LegacyFixer

Product Introduction

1. Definition: LegacyFixer is a security-first, automated dependency scanning and remediation tool for Python projects, deployed as a GitHub App. It operates as a specialized Software Composition Analysis (SCA) and dependency management solution.
2. Core Value Proposition: LegacyFixer exists to provide automated Python dependency security scanning without generating disruptive pull request noise. Its primary value is a "review-first, fix-later" workflow that prioritizes developer control and auditability over fully automated updates, differentiating it from tools that prioritize automation at the expense of stability.

Main Features

1. Passive Security Scanning by Default: LegacyFixer's foundational feature is its passive scan mode. It performs deep security scans of Python dependency manifests and lock files (like requirements.txt, poetry.lock, Pipfile.lock) to identify known vulnerabilities (CVEs) but records the findings without making any code changes or opening pull requests. This provides a safe onboarding path and a continuous security audit trail.
2. Policy-Controlled Fix Pull Requests: Fix creation is not automatic. Pull requests for dependency upgrades are only generated when explicitly enabled at the repository level and pass internal policy and validation checks. This includes conflict resolution, testing for "dependency hell" scenarios, and ensuring PR diff granularity is appropriate. This gives teams granular control over when and how fixes are proposed.
3. Explicit Scan Outcomes & Audit Trail: Every scan run produces a documented, explicit outcome (e.g., NO_ACTION, PR_CREATED). Each outcome includes a clear reason code (like passive_findings or dependency_conflict), the number of vulnerabilities detected, and whether a PR was opened. This creates an immutable audit log for compliance and troubleshooting.

Problems Solved

1. Pain Point: It solves the problem of "alert fatigue" and "PR spam" from fully automated dependency bots (like Dependabot or Renovate), which can overwhelm maintainers with numerous, sometimes breaking, upgrade PRs. It also addresses the gap in tools that only act when an automatic fix is possible, leaving vulnerabilities unreported if a fix is complex.
2. Target Audience: The primary user personas are Python repository maintainers, DevOps engineers, and security teams in small to medium-sized organizations who value stability and control. It is particularly suited for maintainers of legacy systems, critical production applications, or projects where dependency changes require careful review.
3. Use Cases: Essential for teams needing a security audit of legacy Python codebases before considering upgrades; for projects with complex dependency graphs where automated upgrades frequently break builds; and for organizations with strict change management policies that require human review before any code modification.

Unique Advantages

1. Strengths & Limitations (Pros & Cons):

   • Pros: Eliminates PR noise through a passive-first, opt-in fix model. Provides superior visibility into security posture even when fixes are not straightforward. Offers fine-grained, repository-level control over automation. Creates a clear audit trail with explicit scan outcomes. Simplifies onboarding with a safe, read-only initial scan.
   • Cons: May move slower than fully automated bots for applying fixes, as it requires manual enablement. The current scope is limited to Python dependency security, not multi-language ecosystems. As a newer tool, it has a smaller community and less third-party integration compared to established alternatives.

2. Key Alternatives & Differentiation:

   • vs. GitHub Dependabot: Dependabot is fully automated and opens a PR for every single vulnerability update it can identify, which can lead to high volume. LegacyFixer differentiates by scanning and reporting all vulnerabilities first, then creating a consolidated, validated PR only when enabled, prioritizing context and control over sheer automation.
   • vs. Renovate: Renovate is highly configurable but complex to set up for optimal noise reduction. It focuses on broad dependency updates (including non-security). LegacyFixer differentiates with a security-first, opinionated workflow that is simpler to configure for the specific goal of reducing noise, and it explicitly reports scenarios where it cannot auto-remediate.
   • vs. Snyk Open Source / WhiteSource: These are enterprise-grade SCA platforms with broad language support and advanced features. LegacyFixer differentiates by being a focused, lightweight, and developer-centric SaaS tool specifically for Python teams that deeply integrates a "scan-first, ask-later" philosophy directly into the GitHub pull request workflow.

Frequently Asked Questions (FAQ)

1. How does LegacyFixer handle complex dependency conflicts that block automatic fixes? LegacyFixer detects and reports dependency conflicts and "dependency hell" scenarios as part of its scan validation. In these cases, it will record the vulnerabilities found but output a NO_ACTION outcome with a reason like dependency_conflict, informing the developer that manual intervention is required instead of creating a failing or broken pull request.
2. What is the difference between passive mode and active fix mode in LegacyFixer? In passive mode (the default), LegacyFixer performs a security scan and records all vulnerability findings in its dashboard without making any changes to your GitHub repository. In active fix mode (enabled per-repo), it will additionally create a validated pull request with dependency upgrades that pass its safety and policy checks.
3. Can LegacyFixer scan private GitHub repositories? Yes, as a GitHub App, LegacyFixer can be installed on an organization or user account and granted permission to access and scan selected private repositories, making it suitable for both open-source and private Python projects.
4. Does LegacyFixer support dependency files other than requirements.txt? Yes, LegacyFixer is tested across common Python dependency layouts, including requirements.txt (and nested ones), poetry.lock, Pipfile.lock, and dependencies declared in setup.cfg under install_requires.
5. What happens when my free trial of LegacyFixer ends? After the 7-day trial, you will need to subscribe to a paid plan to continue scanning your connected repositories. You can revoke the app's access at any time from your GitHub account settings, which will immediately stop all scans.