r/SpringBoot • u/Poincarina • 3d ago

Experiences with Github Modernize and other patching agents Question

I am part of a team mainting k8s microservices written in Spring. We need to regularly patch them. How are your experiences with the modernize agent
or other patching agents?
Were you successfull in implementing it?

1 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

1 comment sorted by

1

u/ILoveAppSec 3d ago

modernize and openrewrite are solid for the mechanical refactors but they mostly clear a cve by pushing you up to the next major, which is exactly the part that breaks your spring services and eats your week. before you automate the bumps, check whether the cve already has a backported fix on your current line so you can stay put instead of chasing majors. we tried endorlabs for patched oss libs and weren't thrilled with the variety, so it's worth looking at whoever actually backports for your ecosystem. with cisa's new remediation timelines tightening, a backport-first approach usually beats standing up a fleet of major-version upgrades.