a version bump alone breaks the build. Here is what Dependabot, a GitHub agent and Mendr each do with it.

Checked against GitHub's documentation on Oct 29, 2026 · sources at the end

Before anyone fixes it

GitHub sees three alerts.
Mendr sees one finding.

GitHub lists an alert for every detected vulnerability, and you assign an agent one alert at a time.15,16 Mendr keeps one finding per package in each repository, with every advisory and every manifest in it, one due date from the most severe advisory, and one fix. A package with nine advisories is still one finding.

On GitHub

Dependabot alerts3 open
  • High

    SVGO removeScripts plugin leaves some executable scripts intact

    GHSA-2p49-hgcm-8545 · svgo 1.3.2

  • High

    SVGO: removeScripts allows executable links through namespace and control-character bypasses

    GHSA-w27v-7q3p-w38r · svgo 1.3.2

  • Moderate

    SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

    GHSA-4vpr-x523-8j87 · svgo 1.3.2

An alert for every detected vulnerability. Drawn from GitHub's docs with acme-web's real advisories.

In Mendr

Queue1 finding

svgo1.3.2 → 2.8.4

High

3 advisories · 2 high, 1 moderate · mendr-sh/acme-web · one due date, set by the high ones

  • GHSA-2p49-hgcm-8545High
  • GHSA-w27v-7q3p-w38rHigh
  • GHSA-4vpr-x523-8j87Moderate
One due date, one fix: acme-web#4 fixed all three

Ending 1

Dependabot bumps the version.

It opens a pull request that moves svgo to 2.8.4 and checks that the dependency graph still resolves. It does not change your code or run your tests.1 Your CI does, and the build fails.

EndsA red pull request, waiting for someone to fix src/icons.js.

Version bump onlyBuild fails
$ npm install -D svgo@2.8.4
$ npm run build

src/icons.js:6
const svgo = new SVGO({
             ^
TypeError: SVGO is not a constructor
Real output · acme-web at 6833c3d, Node 20

Ending 2

Or a GitHub agent takes it.

With GitHub Code Security and eligible Copilot access, you can assign an alert to Copilot, Claude or Codex, one alert at a time.4,15 The agent works on the failing tests, and GitHub checks its changes before you review the draft.

EndsA draft pull request inside GitHub, if your plans and policies allow it.

Alert assigned to an agentas GitHub documents it
  1. 1A draft pull request opens with the assigned agent's proposed fix.4
  2. 2The agent works on failing tests that the update caused.4
  3. 3GitHub checks the agent's changes: CodeQL, secret scanning and an Advisory Database check.5,7
  4. 4Copilot asks for a second opinion: a Copilot code review. Copilot only.5
  5. 5Your workflows wait for a person with write access to approve the run.6
GitHub's documented steps. We have not run this path on acme-web.

Ending 3

Mendr fixes it. Then a separate AI checks it.

A person presses Fix. Mendr's agent upgrades svgo, moves src/icons.js to the v2 API, and runs the build, tests and audit in a single-use sandbox. Then a separate AI session reviews the frozen diff, read-only. It sent this fix back once. The pull request opened only after it accepted.17,19

EndsOne green pull request for all three advisories, saying what ran and what is still open.

12:03Time-lapse of the recorded run
mendr-sh/acme-web, 12 min 03 s
  1. 0:01Single-use sandbox starts, repository at a pinned commit
  2. 0:07Mendr's agent starts
  3. 2:17Agent changes src/icons.js for the svgo v2 API
  4. 2:43Build, tests and npm audit run
  5. 5:35A separate reviewer starts, read-only
  6. 7:23Reviewer requests corrections
  7. 7:23Agent corrects the change and reruns the checks
  8. 9:19Reviewer checks again
  9. 11:51Reviewer accepts
  10. 12:03Pull request #4 opens
Read mendr-sh/acme-web#4 on GitHub
src/icons.js · Mendr's changesvgo v2 API
33const SVGO = require("svgo");
33const { optimize } = require("svgo");
1111 const result = await svgo.optimize(svg);
2121 const result = optimize(svg, config);
Checks in Mendr's sandboxPassed
  • npm run buildOptimized 3 icons
  • npm test9 of 9 tests
  • npm audit4 → 0 findings
  • git diff --checkNo whitespace errors
  • Content gateNo rule rejected it
  • Independent reviewAccepted

Still open. No dedicated regression test exercises the removeScripts bypass payloads.

Where GitHub is the better choice.

Dependabot is free.

It is built in, supports many package ecosystems, and keeps dependencies current with version updates. It can group security updates into one PR. If your security PRs pass CI, it may already do the job.1,2,12

Copilot also fixes code scanning.

GitHub can keep dependency and code-scanning remediation inside your existing workflow. You can compare coding agents on one Dependabot alert. Access depends on your plans and policies; runs consume AI credits and Actions minutes.4,9,13

Mendr is new.

It is small, GitHub only, and a second vendor with write access to your repositories. Its reviewer is an AI, not a person.

