Azure DevOps Agentic Autofix Now Fixes Dependency Vulnerabilities

Dependency scanners tell a team which package is vulnerable, then leave someone to write the upgrade, check compatibility and open the pull request. Microsoft’s Agentic Autofix for Azure DevOps now writes that change too, using the Copilot coding agent and the repository’s own instructions. For platform teams that run GitHub Advanced Security for Azure DevOps, it moves Autofix from a narrow set of CodeQL rules to dependency alerts and third-party scanners, with a human still deciding what merges.

What Happened

Microsoft’s announcement describes three changes to Copilot Autofix in GitHub Advanced Security for Azure DevOps:

• An agentic foundation. Autofix uses the Copilot coding agent to explore repository context, then reviews and refines its proposed change before returning it.
• Beyond CodeQL. Autofix previously generated fixes only for a scoped set of CodeQL rules. It now accepts code scanning alerts from other tools.
• Dependency fixes. On a supported dependency alert, Generate fix can open a pull request with a suggested change and an explanation.

The agent can also read custom instructions and skills in supported .github or .agents locations. Microsoft’s examples are an instruction pointing the agent to an approved input-validation helper, and a skill describing the team’s package-update procedure and compatibility checks.

Why It Matters

Triage gets better data too. Advanced Security now shows the EPSS percentile for dependency alerts when data exists, which ranks predicted exploitation likelihood. Microsoft is careful to note it isn’t the probability that someone will attack the application. Development dependency detection separates dev-only packages from runtime ones, so a team can filter to runtime dependencies with a high EPSS percentile before spending effort.

Cost and control are spelled out. Generating fixes consumes AI credits, and enabling Autofix doesn’t generate fixes automatically; someone selects individual alerts. Not every request produces a fix, and Microsoft says every suggestion should be reviewed, built and tested before merging.

What This Means for Platform Teams

The instructions and skills hook is where platform teams add value. A shared skill that encodes how the organization upgrades packages, and which helpers to use, turns Autofix from a generic patch generator into something closer to the team’s own standards. Stack Archive covered a similar push to give agents repository context in Cursor and Chainguard’s supply chain work.

Rollout is staged. Agentic Autofix reaches organizations in the limited public preview over the next two to three weeks, with public preview in November. It can be enabled at the organization, project or repository level with a single button for both dependency and code scanning alerts, and teams then pick individual alerts at the repository level. Microsoft’s documentation on Copilot Autofix for code security alerts covers setup.

Source: Azure DevOps Blog

Content created with AI assistance and reviewed for accuracy.