LegacyFixer
Guides
Practical guidance for Python dependency security, dependency update workflows, and reducing pull request noise.
Technical guides
This section collects practical articles about maintaining Python dependencies safely and with less repository noise.
A live detect-only scan of urllib3 2.7.0 reported three separate security advisories, all with fix version 2.8.0; scan #231 created no pull request.
Detecting CVE-2026-111497 in Python Brotli: A Real LegacyFixer Security Scan
A live detect-only scan of Brotli 1.2.0 identified CVE-2026-111497, preserved two advisory references and the reported fix version 1.2.1, and created no pull request.
Detecting Vulnerable Python Dependencies: A Real NLTK Security Scan
A controlled 2026 NLTK security scan: 17 distinct advisory identifiers, recorded fix versions, and a separate audit of NLTK 3.10.4.
Python Environment Markers Can Hide Dependencies from Security Scans
A 2026 Dependabot case showing how marker parsing can drop valid dependencies before security analysis, plus a controlled LegacyFixer test of the same marker structure.