Root

Root provides automated vulnerability remediation for open-source software dependencies and container images. The platform patches vulnerabilities in application libraries and base images without requiring version upgrades or code changes. It operates by applying fixes directly to existing software versions, eliminating the need for developers to manually upgrade dependencies or rebase code. The system addresses vulnerabilities in npm packages and other open-source components at the point of disclosure, including Known Exploited Vulnerabilities (KEVs). Fixes are applied in parallel across thousands of dependencies while maintaining current software versions. Each remediation includes supporting documentation such as Software Bill of Materials (SBOM), Vulnerability Exploitability eXchange (VEX), provenance data, attestation, and complete code differentials. Root targets the gap between vulnerability disclosure and traditional patching workflows, particularly for application-level dependencies that teams often pin or defer updating due to breaking changes. The platform operates continuously, including during off-hours and holidays, without requiring manual intervention from development or security teams. It maintains compatibility with existing build and deployment pipelines.