Observed arrival · 2026-10-15
VulnBump tests whether dependency fixes survive shipping
A Snyk benchmark compares AI-agent approaches to upgrading vulnerable dependencies across 307 upgrades in 43 real repositories.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Software-security and developer-tooling teams
- Worth noticing
- The benchmark covers 307 upgrades in 43 repositories, with one run per agent and filters for Maven, Gradle, npm, Yarn, pip, and Poetry.
Field notes
The page labels the project “VulnBump 1.0 draft” and presents the comparison as one run per agent. Its leaderboard offers filters for six package ecosystems, while links point to a methodology page, GitHub, and a whitepaper. The extracted homepage does not show the gate definitions or individual result rows, so those details cannot be checked from this evidence alone.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
One card from the complete issue