Ctrlk
Changelog NotificationsAPIAikido login
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Aikido Libraries Overview

Aikido Libraries is currently in limited availability and is enabled per workspace by Aikido. Full availability in Q3.

Aikido Libraries continuously removes CVEs from the open-source packages your repositories already depend on, without forcing you to upgrade to a new major version. Once a repository is protected, Aikido replaces vulnerable versions with secured, drop-in replacements that keep the same package name and base version you are running today.

The result is a repository whose dependency tree converges to zero open CVEs and stays there, while your application code remains untouched.

How it differs from a standard dependency upgrade

Aikido AutoFix for open source dependencies proposes the minimum version bump needed to clear a CVE. That works well when a fixed upstream version exists and is safe to adopt, but it still requires you to take an upgrade, even if it is only a patch bump.

Aikido Libraries takes a different approach. Instead of moving you to a new version, it pins your repository to Aikido-built variants of the exact versions you already use. Security patches are backported into those variants so the version string, public API, and behavior stay the same.

Use Cases

  • Repositories that pin transitive dependencies and can't easily take upstream upgrades.

  • Legacy services where dependency upgrades carry a high regression risk.

  • Packages that aren't being maintained anymore.

How it works

  1. From AutoFix > Aikido Libraries, open the Protected Repos tab and click Protect Repo on the repository you want to protect. Aikido shows the credit cost in the confirmation modal before you commit. See Protecting a Repository.

  2. Aikido patches your packages. Once a repository is protected, Aikido inspects every CVE affecting the packages in that repository and produces secured variants of those packages. Each variant keeps your original version number with an +aikido.N revision suffix appended (+aikido.1, +aikido.2, ...), so a 1.4.2 install becomes 1.4.2+aikido.1 after pinning.

  3. Daily PRs keep you protected. Aikido reuses the existing AutoFix daily PR mechanism to open a pull request that updates the manifest and lock files to point at the Aikido-pinned variants. New CVEs discovered later are rolled into subsequent daily PRs automatically.

Pricing

Aikido Libraries is sold as a 1-year subscription per protected repository, paid with Aikido credits. The credit cost is shown in the confirmation modal before you commit and renews annually until you cancel renewal. The full formula and worked examples are documented in Protecting a Repository.

Relationship to AutoFix

Aikido Libraries is a distinct product from AutoFix, but the two are designed to work together. Protected repositories continue to receive standard AutoFix output for anything outside the protected dependency set (SAST, IaC, containers, pentest findings). The library updates themselves are delivered through the same daily PR flow, so reviewers see them in the same place as other AutoFix PRs.

Last updated

Was this helpful?