RepoMedic

Overview

Modern software projects accumulate dependency vulnerabilities quickly. Security alerts pile up through transitive packages, unused frameworks, and outdated tooling, increasing risk and maintenance overhead. RepoMedic was developed as an AI-powered repository maintenance agent designed to triage real GitHub security alerts, remove unused framework dependencies safely, apply low-risk dependency updates, validate builds locally before proposing changes, and create scoped pull requests with human oversight. In a live production repository, RepoMedic reduced 20 active security alerts to zero using controlled, validated remediation. This project validates a conservative AI approach: small changes, tested upgrades, and no blind major version jumps.

Key Features

• Scoped Dependency Analysis: Identifies unused frameworks and vulnerable packages by analysing imports, configuration files, and build scripts before making changes
• Low-Risk Remediation Strategy: Prioritises patch and minor updates. Avoids major version jumps unless explicitly reviewed
• Human-in-the-Loop Governance: All changes are proposed via pull request. No automatic merges. Full review control retained
• Local Validation Before PR: Runs pnpm install and pnpm build to verify the working state prior to branch publication
• CI/CD Integrity: Ensures Vercel deployment checks and GitHub Actions pass before merge
• Security Debt Reduction: Removes unnecessary frameworks to reduce attack surface and long-term maintenance burden