一句话：提出 Remedius，用 LLM 智能体结合 SMT 优化统一依赖升级与补丁移植，修复 Maven 项目依赖漏洞。
开源依赖漏洞修复是软件供应链安全的关键，但现有自动化方法几乎只做依赖升级，受制于安全版本是否可得、版本锁定与 API 不兼容。本文提出 Remedius：一个面向 Maven 项目的 agent 驱动修复框架，将依赖升级与补丁移植统一到整体优化流程中。它按使用方式动态聚类依赖，由 LLM 驱动的自主 agent 采集项目特定证据，把兼容性、可达性与补丁难度等上下文因素转化为 SMT 可解约束，从而在漏洞级别而非依赖级别做成本感知决策，兼顾漏洞覆盖率、构建正确性与运行时兼容性。在 301 个真实 Maven 项目上的评估表明，Remedius 修复的漏洞数最多、构建与测试失败最少，优于当前最优基线。
Remediating vulnerabilities in open-source software (OSS) dependencies is vital to maintaining software supply chain security. However, current automated approaches almost exclusively rely on dependency upgrades, which is limited by the nature of upgrades, i.e., the availability of secure versions, version pinning, and API incompatibilities. To address the limitation, this paper presents Remedius, an agent-based remediation framework for Maven projects that unifies dependency upgrading and patch porting within a holistic optimization workflow. Remedius dynamically clusters dependencies by usage, gathers project-specific evidence through autonomous LLM-driven agents, and formulates a cost-aware remediation optimization problem solved via Satisfiability Modulo Theory (SMT). The agents translate complex contextual factors—such as compatibility, reachability, and patch difficulty—into solver-ready constraints, enabling flexible and scalable decision-making beyond what static rules or LLM reasoning alone can achieve. By redefining optimization at the vulnerability level rather than the dependency level, Remedius maximizes vulnerability coverage while preserving build correctness and runtime compatibility. An evaluation of 301 real-world Maven projects demonstrates that Remedius outperforms state-of-the-art baselines, achieving the highest number of vulnerabilities fixed and the fewest build or test failures. These results highlight a new direction for automated OSS remediation beyond upgrade-only solutions toward adaptive, agent-driven vulnerability management.
@article{paperbot12088,
title = {Agent-Based Automated Remediation for Vulnerabilities in Maven Projects},
author = {Lyuye Zhang and He Ye and Federica Sarro and Yuqiang Sun and Yang Liu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA2},
year = {2026},
doi = {10.1145/3839495}
}