Aikido Offers Backported Dependency Patches to Help Teams Meet Vulnerability SLAs
Summary
Aikido says its Libraries product backports upstream security fixes to existing dependency versions, with automated testing, human review and readable diffs, aiming to help teams remediate vulnerabilities without upgrading APIs.
Key points
- Aikido says each patch adapts a maintainer's upstream security fix to the dependency version in use; patches are automatically tested, reviewed by a person and provided as a readable diff.
- The article cites a 2026 Verizon report saying 26% of known exploited vulnerabilities were fully remediated in 2025, down from 38% in 2024, while median remediation time rose to 43 days.
- For example, Aikido's jsonwebtoken 8.5.1-aikido.5 backports fixes for CVE-2022-23529 from version 9.0.0 while retaining the older version's API.
- Aikido says its catalog covers more than 9,000 libraries across seven language ecosystems and that it ships 50–100 new patches daily.
- The company says enrolled repositories receive patches within 48 hours for known exploited vulnerabilities and within seven days for Critical and High CVEs.
- Aikido describes single-package fixes through its AutoFix menu and repository activation that pins dependencies and creates daily AutoFix pull requests for newly disclosed CVEs.
Article Details
- Event Type
- Promotional overview of Aikido Libraries, a service for providing patched versions of vulnerable dependencies.
- Impact
- Aikido says the service backports upstream security fixes to dependency versions without changing package names or public APIs, and provides tested patches for review. The article gives CVE-2022-23529 in jsonwebtoken 8.5.1 as an example; it also claims patches are delivered within 48 hours for known exploited vulnerabilities and within 7 days for Critical and High CVEs.