More code, more upkeep.
Teams merge more code every quarter, and the dependency work that follows lands on senior engineers.
Maintenance is eating your roadmap. PatchWave gives it back.
PatchWave checks every dependency update against your code and fixes what breaks, so your engineers get back to shipping.
Join the public betaFree for 30 days, up to 100 PRs. No credit card.
Dependency PRs0/7assessed
- Criticalacme/checkout-web Bump lodash 4.17.20 → 4.17.21
- Mediumacme/payments-api Bump jose 4.15.4 → 4.15.9
- checks passacme/notification-worker Bump debug 4.3.4 → 4.3.6
- Highacme/notification-worker Bump semver 7.5.4 → 7.6.2
- Mediumacme/checkout-web Bump postcss 8.4.31 → 8.4.38
- checks passacme/auth-service Bump @types/node 20.11.0 → 20.14.2
- checks passacme/internal-dashboard Bump vite 5.2.8 → 6.0.0
Every quarter, maintenancetakes a bigger bite.
20 to 30% of engineering capacity goes to maintenance. Debt continues to accrue.
MaintenanceRoadmap
Faster exploits, less warning.
AI keeps getting better at finding and exploiting vulnerabilities. One critical CVE and the sprint goes sideways.
“Nobody plans to fall a year behind on updates. It happens one sprint at a time. We built PatchWave so teams don’t have to choose between shipping and keeping up.”
One place to see, judge and resolve every update.
PatchWave installs as a GitHub App on the repos you choose. You set the automation policy.
Scoped by repository
Install the GitHub App on one repo or all of them, and add more whenever you want.
One inbox across every repo
Every dependency PR in a single view, prioritized and grouped by the action needed.
Immediate visibility
See every open dependency PR and the action PatchWave recommends.
Dependabot tuning
We help tune your Dependabot config so it sends fewer, batched PRs.
Analysis on every PR
The analysis agent reads the changelog, runs language-specific static analysis, and checks vulnerability data and CI.
The report
What changed, what the risk is in your codebase, and what it takes to resolve. Every conclusion comes with its evidence.
Policy by change type
Rules for development versus production dependencies and for patch, minor and major versions.
Runs on read-only access
Analysis needs nothing more than read access to your repositories.
The fix agent
When an update fails the build, a separate agent patches the code to get CI green and updates the PR.
Merge orchestration
Updates merge in an order that accounts for what each one changes, and affected PRs are refreshed and checked again.
Breaks go back to the fix agent
Anything that breaks after a merge returns for another pass.
Auto-merge
Optional and off when you install. PatchWave never merges a change it wrote.
PatchWave does the work. You decide what merges.
Analysis and fixes start automatically. Auto-merge is off until you enable it, and PatchWave never merges a change it wrote.
AnalyzeFixMerge
Less maintenance.More product shipping.
Take dependency update toil off your engineers
Every update comes with evidence, a recommendation on merging, and the smallest code change that lands it.
Resolve critical CVEs without derailing the sprint
No fire drill. When Security calls, the update is already analyzed and any code change it needs is ready.
Handle more maintenance every quarter with less effort
However big the queue gets, PatchWave keeps up with it. Your team stays current on dependencies so less roadmap capacity goes to maintenance.
Put your most expensive engineers on the most valuable work
When dependency updates reach your senior people, the research is already done so each one takes a fraction of the time.
Purpose-built agents for software maintenance.
PatchWave uses separate agents for analysis and fixes. Across every update in every repo, that means lower token cost, less work for your team and a better outcome on average.
Performance
Cost
PatchWaveBest price / performance
General coding agentMore cost, less signal
Human reviewHigh cost
Cost
Cover every repo without spending frontier tokens on chores
A general agent costs tokens and someone’s attention on every update. PatchWave is built for this one job, so leave it on everywhere.
Signal
The digging is already done
Whether an update is safe depends on how it connects to your code. PatchWave’s static analysis traces it and gives the verdict.
Evidence
Every decision is checkable
A general agent sounds confident. PatchWave shows the evidence, laid out the same way on every update.
Questions, answered.
Does PatchWave replace Dependabot or Renovate?
No. It works on top of the bot you already run, on the PRs it opens. During setup we help tune your config so it sends fewer, batched PRs. Dependabot is supported today; Renovate support is coming.
What access does PatchWave need?
PatchWave is a GitHub app you install into your organization. You decide what repositories to enable. The analysis and fix agents are on by default, so PatchWave analyzes Dependabot PRs and attempts a scoped change when an update breaks your checks. We never merge until you explicitly tell us to or set up an auto-merge policy.
What gets merged automatically?
Nothing until you turn on auto-merge. Then only updates that meet your policy and pass analysis. PatchWave never merges a change it wrote.
What happens when PatchWave isn't confident?
PatchWave provides engineers with analysis and labels the PR as needing review.
Can we check its judgment before enabling auto-merge?
Yes. PatchWave analyzes open PRs and shows its recommendations and evidence before you enable auto-merge.
How is PatchWave different from a general coding agent?
It's built for one job. Language-specific static analysis, tooling and evals made for dependency updates mean better calls at a fraction of the cost per update.
How does PatchWave protect our privacy and security?
PatchWave uses AI providers configured not to retain prompts or train on your code, including Amazon Bedrock and Fireworks.ai. We are currently in our SOC 2 audit period. Visit our trust center for details about our security practices and compliance progress.
Visit our trust center ↗What does PatchWave cost?
PatchWave is free for 30 days, up to 100 dependency PRs. Your 30 days start when you install the GitHub App. After 30 days or 100 dependency PRs, whichever comes first, you can choose from subscription plans starting around $1 per PR, with a lower per-PR price at higher volumes. Nothing converts automatically, and nothing is billed during the beta. We’ll share final pricing before your beta period ends so you can decide whether to continue.
What counts as a dependency PR?
One dependency PR is a GitHub pull request created by Dependabot. A single pull request can contain one or more dependency updates: patch, minor, or major. We can help with Dependabot configuration to ensure you are grouping dependencies in an optimal price and performance way.
Wave goodbye to (most) dependency update work.
Free for 30 days, up to 100 PRs.
Enough for every update across your repos to come back analyzed and ready for a decision, while your team ships.
Join the public beta
The 30 days start when you install the GitHub App.