This paper presents the experience and lessons learned in adapting the AutoCodeRover program improvement agent to automatically propose patches for issues reported by SonarQube, and names this new agent SonarQube Remediation Agent, specialized for fixing SonarQube issues.
Abstract
Agentic systems have been gaining traction in solving software engineering tasks. These tasks span from writing documentation, fixing faults in the codebase, and developing new features. A promising application of LLM agents is addressing software "issues", with an issue capturing a unit of improvement needed in a software project. Issues can be detected and constructed by static analysis tools, such as SonarQube. Static analysis tools frequently generate a substantial number of reports related to security vulnerabilities and code quality, imposing a significant manual workload on developers. With the advances in agentic AI, there is potential to automatically remediate these issues, thereby reducing developer effort. In this paper, we present our experience and lessons learned in adapting the AutoCodeRover program improvement agent to automatically propose patches for issues reported by SonarQube. We name this new agent SonarQube Remediation Agent, specialized for fixing SonarQube issues. SonarQube Remediation Agent is designed to be capable of interacting with mission-critical codebases in a secure and trustworthy manner. We discuss our approach in tackling practical challenges such as handling large volumes of issues and designing seamless user interactions. SonarQube Remediation Agent is integrated into the software development lifecycle by suggesting patches during the pull request review workflow, enabling developers to efficiently improve software quality and security with SonarQube.
Across three COBOL-Java case studies, spanning two open-source programs and one internal production-like COBOL program and ranging from 430 to 4,114 source lines, Locksmith consistently improved coverage beyond input-search plateaus, reaching nearly complete coverage on the two open-source programs and 91.90% branch coverage on the internal production-like COBOL program.
Andras Ferenczi, Jordan Docherty, M.D. Bessonov et al.· arXiv.org· 0 citations
ADATracer is presented, a software traceability tool designed to recover links between natural language requirements, Ada source files, version-control commits, and issue-tracking artifacts, and an Ada-aware parser that accounts for language features such as package specifications, bodies, and strong typing.
Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report. Recent agentic AI approaches have shown promising results in automated program repair. However, vulnerability repair demands richer program context than general bug repair - context that security engineers routinely assemble in practice but that existing agentic approaches do not engineer. We identify three critical gaps: code-structure context capturing cross-file data flows and memory operation patterns, runtime-execution context revealing crash semantics and memory origins, and commit-history context recovering how fragile code patterns were introduced. We present AgenticRepair, an agentic vulnerability repair framework that addresses the gaps through multi-faceted program context engineering. AgenticRepair orchestrates three specialized LLM subagents to engineer the contexts, which are then embedded into the memory of a dedicated repair subagent for context-conditioned patch synthesis. Evaluated on SEC-Bench comprising 300 real-world instances with sanitizer-based patch verification, AgenticRepair achieves a 73% success rate, substantially outperforming the strongest baseline by 29%. Our ablation study confirms that the three context facets are mutually complementary, and that multi-agent scaffolding and base-model capacity each play an essential role. Collectively, these findings establish multi-faceted program context engineering as a promising design direction for agentic vulnerability repair.
Michael Fu, Qiyue Mei, Patanamon Thongtanunam et al.· 0 citations
The AgentCodeReview system is presented, a multi-agent system that is able to conduct explainable code review and automated bug repair by leveraging software engineering agents with different code review tasks and its utility and extensibility to the field of explainable AI in software quality assurance are demonstrated.
B. N, T. L. Manasa· International journal of com...· 0 citations
Developing a GenAI agent that autonomously formulates, prioritizes, and completes a limited set of code improvement tasks enterprise-wide is reported, and a Difference-in-Differences analysis found that automated improvements had an effect on the reduction of future maintenance effort that was as strong as or stronger than manual improvements confirming the feasibility of autonomous maintenance.
It is found that a good bug report for an agent overlaps with, but is not identical to, a good report for a human: agents benefit most from concrete, executable, and well-localized information, whereas some qualities long emphasized for human readers, such as natural language steps to reproduce and readable descriptions, contribute little or even correlate with lower success.
Lara Khatib, N. Mathews, M. Nagappan et al.· arXiv.org· 2 citations· ⚡1
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
