> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Supply Chain Autofix

> Open a pull request or merge request that upgrades a vulnerable dependency to a fixed version.

Supply Chain Autofix opens a PR or MR that upgrades a vulnerable dependency to a fixed version.

You choose when to use Autofix by selecting **Open Autofix PR** on the finding’s **Details** page or by calling the API.

<Note>
  Supply Chain Autofix does not require Semgrep Multimodal or [Upgrade Guidance (beta)](/semgrep-supply-chain/upgrade-guidance). You can open an Autofix PR or MR even if Upgrade Guidance is disabled or has not finished running. When Upgrade Guidance analysis has completed, Semgrep can include that information in the PR or MR description.
</Note>

## Open an Autofix PR or MR

<Steps>
  <Step>
    In Semgrep AppSec Platform, go to [**Supply Chain**](https://semgrep.dev/orgs/-/supply-chain).
  </Step>

  <Step>
    Select a finding.
  </Step>

  <Step>
    Click **Fix** > **Open Autofix PR**.

    * If Autofix is unavailable, **Open Autofix PR** does not appear in the **Fix** menu, or Semgrep shows a modal with setup instructions instead of opening the PR. See [When Supply Chain Autofix is available](#when-supply-chain-autofix-is-available).
  </Step>
</Steps>

Semgrep creates the branch and opens a PR or MR in the connected source code manager.

## When Supply Chain Autofix is available

To use Supply Chain Autofix, you must meet the following requirements:

### Project requirements

* [Enable Semgrep Supply Chain scans](/semgrep-supply-chain/set-up-and-configure).
* Run a full scan on a connected repository.
* The project uses a supported ecosystem: JavaScript or Python.
* The finding has a fixed version to upgrade to.

### Repository requirements

* Semgrep needs **Contents: Read and write** access to the repository so it can push a branch and open a PR or MR. See [Grant read and write access](/semgrep-appsec-platform/scm-code-access).

### Environment-specific requirements

* If Semgrep connects to your SCM through the [Semgrep Network Broker](/semgrep-ci/network-broker), upgrade to Network Broker 0.45.2 or later and set `allowCodeAccess` to `true` for that SCM. This setting defaults to `false`. Older broker versions return a 403 allowlist error. See [Use Semgrep Network Broker with Autofix](/semgrep-ci/network-broker#use-semgrep-network-broker-with-autofix).
* If the dependency is in a private registry, [connect the registry to Semgrep](/kb/semgrep-supply-chain/connect-a-private-registry).

## What the PR or MR contains

### Always included

The PR or MR always includes:

* Changes to the manifest or lockfile needed to upgrade the dependency.
* The dependency version Semgrep selected.
* A summary of the finding's severity and reachability.
* Details about the vulnerability and links to its CVE references.
* Relevant dependency release notes, changelogs, and commits.

### Included when Upgrade Guidance is available

If [Upgrade Guidance](/semgrep-supply-chain/upgrade-guidance) analysis has completed by the time you open the PR or MR, the description can also include affected files and functions and guidance on potential breaking changes. If analysis is still in progress or Upgrade Guidance is disabled, that information is not included.

For upgrade analysis without opening a PR or MR, see [Upgrade Guidance (beta)](/semgrep-supply-chain/upgrade-guidance).

## Troubleshooting

If Autofix is unavailable, **Open Autofix PR** does not appear in the **Fix** menu, or Semgrep shows a modal with setup instructions instead of opening the PR.

* If **Open Autofix PR** does not appear, review the [project requirements](#project-requirements).
* If Semgrep shows a modal with setup instructions instead of opening the PR, review the [repository requirements](#repository-requirements) and [environment-specific requirements](#environment-specific-requirements).
* Common configuration issues include missing [**Contents: Read and write**](/semgrep-appsec-platform/scm-code-access) access, a Network Broker older than 0.45.2 or `allowCodeAccess` left at `false`, and a [private registry](/kb/semgrep-supply-chain/connect-a-private-registry) that is not connected to Semgrep.