River Vulnerability Remediation

Shopify's River, an AI agent that works inside the company's chat system, follows vulnerability fixes through to evidence that the affected code has changed. Its security workflow account, published in September 2026, describes checking whether a finding still applies, updating stale patches and waiting for tests against the actual latest revision. Engineers retain responsibility for approvals and merges.

After a dependency fix merges, River checks that the default branch no longer resolves to the vulnerable version and reconciles the tracking records. That makes closure depend on the repository's state, beyond whether a proposed patch passes tests. The workflow builds on River's shared development environment, which gives the agent the same tooling and conventions as engineers.