Just Old Wine in a New Bottle: Improving Vulnerability Repair Robustness to Combat Homologous but Heterogeneous Vulnerabilities

Collaborative development practices, such as forking and branching, enable parallel development and rapid iteration but significantly complicate vulnerability management. A major challenge is the propagation of homologous but heterogeneous vulnerabilities, where the same vulnerability appears within evolved code contexts that differ structurally and contextually across divergent branches or forks.Existing Automated Vulnerability Repair (AVR) approaches often fail in these scenarios due to their limited ability to generalize across structural and contextual variations. To address this problem, we propose EvoRepair, a robust AVR framework tailored for code evolution contexts. Our approach leverages a Retrieval-Augmented Generation based Evolution Specialist to synthesize code evolution variants, enriching the training data with diverse code contexts. We then employ Chain-of-Thought reasoning and curriculum learning to train a Repair Specialist, enabling it to capture invariant repair logic during structural and contextual changes. We evaluate EvoRepair on two datasets representing cross-branch and cross-fork scenarios. Evaluation results demonstrate that EvoRepair successfully repaired 35.33% of the vulnerabilities on average in evolution scenarios, outperforming the state-of-the-art baseline Vul-R2 by 42.12%. Furthermore, EvoRepair also demonstrates superior generalizability in non-evolution scenarios, achieving state-of-the-art performance on the PrimeVul dataset by fixing 25.75% of the vulnerabilities, surpassing the best baseline by 21.75%.