{"slug": "patch-pacer-a-local-model-that-makes-a-noisy-patch-queue-smaller", "title": "Patch Pacer: a local model that makes a noisy patch queue smaller", "summary": "A developer built Patch Pacer, an MIT-licensed command-line tool that converts a JSONL export of security advisories or tickets into a shorter, ordered review queue. The tool runs the open-weight BAAI/bge-small-en-v1.5 embedding model locally via FastEmbed and ONNX Runtime, groups likely duplicates using complete-link clustering plus exact CVE ID matching, and ranks groups deterministically by severity, due date, and asset mapping. In a synthetic example, seven records collapsed into four review groups; the developer notes no time savings have been measured on a real advisory queue.", "body_md": "*This is a submission for the [Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady](https://dev.to/challenges/hacktoberfest-week3-2026-10-19).*\n\nPatch Pacer turns a JSONL export of security advisories or tickets into a short review queue. When a scanner, a vendor, and a teammate each describe the same issue, a reviewer should not have to start from three separate tickets. Patch Pacer runs an open-weight embedding model locally, groups likely duplicates, then orders the groups using only recorded severity, due date, and asset mapping.\n\nThe theme is *Slow and Steady*: let the computer do the repetitive sorting so a person can spend attention on the few decisions that matter. The program never claims that an issue is exploitable, that an asset is affected, or that a patch is complete.\n\nThe repository includes seven synthetic records. Two pairs carry the same CVE identifiers; another pair describes a sandbox build token in different words without a shared identifier. Running the command produces four review groups:\n\n```\npython patch_pacer.py example-advisories.jsonl --today 2026-10-21 --output digest.md\nWrote digest.md (4 review groups from 7 records)\n```\n\nThe generated [example digest](https://github.com/ye11oc4t/patch-pacer/blob/main/digest.md) lists the source records in each group, a transparent review score, and a reminder to verify matches before merging tickets. This is a small synthetic demonstration, not a measured claim about production time savings.\n\nThe [MIT-licensed repository](https://github.com/ye11oc4t/patch-pacer) contains the CLI, example input, generated digest, and tests. It was started during the Week 3 challenge window.\n\n[BAAI/bge-small-en-v1.5](https://huggingface.co/BAAI/bge-small-en-v1.5) produces embeddings on the user's machine through [FastEmbed](https://github.com/qdrant/fastembed) and ONNX Runtime. Patch Pacer compares the vectors to suggest related records; a matching CVE ID is an additional exact signal. Complete-link clustering avoids joining a long chain of only loosely related records.\n\nReview order is separate from the model. It is deterministic and uses the input severity, due date, and whether an asset is mapped. Five local tests check grouping, ranking, duplicate IDs, and safe rendering of source links. The example run also exercised the real model and produced the four-group digest.\n\nAdvisory exports can contain internal asset names and notes. After the first model download, this workflow runs without sending those records to a hosted inference API. The model weights are available to download, the grouping threshold is visible, and the model can be replaced if another language or domain needs a better fit. There is no per-record API charge.\n\nThe open approach also makes the limits visible: semantic similarity can miss duplicates or suggest a false match. A reviewer stays responsible for deciding whether two records refer to the same issue and what action to take.\n\nIn the included example, seven inputs become four review groups. That removes three repeated starting points for a human reviewer. I have not measured time saved on a real advisory queue, so the result is a demonstration of the workflow rather than a performance claim.\n\n*The project and this post were drafted by an AI coding agent. The example was run locally, and five tests passed before submission.*", "url": "https://wpnews.pro/news/patch-pacer-a-local-model-that-makes-a-noisy-patch-queue-smaller", "canonical_source": "https://dev.to/ye11oc4t/patch-pacer-a-local-model-that-makes-a-noisy-patch-queue-smaller-4lbc", "published_at": "2026-10-20 15:40:32+00:00", "updated_at": "2026-10-20 15:49:06.161398+00:00", "lang": "en", "topics": ["artificial-intelligence", "machine-learning", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Patch Pacer", "BAAI/bge-small-en-v1.5", "FastEmbed", "Qdrant", "ONNX Runtime", "Hacktoberfest Open-Source AI Challenge"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/patch-pacer-a-local-model-that-makes-a-noisy-patch-queue-smaller", "markdown": "https://wpnews.pro/news/patch-pacer-a-local-model-that-makes-a-noisy-patch-queue-smaller.md", "text": "https://wpnews.pro/news/patch-pacer-a-local-model-that-makes-a-noisy-patch-queue-smaller.txt", "jsonld": "https://wpnews.pro/news/patch-pacer-a-local-model-that-makes-a-noisy-patch-queue-smaller.jsonld"}}