PatchPilot

PatchPilot — Autonomous Security Patching via GitLab Orbit

The Problem: The 84-Day Vulnerability Gap

Every security scanner can tell you what's vulnerable. None of them tell you what breaks when you fix it.

Here's the daily reality: the Security Dashboard flags a Critical CVE in lodash. You know you need to patch it. But the real question is never "should I upgrade?" It's "what happens to my codebase when I do?"

Which files import this package?
Which functions call the vulnerable symbol?
What modules call those functions?
Does the new version change the API contract?

Without those answers, developers do what humans do with uncertainty: they wait. The industry mean time to remediate Critical CVEs is 84 days — not negligence, but invisible blast radius.

The Solution: PatchPilot

PatchPilot is a GitLab Duo Agent that closes the remediation gap using the GitLab Orbit Knowledge Graph to map the exact blast radius of any vulnerability before writing a single line of a fix.

Triggers

Automatic: GitLab Security Dashboard webhook on new Critical/High CVE
Manual: /.patchpilot CVE-2021-23337 in any MR comment

What it does

Queries Orbit for VulnerabilityOccurrence nodes matching the CVE
Traverses ImportedSymbol nodes to find exact vulnerable symbol usage
Follows DEFINES and CALLS edges to map function-level blast radius
Extends traversal to second-order callers (hop 2)
Checks package registry for API signature changes
Classifies: SAFE / BREAKING / UNKNOWN / CRITICAL_BLAST
Acts: opens a patch MR, a shim MR, or an escalation issue — automatically

How It Uses GitLab Orbit

This is the core differentiator. A plain LLM can only see the file you paste into it. GitLab Orbit sees the entire live codebase dependency graph.

PatchPilot chains 8 real Orbit graph queries per run:

Query	Type	Purpose
`VulnerabilityOccurrence → IN_PROJECT`	traversal	Find CVE in project
`Project → HAS_FILE → File`	traversal	Enumerate affected files
`File → IMPORTS → ImportedSymbol`	traversal	Find vulnerable symbol usage
`File → DEFINES → Definition`	traversal	Map function-level blast radius
`Definition → CALLS → Definition`	traversal	Second-order callers (hop 2)
`count(caller) group_by(definition)`	aggregation	Coupling density score
`User → AUTHORED → MergeRequest`	traversal	Code owner resolution
`Project → HAS_FILE` (manifest)	traversal	Package manager detection

None of this is possible with a plain LLM. Every decision PatchPilot makes is grounded in the live graph — not hallucinated from training data.

The Safety-First Design (Enterprise-Grade)

PatchPilot knows when to stop — as important as knowing what to do:

Classification	Trigger	Action
SAFE	No API changes, blast radius ≤ 4 hops	Auto version-bump MR
BREAKING	Exported signatures changed	MR + auto-generated compatibility shims
UNKNOWN	Empty Orbit graph, dynamic imports	Escalation issue → human
CRITICAL_BLAST	>4 hops or >50 definitions affected	High-priority escalation

This "degraded mode" design means PatchPilot never blindly patches code it cannot reason about. In the context of the GitLab Transcend Hackathon's focus on "agentic speed with enterprise control" — showing the agent knows when to stop is as impressive as showing what it can do.

Live Demo

Escalation Path (real output — live Orbit query)

 >> Step 0 | Checking Orbit cluster health...
 >>         Orbit is healthy (version 0.74.0)
 >> Step 1 | Querying Orbit for vulnerability occurrences...
 !!         No vulnerability occurrences found for CVE-2021-23337.
 >>         Falling back to package import scan...
 >> Step 7  | Classifying patch type... -> UNKNOWN
 >> Step 9  | Creating escalation issue (UNKNOWN)...
 >>         Issue created: https://gitlab.com/ekpenyongasuquo/patchpilot/-/work_items/1
  Result   : UNKNOWN | Artifact: issue

Safe Patch Path (full Orbit graph — MR auto-created)

 >> Step 1 | Found 3 directly affected file(s).
 >> Step 4 | Blast radius -- 5 file(s) | 4 definition(s) | depth=2
 >> Step 7  | Classifying... -> SAFE (no breaking API changes)
 >> Step 8  | $ npm install lodash@4.17.21 --save
 >> Step 9  | MR created: https://gitlab.com/yourorg/repo/-/merge_requests/42
  Result   : SAFE | Artifact: merge_request

What Changes for Developers

Before PatchPilot:

Scanner: "lodash 4.17.20 has a Critical CVE." Developer: parks it in the backlog for 84 days

After PatchPilot:

Scanner detects CVE → PatchPilot runs → patch MR open in 45 seconds Developer reviews a well-reasoned MR with full blast-radius report Merge. Done.

Time saved per patch:

Blast-radius analysis: ~2 hours manual → 45 seconds automated
MR creation + reviewer assignment: ~30 minutes → zero
BREAKING changes: shim scaffolding ready for review, not discovered in CI at 2am

Technical Implementation

Stack: Python 3.12, GitLab Orbit REST API, python-gitlab, Jinja2

Architecture highlights:

Orbit client isolated in agent/orbit/client.py — all query DSL builders are pure functions, fully unit-testable without HTTP
Business logic never imports python-gitlab — clean separation of concerns
Four-classification decision matrix with auditable reasons for every decision
Graceful degradation: Orbit health gate, empty-graph fallback, branch conflict retry, missing code owner fallback to maintainers
18 unit tests — all passing on Python 3.13 / Windows and Linux

Published artifacts:

MIT-licensed GitLab project: gitlab.com/ekpenyongasuquo/patchpilot
GitLab AI Catalog skill: patchpilot (skill.yml included)

Impact

Metric	Before	After
Mean time to remediate Critical CVE	84 days	< 5 minutes (SAFE path)
Blast-radius analysis	2+ hours manual	45 seconds
Broken CI from blind bumps	Common	Eliminated (BREAKING path)
Over-coupled packages	Silent risk	CRITICAL_BLAST escalation