Compass 0.9.0: Patches from the CVE feeds, and one inbox

One inbox

Everything that needs you is one list: a parked decoy response, a grant to accept, a pull request with a revision, a failed job, an access finding, an available update. Each tab shows its count, the total beside the brand opens the whole feed, and every item carries its action: Run, Accept, Retry, Arm, Approve, Acknowledge. Nothing is stored or marked read; an item leaves when the state changes.

compass inbox

The map knows what runs where

Every workload carries what it is made of, as package URLs: the image of each container, resolved to its digest; a Lambda's runtime and layers; an instance's AMI and, with SSM Inventory on, its packages. Repositories are read fully: Dockerfiles, manifests and lockfiles for composer, npm, pip, go, cargo and more, serverless and SAM, Terraform. Each workload says whether it faces the internet, and how.

The CVE feeds, without a key

The new Patches captain follows the feeds every hour: OSV, asked by the purls on your map; cvelistV5 for the products you run; CISA's KEV and FIRST's EPSS for the scores; the Ubuntu, Debian, Alpine and Amazon Linux trackers for the fixed package versions; Packagist and npm at the source. Advisories merge on the CVE id, and one source failing never stops the others.

compass patch feed

Findings and the policy

Every fifteen minutes the advisories are held against the map in each ecosystem's own version order. A finding names the advisory, the package, the fixed version, the file and the workloads that run it. When a CVE is exploited, likely to be, severe, or your workload is exposed, and the fix is a plain bump, the pull request opens without a click; otherwise the finding waits in the inbox and one click approves it.

compass patch findings

The fix pull requests

One pull request per repository with every fix it needs: a docker-library tag, an apt or apk pin, a layer version, a dependency's constraint, each moved to the version the advisory names. The body carries the findings, the changes, how it was verified and how to roll back. The PR watcher keeps it alive, and the findings follow it from open to merged to deployed, when a scan sees the new version running.

compass patch pr

Verified before you merge

Three checks on each fix: your CI, through the PR watcher's checks; the image build, through the repository's own workflow or a minimal compass-build.yml the pull request adds; and a canary, when you grant it: the new image runs on a named staging twin for a few minutes, is probed and compared, then rolled back. The result is a comment on the pull request.

patch.canary_deploy

Lockfiles follow the manifest

When a fix moves a manifest with a lockfile beside it, the pull request adds compass-lockfile.yml: the ecosystem's own tool regenerates the lockfile on the branch, in your CI, and commits it as Compass. Set patch.lockfiles to manifest-only to keep that step for yourself.

patch.lockfiles: "manifest-only"

From the terminal and your agent

compass patch findings, pr, ignore and feed; compass inbox, inbox act and inbox snooze; the same as MCP tools for a coding agent, with two plugin skills. compass status prints a Patches line and the Needs-you line.

compass inbox act <id>