Exploited-vulnerability response, automated.

Quick start

$ npm install -g https://github.com/patchprojectx/patch/releases/download/v0.1.0/patchnow-0.1.0.tgz
$ patchnow init            # writes patch.yml (dry run until armed: true), adds .patchnow/ to .gitignore
$ patchnow scan --fail-on kev
$ patchnow run             # scan → policy → actions (dry run)

Requires Node.js 20 or newer. The only runtime dependency is yaml.

CLI

Exit codes: 0 ok · 1 --fail-on threshold met · 2 usage or config error · 3 an action failed

patch.yml

Unknown keys are rejected, so a typo cannot silently weaken the policy. Secrets are never stored in the file: any key ending in _env names an environment variable.

version: 1
armed: false                # nothing destructive happens until true

scan:
  paths: ["."]
  include_dev: false
  runtimes: auto            # auto | off
  epss: true
  max_depth: 4

packages: { only: [], exclude: [] }

ignore:
  - id: CVE-2020-28500       # OSV id, GHSA id or CVE
    reason: "never called with user input"   # required
    expires: 2026-12-31      # fires again after this date
    packages: [lodash]

triggers:                   # ANY entry fires; keys inside an entry are ANDed
  - kev: true
  - severity: critical       # minimum: low | moderate | high | critical
  - epss: ">0.5"

actions:                    # run in order on the findings that fired
  - pin_patch: { base: main }
  - safe_mode:
      when: { kev: true }
      provider: render_deploy_hook
      url_env: RENDER_MAINTENANCE_DEPLOY_HOOK
  - notify:
      slack: { url_env: SLACK_WEBHOOK_URL }

state: { path: .patchnow/state.json, refire_after_days: 0 }
audit: { path: .patchnow/audit.jsonl }

Any action can carry when: with the same keys to narrow it further. Dedupe key: ecosystem|package|version|advisory. After an armed run acts on a key, that key does not fire again unless refire_after_days is above 0. Dry runs record no state.

Actions

GitHub Action

patchprojectx/patch is a composite action (action.yml at the repository root). It runs patchnow run --sarif, keeps .patchnow/ between runs with actions/cache, and uploads SARIF to code scanning. Pin @v0.1 for the latest v0.1.x, or @v0.1.0 for an exact release.

on:
  schedule: [{ cron: "*/15 * * * *" }]
  workflow_dispatch:
permissions: { contents: write, pull-requests: write, security-events: write }
jobs:
  patchnow:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: patchprojectx/patch@v0.1
        with: { config: patch.yml }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

Inputs: config · working-directory · dry-run · sarif · upload-sarif · github-token · persist-state

Supported files

Security model: what leaves your machine

• To api.osv.dev: package names, versions and ecosystems.
• To api.first.org: CVE identifiers, for EPSS scores. Disable with scan.epss: false or --no-epss.
• From cisa.gov: the public KEV catalog, cached locally for 6 hours.
• Never sent: source code, file contents beyond name and version, environment variables. Secrets are referenced only by environment-variable name and redacted from error URLs.
• Least surprise: dry run by default. Revocation needs armed: true and confirm: true. Lockfile updates run with --ignore-scripts. PATCH never merges anything; a human reviews the pull request.
• This website: the checker sends only name and version pairs to OSV. No cookies, no analytics.

Limitations (v0.1)

• Coverage is OSV's coverage. Matching is by package and version only; there is no reachability analysis.
• A package.json without a lockfile, or a go.sum-only project, can over-report. Ranges in requirements.txt are skipped.
• The minimum fixed version can still be a breaking change. Run your tests on the pull request.
• The end-to-end test covers the npm update path. The pnpm, Go, Cargo and Composer editors call the native tools but are not covered by it. yarn.lock and poetry.lock are reported for manual update.
• Pull requests opened with the default GITHUB_TOKEN do not trigger other workflows. Use a GitHub App or a fine-grained PAT if CI must run on them.
• Node.js and PHP runtime checks use a hand-curated advisory table, not a live feed. Go is matched live through OSV.
• Windows and SBOM inputs (CycloneDX, SPDX) are not supported yet.