Security
Remediation runs
A remediation run takes a confirmed security alert, patches the dependency in a sandbox, verifies the project still builds, and opens a pull request for your team to review.
Choosing the mode and its thresholds is an admin task. Everyone else meets a remediation run as a pull request, and reviews it like any other.
#How a fix gets started
The Mode control on a repository's remediation settings decides who starts a run.
| Mode | What it does |
|---|---|
| Off | Confirmed exposures are reported and nothing is patched. |
| One-click | Create fix appears on a confirmed security alert. A run starts when someone chooses it. |
| Automatic | A run starts on its own once an exposure at or above the threshold is confirmed. |
One-click is where most teams start, because it puts a person between the confirmation and the pull request while you learn what the fixes look like.
In Automatic mode, Auto-fix threshold sets how severe an exposure has to be, with Medium+, High+ and Critical as the three settings, and Max open fix PRs caps how many a repository can have open at once.
#Watching a run
Remediation runs
Every fix inline has attempted — the sandbox patches a confirmed vulnerability, verifies it, and opens a PR for your review. Watch one live as it runs.
Pipeline
Activity
Remediation PR opened
PR #514 · PR open
Remediation runs lists every run with the package it is fixing, the repository, and where it has got to. Open one and the Pipeline card shows the eight phases in order, from Acquire sandbox through Apply fix and Verify to Open PR.
Activity fills in underneath as the run works, step by step, so a run that is taking a while tells you what it is doing. It updates live, which is worth watching the first few times to see how a fix is arrived at.
The chip on each row says the same thing in one word: Fix queued, Fixing…, PR open, Fix merged, Fix closed or Fix failed.
#What gets checked before the pull request
Verification decides how much the run proves before it opens anything, and the pull request body reports the results either way.
| Setting | What runs in the sandbox |
|---|---|
| None | The pull request opens without anything being run. |
| Build | Install, then build and typecheck. |
| Full | Install, lint, build and tests, and the run repairs the patch itself if something fails. |
Full is what makes an automatic mode restful, because a bump that breaks the build is dealt with in the sandbox rather than in your pull request queue.
#The pull request
A fix arrives as its own pull request, never as a commit onto a branch of yours. Fix from branch sets the base it is cut from, Open PR into sets the branch it targets, Branch naming follows your convention or takes a pattern you give it, and PR labels applies the labels your team files by.
From there it is an ordinary pull request: review it, ask for changes, merge it or close it. Closing one leaves the security alert open, so it comes back to the queue.
Remediation is included with Pro. See Plans and billing.