Dependabot opens PRs. PatchWave merges them.

PatchWave is a GitHub app that automatically analyzes, fixes and merges your Dependabot PRs.

Sign up for free

25 free PRs every month.No credit card required.

Patch, the PatchWave mascot, surfing a wave

Meet Patch.

Patch is an agent that automatically analyzes, fixes and merges your Dependabot PRs.

Dependabot PRs
  • acme/checkout-web Bump lodash
  • acme/payments-api Bump jose
  • acme/notification-worker Bump debug
  • acme/notification-worker Bump semver
  • acme/checkout-web Bump postcss
  • acme/auth-service Bump @types/node
  • acme/internal-dashboard Bump vite

He's extremely good at his job.

Patch combines static analysis + AI to offer unparalleled price/performance.

Cost vs. performance. Patch sits on the frontier at low cost and high performance. A Staff engineer performs slightly better at far higher cost, on a log scale. A general coding agent costs more than Patch and performs worse.
Patch
Coding Agent
Staff Engineer

  • Patch

    Performance
    4.5 of 5
    Cost
    0.25 of 5
    • Strength: Best price/performance
    • Strength: Fully automated
    • Weakness: Only does dependency updates

  • Coding Agent

    Performance
    2 of 5
    Cost
    3 of 5
    • Strength: Tries its best
    • Weakness: Burns frontier tokens
    • Weakness: Needs babysitting

  • Staff Engineer

    Performance
    5 of 5
    Cost
    5 of 5
    • Strength: The best for risky upgrades
    • Weakness: Single threaded
    • Weakness: Time is better spent on business

Patch takes work off your plate.

Maintenance consumes 20-30% of engineering capacity every quarter. Most teams under budget. Patch helps.

What's it costing your team?

Run the free checkup

“Nobody plans to fall a year behind on updates. It happens one sprint at a time. We built PatchWave so teams don’t have to choose between shipping and keeping up.”

Donnie Flood, CEO

PatchWave keeps you in the loop.

The PatchWave inbox, grouping dependency PRs across repositories by the action they need.

Ship more product with less maintenance.

  • No more update toil

    Every update arrives analyzed, fixed or ready to merge.

  • CVEs without the fire drill

    When Security calls, the update is already analyzed, with any fix it needs ready.

  • Keeps up as the queue grows

    However many updates land, Patch keeps pace.

  • Seniors on the hard problems

    Risky upgrades reach them with the research already done.

Questions, answered.

Does PatchWave replace Dependabot or Renovate?

No. It works on top of the bot you already run, on the PRs it opens. During setup we help tune your config so it sends fewer, batched PRs. Dependabot is supported today; Renovate support is coming.

What access does PatchWave need?

PatchWave is a GitHub app you install into your organization. You decide what repositories to enable. The analysis and fix agents are on by default, so PatchWave analyzes Dependabot PRs and attempts a scoped change when an update breaks your checks. We never merge until you explicitly tell us to or set up an auto-merge policy.

What gets merged automatically?

Nothing until you turn on auto-merge. Then only updates that meet your policy and pass analysis. PatchWave never merges a change it wrote.

What happens when PatchWave isn't confident?

PatchWave provides engineers with analysis and labels the PR as needing review.

Can we check its judgment before enabling auto-merge?

Yes. PatchWave analyzes open PRs and shows its recommendations and evidence before you enable auto-merge.

How big a problem is this for us, really?

Run the free PatchWave Dependency Checkup to find out. It reports your open Dependabot PRs, unpatched CVEs, and the engineering hours they take. It only reads from GitHub, the report stays on your machine, and you don't need a PatchWave account.

Run the free Dependency Checkup ↗
How is PatchWave different from a general coding agent?

It's built for one job. Language-specific static analysis, tooling and evals made for dependency updates mean better calls at a fraction of the cost per update.

How does PatchWave protect our privacy and security?

PatchWave uses AI providers configured not to retain prompts or train on your code, including Amazon Bedrock and Fireworks.ai. We are currently in our SOC 2 audit period. Visit our trust center for details about our security practices and compliance progress.

Visit our trust center ↗
What does PatchWave cost?

Everyone gets 25 free dependency PRs every month. No credit card required. Paid plans start at $10 a month for 35 PRs total, including your 25 free PRs. All plans include analysis, fixing, and unlimited repositories and users. Choose up to 200 PRs a month, with volume discounts.

See pricing and plan details ↗
What counts as a dependency PR?

One dependency PR is a GitHub pull request created by Dependabot. A single pull request can contain one or more dependency updates: patch, minor, or major. We can help with Dependabot configuration to ensure you are grouping dependencies in an optimal price and performance way.

Wave goodbye to (most) dependency update work.

25 free PRs every month.

Sign up for free

No credit card required.

Not ready to install? Run the free Dependency Checkup first.