Ctrlk
Changelog NotificationsAPIAikido login
For the complete documentation index, see llms.txt. This page is also available as Markdown.

AutoFix for Open Source Dependencies: Aikido Libraries

Stay on your current dependency version with patched, drop-in replacements for vulnerable packages.

Aikido Libraries gives you access to more than 5,500 patched open-source packages.

Each library is a drop-in replacement for a vulnerable dependency. You keep the same package name, version, and API. You do not need application changes.

When a safe upstream upgrade is blocked by breaking changes, Aikido Libraries lets you stay protected without waiting for a refactor.

Why teams use it

  • More than 5,500 patched libraries are available today.

  • Patches target the exact version you already run.

  • Every patch is verified by Aikido's security team before release.

How it works

When a CVE is published, Aikido scans affected package versions, researches the vulnerability, and backports the fix to the exact version you use.

Every patch goes through human verification before release. The result is a patched build of the same package version, with no API changes.

Example: log4j 1.x

log4j 1.x has been out of maintenance since 2015. Many teams still run it because moving to log4j 2.x is a breaking migration.

Version 1.2.17 contains these critical issues:

The Aikido Libraries variant of log4j 1.2.17 fixes these CVEs without forcing a migration to 2.x.

Use Aikido Libraries in AutoFix

AutoFix proposes an upgrade to an Aikido Libraries variant when one is available. You can review this in the AutoFix dependency overview. Java variants are hosted on maven.aikido.io.

To upgrade to the Aikido Libraries variant, select this option in the AutoFix creation modal.

Continuous protection for an entire repository

AutoFix offers Aikido Libraries on a per-CVE basis.

For continuous coverage across a repository, use the Aikido Libraries product. It creates daily PRs that pin packages to their Aikido-patched variants, including future CVEs found anywhere in the dependency tree.

Last updated

Was this helpful?