This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady.
Patch Pacer turns a JSONL export of security advisories or tickets into a short review queue. When a scanner, a vendor, and a teammate each describe the same issue, a reviewer should not have to start from three separate tickets. Patch Pacer runs an open-weight embedding model locally, groups likely duplicates, then orders the groups using only recorded severity, due date, and asset mapping.
The theme is Slow and Steady: let the computer do the repetitive sorting so a person can spend attention on the few decisions that matter. The program never claims that an issue is exploitable, that an asset is affected, or that a patch is complete.
The repository includes seven synthetic records. Two pairs carry the same CVE identifiers; another pair describes a sandbox build token in different words without a shared identifier. Running the command produces four review groups:
python patch_pacer.py example-advisories.jsonl --today 2026-10-21 --output digest.md
Wrote digest.md (4 review groups from 7 records)
The generated example digest lists the source records in each group, a transparent review score, and a reminder to verify matches before merging tickets. This is a small synthetic demonstration, not a measured claim about production time savings.
The MIT-licensed repository contains the CLI, example input, generated digest, and tests. It was started during the Week 3 challenge window.
BAAI/bge-small-en-v1.5 produces embeddings on the user's machine through FastEmbed and ONNX Runtime. Patch Pacer compares the vectors to suggest related records; a matching CVE ID is an additional exact signal. Complete-link clustering avoids joining a long chain of only loosely related records.
Review order is separate from the model. It is deterministic and uses the input severity, due date, and whether an asset is mapped. Five local tests check grouping, ranking, duplicate IDs, and safe rendering of source links. The example run also exercised the real model and produced the four-group digest.
Advisory exports can contain internal asset names and notes. After the first model download, this workflow runs without sending those records to a hosted inference API. The model weights are available to download, the grouping threshold is visible, and the model can be replaced if another language or domain needs a better fit. There is no per-record API charge.
The open approach also makes the limits visible: semantic similarity can miss duplicates or suggest a false match. A reviewer stays responsible for deciding whether two records refer to the same issue and what action to take.
In the included example, seven inputs become four review groups. That removes three repeated starting points for a human reviewer. I have not measured time saved on a real advisory queue, so the result is a demonstration of the workflow rather than a performance claim.
The project and this post were drafted by an AI coding agent. The example was run locally, and five tests passed before submission.