{"id":5293,"date":"2026-10-21T15:06:27","date_gmt":"2026-10-21T15:06:27","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/10\/21\/introducing-agentic-autofix-for-code-and-dependencies\/"},"modified":"2026-10-21T15:06:27","modified_gmt":"2026-10-21T15:06:27","slug":"introducing-agentic-autofix-for-code-and-dependencies","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/10\/21\/introducing-agentic-autofix-for-code-and-dependencies\/","title":{"rendered":"Introducing Agentic Autofix for code and dependencies"},"content":{"rendered":"

Fixing a vulnerability takes more than knowing where it is. You need a change that follows your coding standards and works with the rest of your code.<\/p>\n

Copilot Autofix for GitHub Advanced Security for Azure DevOps now runs on an agentic foundation. It also supports dependency vulnerability fixes and code scanning alerts from third-party tools.<\/p>\n

Select the alert to address, Autofix works in the background on a proposed change in your existing Azure DevOps workflow, and your team keeps the final decision on what to merge.<\/p>\n

Agentic fixes use your repository context<\/h2>\n

Your team might require a shared validation helper or a specific package-update procedure. A fix that ignores those decisions still leaves you with work to do.<\/p>\n

Agentic Autofix uses the Copilot coding agent to explore relevant repository context. It can review and refine its proposed changes before returning a suggestion.<\/p>\n

It can also use custom instructions and skills in supported .github<\/code> or .agents<\/code> locations. For example, instructions can direct the agent to use your approved input-validation helper. A dependency-update skill can describe your package-update procedure and compatibility checks.<\/p>\n

This gives the agent guidance about how changes should fit your repository. Instructions and skills provide additional context to guide Autofix in the right direction and minimize bespoke remediation.<\/p>\n

\"autofix<\/a><\/p>\n

The same workflow, beyond CodeQL<\/h3>\n

Previously, Autofix was limited to fix generation for a scoped set of CodeQL rules. Now, if you use another code scanning tool, you can now request Autofix for those alerts too.<\/p>\n

Generate fixes for dependency vulnerabilities<\/h2>\n

Dependency scanning identifies vulnerable packages and provides remediation guidance. You still have to turn that guidance into a change. Autofix now gives you a fix-generation workflow for these findings, not just static analysis results.<\/p>\n

Open a supported dependency vulnerability alert and select Generate fix. Then, Agentic Autofix can open a pull request with a suggested change and an explanation. You review it through the same process you use for other code changes.<\/p>\n

Decide which dependency alerts to address first<\/h3>\n

Severity alone doesn\u2019t tell you how likely exploitation is or how your project uses a vulnerable dependency. EPSS and development dependency detection add that context to dependency triage.<\/p>\n

The Exploit Prediction Scoring System (EPSS) estimates exploitation likelihood in the wild. When data is available, Advanced Security shows the EPSS percentile for a dependency alert. A higher percentile means a higher relative rank for predicted exploitation likelihood. It isn\u2019t the probability that someone will attack your application.<\/p>\n

Alongside EPSS, development dependency detection distinguishes development-only dependencies from runtime dependencies in supported ecosystems. Use the Development badge and Scope filter to understand the dependency\u2019s role.<\/p>\n

For example, for prioritization, combine the Runtime scope filter with a high EPSS percentile range to focus a triage pass. Then, consider severity and your application\u2019s exposure before choosing a supported alert for Autofix.<\/p>\n

\"dependency<\/a><\/p>\n

Get started<\/h2>\n

From the organization, project, or repository-level, enable agentic Autofix with a single button for both dependency and code scanning alerts. From there, select individual alerts at the repository-level that you want to receive Autofixes for.<\/p>\n

\"autofix<\/a><\/p>\n

Agentic Autofix will roll out over the next two to three weeks. If your organization is enrolled in the limited public preview, request a fix from a supported dependency or code scanning alert. Review the full diff, run your build and tests, and verify the code changes before merging.<\/p>\n

Generating fixes consumes AI credits; enabling Autofix doesn\u2019t generate fixes automatically. Not every request produces a fix, and AI-generated suggestions should be reviewed for correctness.<\/p>\n

Agentic Autofix will be available in public preview in November.<\/p>\n

For details, see Prioritize dependency scanning alerts<\/a> and Copilot Autofix for code security alerts<\/a>.<\/p>\n

Share feedback here, via email, or through the Azure DevOps Developer Community<\/a>.<\/p>\n

The post Introducing Agentic Autofix for code and dependencies<\/a> appeared first on Azure DevOps Blog<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Fixing a vulnerability takes more than knowing where it is. You need a change that follows your coding standards and […]<\/p>\n","protected":false},"author":1,"featured_media":5294,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[3],"tags":[],"class_list":["post-5293","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5293"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5293\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5294"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}