> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/triage-and-remediation/remediate/fix-pull-requests.md).

# Fix Pull Requests

Automatically generate pull requests that fix exploitable vulnerabilities, whether they come from a vulnerable dependency or your own code.

When Konvu confirms a vulnerability is exploitable, it can open a fix pull request that resolves it. You get one by accepting a [remediation plan](/konvu/triage-and-remediation/remediate/remediation-plans.md) on the **Remediate** page, or with **Generate PR** on an exploitable SAST finding. Fix pull requests handle two kinds of findings:

* **Dependency vulnerabilities (SCA):** Konvu upgrades the vulnerable dependency to a safe version.
* **Code vulnerabilities (SAST):** Konvu writes a targeted fix in your own code.

In both cases, Konvu handles the research, the fix, testing, and code review. You review and merge the PR.

<figure><img src="https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2Fyp8bIWVDxfBiuI53nRGC%2Fimage.png?alt=media&amp;token=59e865fc-59f5-4575-9643-373872b83ba4" alt=""><figcaption></figcaption></figure>

## Setup

Opening fix pull requests needs an integration with write access to your repositories. On GitHub, that is the **Konvu Autofix** GitHub App, separate from the main Konvu GitHub App used for source code analysis. The same app covers both dependency and code fixes. On GitLab, use a GitLab integration with write access.

To install the Konvu Autofix GitHub App:

1. Go to [**Integrations**](https://app.konvu.com/integrations)
2. Find the **Konvu Autofix** app and click **Install**
3. Select the GitHub organization and repositories you want to enable fix pull requests on
4. Grant the required permissions:
   * **CI checks**: read access (to watch test results)
   * **Pull requests**: read and write access (to create and update fix pull requests)

Once installed, fix pull requests are available for any exploitable finding in the connected repositories.

## How fix pull requests work

The pipeline depends on the type of finding.

### Dependency fixes

For a vulnerable dependency, generating a fix pull request runs a five-stage pipeline:

<table><thead><tr><th width="174.322265625">Stage</th><th>What happens</th></tr></thead><tbody><tr><td><strong>Research</strong></td><td>Konvu gathers vulnerability details from OSV, GitHub Advisory Database, and NVD to determine the fix version</td></tr><tr><td><strong>Analysis</strong></td><td>Konvu evaluates how the vulnerability affects your specific project, using the assessment data it already has</td></tr><tr><td><strong>Upgrade</strong></td><td>Konvu bumps the dependency to the safe version in your manifest file and regenerates the lockfile</td></tr><tr><td><strong>Test</strong></td><td>Konvu runs your test suite. If tests break due to the upgrade, it attempts to fix the breaking changes</td></tr><tr><td><strong>Review</strong></td><td>Konvu performs a code review of the changes and opens a pull request on your repository</td></tr></tbody></table>

### Code fixes

For a vulnerability in your own code, generating a fix pull request builds on the exploitability assessment Konvu produced during triage:

<table><thead><tr><th width="174.322265625">Stage</th><th>What happens</th></tr></thead><tbody><tr><td><strong>Analysis</strong></td><td>Konvu reads the finding and its assessment evidence, including the vulnerable data flow and the affected file and line</td></tr><tr><td><strong>Fix</strong></td><td>Konvu writes a targeted code change in the affected file to close the vulnerability</td></tr><tr><td><strong>Test</strong></td><td>Konvu runs your test suite. If the change breaks tests, it attempts to fix the breaking changes</td></tr><tr><td><strong>Review</strong></td><td>Konvu reviews the change, confirms the vulnerability is resolved, and opens a pull request on your repository</td></tr></tbody></table>

A code fix requires a completed assessment. You trigger it from an exploitable SAST finding; Konvu does not generate a fix pull request for findings it hasn't assessed.

Each fix runs in an isolated container, a fresh environment with no carryover between runs.

Konvu opens the pull request as a draft and leaves it in draft until your CI checks pass. The fix pull request shows why the finding matters, what changed, the diff, and the result of each CI check. When the pull request is merged or closed, the **Remediate** page updates on its own.

## Supported ecosystems

Dependency fixes support these package managers:

| Ecosystem   | Package managers | Manifest files                                      |
| ----------- | ---------------- | --------------------------------------------------- |
| JavaScript  | npm, Yarn, pnpm  | `package.json`                                      |
| Python      | pip, Poetry      | `requirements.txt`, `pyproject.toml`, `poetry.lock` |
| Java/Kotlin | Maven, Gradle    | `pom.xml`, `build.gradle`                           |
| Ruby        | Bundler          | `Gemfile`                                           |
| Rust        | Cargo            | `Cargo.toml`                                        |
| Go          | Go modules       | `go.mod`                                            |
| .NET        | NuGet            | `*.csproj`, `packages.config`                       |
| PHP         | Composer         | `composer.json`                                     |

Code fixes aren't tied to a package manager. You can trigger a fix on any SAST finding Konvu has assessed as exploitable, whichever scanner reported it. See [Bring In Findings](/konvu/get-started/bring-in-findings.md) for the scanners that feed SAST findings.

## What the PR contains

### Dependency fix pull requests

* **Dependency version bump** in the manifest file (e.g., `package.json`, `pom.xml`)
* **Regenerated lockfile** to match the updated dependency
* **Test fixes** if the upgrade caused test failures
* **PR description** with vulnerability context: the CVE or advisory, affected versions, and why the upgrade resolves the issue

<figure><img src="https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FA3SsMJ4irowcKeJXIZK9%2Fimage.png?alt=media&amp;token=01fb53fc-6aa8-43bf-9899-c0bc6596e933" alt=""><figcaption></figcaption></figure>

### Code fix pull requests

* **Code changes** in the affected file that close the vulnerability
* **Test fixes** if the change caused test failures
* **PR description** with the finding context: the vulnerability type, Konvu's exploitability assessment result, a link back to the finding, and what the fix changes

## Limitations

### Dependency fixes

* **Version bumps only.** For a dependency finding, Konvu upgrades the vulnerable dependency to a safe published version. It does not backport patches or apply workarounds.
* **No dependency overrides or pins.** Konvu does not use npm `resolutions`, Maven `dependencyManagement` forced versions, Go `replace` directives, or similar override mechanisms.
* **No pre-release or canary versions.** Konvu only upgrades to stable, published releases.
* **Supported ecosystems only.** Dependency fixes work with the package managers listed above. Other ecosystems are not supported.

### Code fixes

* **Requires a completed assessment.** Konvu generates a fix pull request only for SAST findings it has assessed as exploitable. Findings that haven't been triaged can't be fixed.
* **Targeted fixes only.** Each fix pull request addresses a single finding with a focused change. Konvu does not restructure surrounding code or fix issues beyond the reported vulnerability.

## Next steps

* [Remediation Plans](/konvu/triage-and-remediation/remediate/remediation-plans.md): review what a fix will change before Konvu opens the pull request
* [Fixes on Developer Pull Requests](/konvu/triage-and-remediation/remediate/fixes-on-developer-pull-requests.md): get dependency fixes committed to your developers' own pull requests
* [How Assessments Work](/konvu/triage-and-remediation/exploitability-assessment/how-assessments-work.md): understand how Konvu decides a finding is exploitable


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.konvu.com/konvu/triage-and-remediation/remediate/fix-pull-requests.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.