Automate the security work after an advisory
Konvu is a Renovate alternative for vulnerability remediation. It takes findings from your existing scanners, proves which are exploitable in your environment, and prepares tested fix PRs. It handles the security investigation and the code changes an upgrade requires, so engineers can review a fix instead of starting that work themselves.
Renovate's presets, grouping and schedules control dependency maintenance. Konvu takes over security remediation when configuring the update queue still leaves your team investigating advisories and repairing upgrades. See the fix workflow.
Automate the investigation behind the security upgrade
An advisory identifies an affected package version. Konvu checks whether the vulnerability can be used in your application: the runtime, configuration, code path and attacker-controlled input. Each verdict keeps the evidence that decided it.
On our own repositories in Q3 2026, 10 of 384 Dependabot alerts were assessed as exploitable. The quarterly analysis shows the findings and their context. It is the work behind deciding which upgrades belong in the security fix queue.
Grouping and scheduling make an update queue easier to manage. Exploitability analysis determines what an attacker can use in this deployment. Konvu carries that investigation into the remediation plan and PR.
Repair the changes the upgrade requires
A vulnerable transitive dependency may require upgrading its parent. That parent can introduce breaking changes in application code. Konvu resolves the version constraints, checks the changelog, adapts affected call sites and runs your tests. Your team reviews and merges the resulting fix PR. How remediation works.
Self-hosted Renovate supports administrator-approved post-upgrade tasks, including migration commands and generated files. Your team supplies those commands. Konvu investigates the finding and works out the change the application needs as part of the fix workflow.
Compare the remediation work
| Work to complete | Renovate | Konvu |
|---|---|---|
| Select a security update | GitHub vulnerability alerts or optional OSV checks | Exploitability investigation on findings from connected scanners |
| Explain the decision | Advisory data and configured update rules | Evidence from code, configuration and attacker-controlled input |
| Handle breaking changes | Configured post-upgrade commands on self-hosted deployments | Resolve the upgrade path and repair affected call sites |
| Verify the fix | CI status checks and configurable automerge | Run your tests and prepare the fix PR for review |
| Cover other finding types | Dependency maintenance and security updates | Dependency and code findings from your existing scanners |
| Keep maintenance policy | Shared presets, package rules, custom managers and schedules | Konvu owns security remediation; Renovate can continue routine updates |
Sources: Renovate vulnerability alerts, OSV checks, post-upgrade tasks, Konvu product and remediation.
Use the scanners you already run
Konvu works from findings in your existing security tools. On GitHub, it can read Dependabot alerts even when Renovate manages version updates. It also handles findings from other supported scanners, including SAST findings in your own code.
A confirmed exploitable finding can get a fix PR. A false-positive verdict includes a reason your team can approve, with writeback where the scanner supports it. An inconclusive finding stays open. The investigation and remediation share the same evidence, so an engineer does not have to reconstruct the finding before reviewing the fix.
Move security fixes to Konvu
- Connect the repository and scanner that provide your vulnerability findings. On GitHub, leave Dependabot alerts enabled.
- Review Konvu's verdicts and evidence on your own backlog. For GitHub fix PRs, install the separate Konvu Autofix GitHub App. Automatic PRs are opt-in per repository.
- Assign one owner to security PRs for each repository and ecosystem. Adjust Renovate's vulnerability update rules for the scope Konvu takes over. Review routine updates that overlap a security upgrade.
- Keep the Renovate presets and custom managers you use for routine maintenance. Your team reviews and merges Konvu's security fixes.
There is no native Renovate connector or automatic coordination between PR queues. Konvu imports scanner findings and opens its own fixes. Check repository and ecosystem coverage during the trial; pricing lists cloud and self-managed SCM support.
Evaluate the engineering work Konvu takes over
Use findings your team has already spent time investigating, including upgrades that need application changes. Review the verdict, the proposed change and the tests together. That gives you a comparison against the work an engineer currently does after an update bot opens a PR.
Business starts at $2,000 a month with 400 confident verdicts and includes auto-fix PRs. Inconclusive runs and failed fix attempts are free. Enterprise adds self-hosted analysis and governance options. See pricing or start a free trial.
Related comparisons
- Dependabot vs Renovate: Configuration, ecosystems and platform support.
- Konvu vs Dependabot: From scanner alert to exploitability verdict and tested fix PR.
- Automated remediation: The upgrade path, code changes, tests and review controls.