Jatayu
Jatayu takes on the security upgrade that every team puts off.
Core trick
Runs tests and an exploit in a sandbox before and after an Argon-written upgrade, trusting only raw JUnit and exit-code artifacts.
Description
Jatayu takes on the security upgrade that every team puts off. When a framework reaches end of life, it stops getting security fixes. The fix is a major-version upgrade that touches every file, so it sits in the backlog while the app stays exposed.
Fleet scans repositories and flags every app on an unsupported framework or runtime, with file:line evidence from endoflife.date data. For each app it picks, Jatayu:
runs the baseline tests and a security exploit in an Antigravity sandbox;
has Gemini 4 Argon rewrite every affected file in one long-decode response;
re-runs the tests and the exploit in a fresh sandbox.
Every result comes from raw sandbox artifacts (JUnit, exit codes, probe output) downloaded through the Files API, never from the model’s own summary. Jatayu also rejects patches that weaken tests and checks that its harness files come back byte-for-byte. Nothing reaches GitHub until a human approves the exact patch, bound by its SHA-256.
Results from today’s runs:
Django 4.2 → 5.2: 25/25 tests passed before and after. The CVE-2026-87975 exploit went from succeeding to blocked.
Language-agnostic (expressjs/cors), Express 4.21.2 → 5.3.0: 49/49 tests passed before and after, with the worktree verified. This run used a recipe-driven harness
README excerpt
# Jatayu **Find applications running on frameworks that no longer receive security fixes, upgrade them with Gemini 4 Argon, verify the result in a sandbox, and publish only with human approval.** Django 4.2 stopped receiving security patches on April 7, 2026. Every framework reaches the same point, and the fix is always the upgrade that touches every file. Jatayu turns that backlog item into a reviewable, evidence-backed change. | Capability | What it does | Status | |---|---|---| | **Fleet** | Reads dependency manifests and lock files across repositories and ranks every end-of-life framework and runtime, with file and line evidence | Available | | **Upgrade engine** | Gemini 4 Argon reads the whole repository plus the official upgrade notes in one context and writes every changed file in a single long-decode response | Verified end to end on Django 4.2 → 5.2 | | **Verification** | An Antigravity managed agent runs a controller-owned harness; Jatayu downloads the raw JUnit XML, logs, exit codes and probe output through the Files API and builds the report from those bytes only | Working; see results below | | **Review and approval** | Evidence, blockers and the patch SHA-256 on one page; nothing is published without explicit approval of that exact patch | Review implemented; PR publication disabled | ## Results Measured on 2026-10-25 against [jatayu-demo-app](https://github.com/Jainparas99/jatayu-demo-app) at commit `554e82b`, a small Django 4.2 application written for th