LegacyFixer

Automated Python dependency security, without PR noise

LegacyFixer scans selected Python repositories, records dependency-security results, and creates review-ready pull requests only when repository settings explicitly allow it.

Service status: LegacyFixer is temporarily unavailable while the service is paused for maintenance. The public demo snapshot and technical guides remain available.

Review demo snapshot

Passive by default

Start with scan results only. No code changes are made during the recommended first onboarding run.

Review-ready PRs

When enabled, fixes are proposed through isolated branches and pull requests for human review.

Repository-level control

Each repository controls whether PR creation is enabled and how many LegacyFixer PRs can be open.

Start free trial

LegacyFixer is available as a self-service GitHub App for selected Python repositories. Start with GitHub, connect repositories, and run passive dependency-security scans during a 7-day trial.

Start with Sign in with GitHub. During trial, you can connect up to 3 repositories. Passive scans are available first; pull requests are created only when repository settings explicitly allow them.

You can remove access at any time from GitHub settings by uninstalling the GitHub App or changing repository access.

  1. Sign in with GitHubCreate your workspace and connect selected Python repositories.
  2. Run passive scans firstThe first scan records findings without opening a pull request.
  3. Enable PRs deliberatelyPull request creation is optional and controlled per repository.

Current validated coverage

Dependency layouts

  • requirements.txt
  • nested requirements.txt
  • poetry.lock
  • Pipfile.lock
  • setup.cfg install_requires

Behavioral cases

  • passive findings
  • dependency conflict
  • dependency hell
  • PR diff granularity
  • no PR in passive mode

Best first fit: a small or medium public repository that is not production-sensitive.

Review the demo snapshot

Review a previously validated passive LegacyFixer scan snapshot. The live read-only status page is unavailable while the service is paused. This snapshot shows the recommended first onboarding path: scan, record findings, and avoid pull request creation until the result is reviewed.

Previously validated passive scan Successful scan with findings and no PR opened

Demo scan snapshot

Trigger
webhook
Status
success
Result
NO_ACTION
Reason
passive_findings
PR opened
no
Run time
21s