Using both? Keep Dependabot for alerts and version updates. Use Mendr for the fixes that sit open because someone has to run the tests or change the code. Mendr imports your Dependabot alerts. Decide per repository which tool opens security pull requests.

Every detail, side by side +

Checked against GitHub's documentation on Oct 29, 2026
QuestionGitHubMendr
What lands in your queueAn alert for every detected vulnerability, each with its own manifest path. You assign an agent one alert at a time.15,16One finding per package in each repository, with all its advisories and manifests. One due date, from the most severe advisory, and one fix.19
What starts a fix

Dependabot. Automatic attempts for alerts with a patched version. Security updates can be grouped into one PR.1

Agent. A person assigns the alert to Copilot, Claude or Codex.4

A person selects findings and presses Fix.18
Code changes on a breaking upgrade

Dependabot. None. It changes the dependency version only.1

Agent. The agent tries to fix the test failures that the update caused.4

Mendr's agent changes the code in a single-use sandbox.19
Validation where the fix runs

Dependabot. The dependency graph still resolves. No build or tests of its own.1

Agent. Your tests and linters, plus CodeQL, secret scanning and an Advisory Database check on its changes.5,7,8

Checks that the fix agent selects or that your repository setting requires, in a single-use VM. Content rules check the diff.17
Review of the change

Dependabot. No AI change to review.1

Agent. Copilot: a Copilot code review during its own run. Claude and Codex: not documented.5,7

A separate read-only AI session. The PR opens only if it accepts.17
Limits on the AI

Dependabot. No AI.

Agent. Copilot is limited to one branch and cannot merge its PR. A new task gets a copilot/ branch; a mention on an existing PR can use that PR's branch.6

No GitHub credentials. Changes to CI configuration, .github/, install scripts, Git hooks and CODEOWNERS are rejected.17
PrioritizationAlerts sort by importance. Reachability analysis is in public preview for JavaScript and TypeScript on Enterprise Cloud, free during the preview and off by default.15,20Ranks dependency findings across repositories using severity, CISA KEV and EPSS. Due dates come from your SLA policy.18
After the PR opens

Dependabot. Your CI runs; your team merges.1

Agent. Your workflows wait for a person to approve the run, by default.6

Your CI runs; your team merges. Mendr never merges, then rescans.17,18
DeadlinesDependabot alerts have auto-triage rules. GitHub documents security campaigns for code-scanning and secret-scanning alerts.10,11One ranked queue for every repository, with due dates from your SLA policy.18
Pricing

Dependabot. Included on every GitHub plan.12

Agent. Dependabot-to-agent assignment requires Code Security and eligible Copilot access. Code Security lists $30 per active committer/month. Copilot access can be seat-based or included with eligible Enterprise accounts; usage and Actions charges apply.4,7,12,13,21

Free with 5 free fixes. Pro $20 or Max $200 a month, with an AI budget that Mendr pays.18
Where it runs

Dependabot. GitHub Actions runners.14

Agent. An ephemeral cloud development environment.8

A single-use VM with a recorded execution deadline.17
Coverage

Dependabot. Security updates for many ecosystems, plus version updates.2,3

Agent. Dependabot alerts. Agentic autofix also covers code scanning alerts.4,9

Dependency advisories, and the Node.js and Go versions that your repositories declare. Fix toolchains for Node.js, Python, Go, Rust, Ruby, Java, Kotlin and PHP.18

Sources

  1. About Dependabot security updates · docs.github.com
  2. Dependabot supported ecosystems and repositories · docs.github.com
  3. Dependabot default package cooldown (Jul 14, 2026) · github.blog
  4. Dependabot alerts assignable to AI agents (Apr 7, 2026) · github.blog
  5. Copilot coding agent validates code security and quality (Oct 28, 2025) · github.blog
  6. Risks and mitigations for Copilot cloud agent · docs.github.com
  7. About third-party coding agents · docs.github.com
  8. About Copilot cloud agent · docs.github.com
  9. Agentic autofix for code scanning is generally available (Oct 15, 2026) · github.blog
  10. About security campaigns · docs.github.com
  11. About Dependabot auto-triage rules · docs.github.com
  12. GitHub security plans and pricing · github.com
  13. Plans for GitHub Copilot · docs.github.com
  14. About Dependabot on GitHub Actions runners · docs.github.com
  15. Viewing and updating Dependabot alerts · docs.github.com
  16. REST API endpoints for Dependabot alerts · docs.github.com
  17. Mendr security review · mendr.sh
  18. Mendr pricing and FAQ · mendr.sh
  19. mendr-sh/acme-web#4 · github.com
  20. Dependabot reachability analysis preview (Oct 28, 2026) · github.blog
  21. Copilot access included with eligible Enterprise accounts (Oct 28, 2026) · github.blog

See it on your own repos.

Connect GitHub and run the first scan on up to 5 repositories. It only reads your code. Your first 5 fixes are free.

Connect GitHubRead the pull request