Introducing Evergreen: CVE Remediation Across Your Entire App

HeroDevs launched Evergreen today for application-wide CVE remediation. Evergreen continuously tracks the support status of every open source dependency in your application. When a CVE lands on a dependency that no longer gets upstream fixes, Evergreen delivers a CVE-free, drop-in replacement as a pull request, backed by a 14-day CVE SLA. Your team closes CVEs that used to require a major upgrade, and your engineers stay on the product roadmap.

The CVEs that stay open when there's no upstream fix

Most CVEs get resolved with a version bump. The ones that stay open, and take the most engineering effort, usually sit on a version that no longer gets upstream fixes (end-of-life).

Closing those CVEs means one of two things: a major upgrade, or a patch your team writes and maintains in-house. Either way, engineers come off the roadmap.

The problem is structural, not temporary. Sonatype’s 2026 State of the Software Supply Chain Report cites HeroDevs research finding more than 81,000 open source package versions already carrying a known CVE with no upstream fix path. And frontier AI models now make finding vulnerabilities fast and cheap, which pushes CVE volume past what engineering teams can work through one at a time.

How Evergreen works

With Evergreen, a CVE on an unsupported dependency stops being a new project and becomes a pull request to review and merge.

1. Install. Install the HeroDevs GitHub App, select the repositories that make up your application, and merge one GitHub Actions workflow.
2. Scan. Evergreen tracks your entire open source dependency tree, including packages that are healthy and supported today. Coverage begins when a package loses upstream support.
3. Secure. When a CVE lands on a dependency with no upstream fix, HeroDevs identifies an already-secured replacement or builds one.
4. Remediate. A pull request swaps the vulnerable dependency for the CVE-free, drop-in replacement, in your team's existing workflow.
5. Prove. Each remediation ships with a VEX (Vulnerability Exploitability eXchange) statement and a legal attestation.

At launch, Evergreen covers applications built using Java, JavaScript, and .NET, in and integrates with a number of source code management tools such as GitHub, Azure DevOps and more. 

HeroDevs patches every CVE on dependencies that no longer get upstream fixes, not just CVEs with an upstream fix to backport. HeroDevs keeps patching the drop-in replacement as new CVEs land. Your team stays secure on the versions it uses, across the entire application, and can migrate off that open source when it chooses to, not when a CVE forces the move.

What Evergreen means for AppSec and compliance teams

For AppSec and compliance teams, a CVE on a version that no longer gets upstream fixes is a finding that stays open. Each one is persistent risk in production that AppSec answers for but can't close alone.

Evergreen works alongside the security scanners you already run. Scanners keep reporting CVEs as they do today. Evergreen continuously tracks the health of open source dependencies across the entire application and automatically ships a CVE-free drop-in replacement delivers a CVE-free, drop-in replacement that closes the finding.

Every replacement arrives with a VEX statement and a legal attestation. That's evidence AppSec and compliance teams can hand to auditors for frameworks such as FedRAMP, PCI, SOC 2, HIPAA and the EU Cyber Resilience Act (CRA).

Why CVE remediation belongs at the application level

Aaron Mitchell, CEO of HeroDevs, explains why Evergreen moves remediation from single CVEs to the whole application:

“AI has made finding vulnerabilities fast and cheap, but what we still see is remediation happening one CVE at a time. That approach worked when CVEs arrived at a pace teams could keep up with. At more than 260 new CVEs a day, every CVE handled on its own is another project that pulls engineers off the roadmap. We built Evergreen on a new premise: customers should be able to secure their entire application, not just one CVE at a time. For the engineering team, what used to be a new project becomes a pull request to review and merge.”

More than 1,000 organizations, including half of the Fortune 100, already rely on HeroDevs for CVE remediation in the open source libraries their applications depend on. Evergreen extends that same remediation from individual libraries to the entire dependency tree. Every replacement is reviewed and tested by open source maintainers, including the original maintainers of widely used frameworks.

Get started with Evergreen

Evergreen is available today. Watch this video to learn more about Evergreen or contact us to schedule a demo.