---
title: "How River takes security work from a fix to merge"
description: "Shopify’s River is an AI agent in Slack that manages dependency and first-party application vulnerability remediation beyond the patch. It validates ledger entries against repository, pull-request, and vulnerability-tracker state, checks whether findings remain active, and updates code on the repository head when it can do so safely. River regenerates lockfiles with repository tooling, repairs upgrade failures, discards stale CI results after rebases, and avoids overwriting human work. When product or risk judgment is required, it preserves evidence and hands owners a question, then verifies the repository head, dependency graph, tracker, and ledger after merge. In its 11 days, the dependency backlog fell about 70%, while security merges through the freshness-gated queue rose from about 10% to 80%."
---

# How River takes security work from a fix to merge

[Shopify](https://yomu.fyi/company/shopify) · 2023-10-18 · Sep 2, 2026

**Type:** Problem & solution

## Summary

Shopify’s River is an AI agent in Slack that manages dependency and first-party application vulnerability remediation beyond the patch. It validates ledger entries against repository, pull-request, and vulnerability-tracker state, checks whether findings remain active, and updates code on the repository head when it can do so safely. River regenerates lockfiles with repository tooling, repairs upgrade failures, discards stale CI results after rebases, and avoids overwriting human work. When product or risk judgment is required, it preserves evidence and hands owners a question, then verifies the repository head, dependency graph, tracker, and ledger after merge. In its 11 days, the dependency backlog fell about 70%, while security merges through the freshness-gated queue rose from about 10% to 80%.

## Context

Dependency upgrades and application vulnerability fixes can become stale while pull requests await review, and passing CI on a pull request does not prove that the vulnerability has been removed from the repository head. Engineers also had to shuttle state among code, CI, Slack, and the vulnerability tracker.

## Approach / What changed

River validates ledger entries against live repository, pull-request, and vulnerability-tracker state; confirms that findings remain active; rebases or drafts narrowly scoped fixes on the current repository head; preserves evidence during handoffs; and verifies the repository head, dependency graph, tracker, and ledger after merge.

## Takeaways

- River treats ledger entries as claims to reconcile rather than operational truth, checking current GitHub, repository, pull-request, and vulnerability-tracker state before acting.
- After a rebase or force-push, prior CI results are discarded because they apply to an earlier commit; River waits for results from the current head.
- A green pull request is not remediation until the change merges and the repository head, vulnerability record, and ledger agree that the vulnerable dependency or finding is resolved.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [CI/CD](https://yomu.fyi/topic/ci-cd), [Reliability](https://yomu.fyi/topic/reliability), [Security](https://yomu.fyi/topic/security)

- Source: [Shopify](https://shopify.engineering/river-vulnerability-remediation)
- Source URL: https://shopify.engineering/river-vulnerability-remediation
- Ingested by Yomu: 2026-09-04T00:00:52.477Z

[Read original post](https://shopify.engineering/river-vulnerability-remediation)