Legit Security extends Agentic Remediation to open-source dependencies

Legit Security has widened its Agentic Remediation capability to cover vulnerabilities in open-source dependencies, not only first-party code. The company said the agent now takes a vulnerable dependency through to a verified fix without manual triage.

Every fix is re-scanned before a pull request is opened, so developers receive a change that has already been checked rather than a suggested version to try. Where a fix crosses a major version boundary, the agent adds an AI-assisted analysis layer that examines how the repository uses the package and proposes the source code adaptations needed.

Legit said the dependency fix itself is verified by re-scanning, while the code adaptation for a major version jump is AI-assessed rather than independently verified. The pull request flags that distinction so developers know what warrants closer review before merging.