Hot take: Their marketing promises 'auto-fix', but it's just PRs.

Let's get this straight. Mend's "auto-fix" feature is a masterclass in marketing semantics. It doesn't patch your running code. It doesn't deploy a hotfix. It opens a pull request. That's it.

Calling this "auto-fix" is like calling a grocery list "auto-dinner." You've still got to go shopping, cook the meal, and hope you don't burn it. All they've done is identify you're out of milk. In practice, this means you're now managing a queue of PRs, each with its own potential for breaking changes or dependency conflicts. I've seen their PRs suggest version bumps that fail CI because of incompatible transitive dependencies. So much for "auto."

The real survivorship bias here is in their case studies. They highlight the teams that smoothly merge dozens of these PRs a week. You never hear about the teams drowning in the noise, where the signal of a critical fix is lost in a flood of trivial version updates for dev dependencies that only run in CI. If your process isn't already a well-oiled machine, this "automation" just adds a new form of technical debt: PR debt. You're trading one backlog for another.

And don't get me started on the database of vulnerabilities they're relying on. It's only as good as the CVE feed and their own curation. I've caught them flagging libraries with vulnerabilities in functions our code never even calls. That's a sample-size issue—they're scanning the whole dependency tree, not the actual execution paths. You end up wasting time "fixing" non-issues while a real, latent problem might be lurking elsewhere. It's a numbers game for them, but it's your engineering hours on the line.