Bitbucket Rovo Dev Auto Closing Vulnerabilities

Quick Overview

Atlassian's Rovo Dev agent automatically resolves code vulnerabilities by creating, fixing, validating, and merging pull requests, resulting in saving over 1000 developer hours and reducing vulnerability resolution time by 50% across 1800 merged PRs in a three-month pilot.

Key Points: The Rovo Dev agent was launched to automatically resolve vulnerability (VULN) issues identified through Software Composition Analysis (SCA) scans in Bitbucket Cloud. The pilot program resulted in over 1000 developer hours saved and a 50% reduction in vulnerability resolution time over three months. The automation processed 1800 merged Pull Requests (PRs) that addressed vulnerabilities. The automated workflow starts with a Jira issue, utilizes Rovo Dev to clone the repository, confirm the vulnerability, gather context, fix the issue, validate, iterate, and finally prepare and raise the PR for review. The PR generated by Rovo Dev includes a comprehensive summary of changes, including dependency updates (e.g., upgrading Spring Framework dependencies) and updated CVE references. Verification steps confirm the vulnerability is no longer detected, the dependency tree is updated to fixed versions (e.g., Spring Framework core to 6.2.11), and all build pipelines passed successfully. The presentation concludes by encouraging users to try Rovo Dev, noting that more sophisticated agent features are planned for future launches.

Context: Ray Zhang, a Principal Machine Learning Engineer at Atlassian, presents a 'Bitbucket Blitz' session detailing the implementation and impact of the Rovo Dev agent for automatic vulnerability resolution. The context is addressing the overwhelming challenge of handling over 1000 new SCA issues per month, which previously consumed over 1000 developer hours monthly and took more than 10 days to resolve traditionally.

Detailed Analysis

The presentation details how Atlassian leveraged Rovo Dev to tackle the significant challenge of managing a massive backlog of security vulnerabilities identified via Software Composition Analysis (SCA), which historically consumed over 1000 developer hours per month and took over 10 days to resolve. The solution involves the Rovo Dev agent automating the entire remediation lifecycle triggered by a Jira issue. The process flow includes the agent cloning the repository, confirming the vulnerability using the same scanner, gathering context and requirements, fixing the issue via iteration (Fix, validate, iterate), performing final touch-ups, preparing the Pull Request (PR) with appropriate summaries and reviewers, and finally merging the fix. In a three-month pilot, this automation led to significant gains: 1800 vulnerabilities were resolved via merged PRs, saving over 1000 developer hours, and cutting the vulnerability resolution time by 50%. The PR generated by the bot is highly detailed, including summaries of dependency changes (like upgrading Spring Framework core from 6.2.10 to 6.2.11) and updated CVE references. Verification steps confirmed the fix, showing successful builds and verification trees confirming the removal of the vulnerability.