Dependencies and advisories
Exact versions from your lockfiles, direct and transitive, matched against public advisories and re-checked daily.
Dependency findings here come from lockfiles, not from manifest ranges. What matters is the version that will actually be installed, including the transitive one four levels down that nothing in your package.json mentions.
- Direct and transitive packages are both resolved and stored per repository.
- Versions are matched against public advisories, with the identifier and the fixed version.
- When a new advisory lands, the applications it affects are targeted for re-evaluation the same day rather than at the next scan.
- A dependency finding tells you the upgrade that clears it, and whether the upgrade is a major one.
A vulnerability in a code path your application never calls is still worth fixing, but it is not an emergency. Severity reflects what we can establish; when we cannot tell whether the path is reachable, the finding says so.
Questions
Which lockfiles do you read?
The JavaScript ecosystem ones - npm, pnpm and yarn. If your repository has no lockfile, the dependency step reports itself as skipped.
How quickly do you notice a new advisory?
Advisory re-evaluation runs daily for affected applications, so within a day of the advisory being published.
Do you open upgrade pull requests automatically?
Not automatically. Fix with AI can prepare the change and open it as a draft when you ask for it on a specific finding.
Something here wrong, missing or out of date? Tell us and we will fix the page.