Built on Nebius Token Factory + NVIDIA Nemotron

Dependabot bumps the version. Rivet makes the upgrade work.

One upgrade, verified: detect the advisory, research the breaking changes, plan the fix, and iterate in a Token Factory Sandbox until your tests pass. At most one draft PR, or an honest no.

Start Building

> /rivet upgrade pyjwt

Comment it on any GitHub issue. No package to install.

acme/ticketdesk#1rivet/1-8b9221f4

pyjwt 1.7.1 → 2.13.01m 46s

Advisory targetGHSA-ffqj-6fqr-9h24

ORACLE EXECUTIONToken Factory Sandbox

FAILED test_create_and_list

FAILED test_link_roundtrip

FAILED test_peek_ignores_signature

18 failed, 2 passed

Verified diffsrc/ticketdesk/auth/links.py

- jwt.encode(payload, key, algorithm="HS256").decode("ascii")

+ jwt.encode(payload, key, algorithm="HS256")

- except jwt.ExpiredSignature:

+ except jwt.ExpiredSignatureError:

20 passed · re-audit clean, 0 advisories

EXIT 0

Draft PR #2 opened. Total cost: $0.1196.Verification complete

At most 1

Draft PR per issue

No PR spam, no broken builds

Never

Edits your tests

Tests must pass — they stay the frozen oracle

$0.12

Typical run cost

This run: $0.1196 in 1m 46s

Invented versions

Advisories and fixed versions come from OSV.dev

Architectural pipeline

Four bounded, reproducible phases.

Rivet does not touch your repo directly. Every phase runs against one sandbox checkpoint, with up to three retries before it gives up and says why.

01 / DETECT

Vulnerability mapping

Cross-references your lockfile against OSV.dev and the GitHub Advisory Database. Nothing is flagged without a real advisory ID and a fixed version.

OSV.dev & GHSA sync

02 / RESEARCH

Changelog extraction

Tavily Search finds the vendor changelog and migration notes; Tavily Extract reads the pages, so the fix follows real docs instead of a guess.

Tavily Search + Extract

03 / SANDBOX

Checkpoint and iterate

A Token Factory Sandbox checkpoints your repo, installs the bumped dependency (sandboxes keep network access for installs), and runs your test suite until it is green or the attempt gives up.

Token Factory Sandboxes

04 / REVIEW

Independent review

Nemotron Lightning writes the fix inside the sandbox loop; Nemotron Super reviews only the winning diff and checks it actually resolves the advisory before a PR opens.

Nemotron Super + Lightning

Stuck after a retry, the sandbox restores the checkpoint and tries again — up to three attempts per issue.

Empirical comparison

A version bump is not an upgrade.

Standard bump bots change one line in your lockfile and leave the breaking changes to you. Rivet reads the migration guide and fixes your code until the real test suite is green.

Standard bump bot (Dependabot / Renovate)CI red

Blind bump to the manifest, no verification of dependent API breaks. The regression research becomes your afternoon.

pyproject.toml

- pyjwt==1.7.1

+ pyjwt==2.13.0

CI failed after the bump

18 tests failed: test_create_and_list and 17 others, mostly AttributeError on renamed exceptions and a str that used to be bytes.

Rivet upgrade run1m 46s

Pre-flight reproduction, changelog research, and a sandbox loop that edits until the suite is green. Yields one pass-verified draft PR, or none.

src/ticketdesk/auth/links.py

- jwt.encode(payload, key, algorithm="HS256").decode("ascii")

+ jwt.encode(payload, key, algorithm="HS256")

- except jwt.ExpiredSignature:

+ except jwt.ExpiredSignatureError:

Sandbox attested: 20/20 tests passing

Re-audit clean, draft PR opened. Merge stays yours.

Draft PR #2, $0.1196, your turn to merge

Compute economics

Itemized run ledger

Real cost from the pyjwt upgrade run on this page. No token markups or hidden fees — Token Factory list prices, billed per call.

RIVET RUN LEDGER // 8b9221f4

acme/ticketdesk#1 (pyjwt 1.7.1 → 2.13.0)

Subsystem / operation	Detail	Cost (USD)
Nemotron Super	plan + review, 2 calls	$0.0098
Nemotron Lightning	fix loop, 4 calls	$0.0017
Token Factory Sandboxes	16 runs: checkpoint, bumps, tests, re-audit	$0.1081
Tavily	1 Search + 1 Extract, free tier	$0.00 (free tier)
Total run cost	1m 46s wall time	$0.1196

4 files changed, one green attempt, one draft PRToken Factory list prices: Lightning $0.06/$0.24, Super $0.30/$0.90 per 1M tokens

Start with one repo and one issue.

Connect your GitHub repository in less than sixty seconds. Comment /rivet upgrade on one advisory or breaking version bump, and read the verified sandbox log.

Create account Read the architectural spec