> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Supply Chain Autofix

> Open a pull request or merge request that upgrades a vulnerable dependency to a fixed version.

Supply Chain Autofix opens a PR or MR that upgrades a vulnerable dependency to a fixed version.

You choose when to use Autofix by selecting **Open Autofix PR** from a finding's **Fix** menu or by calling the API.

Supply Chain Autofix does not require Semgrep Multimodal or [Upgrade Guidance (beta)](/semgrep-supply-chain/upgrade-guidance). You can open an Autofix PR or MR even if Upgrade Guidance is disabled or has not finished running. When Upgrade Guidance analysis has completed, Semgrep can include that information in the PR or MR description.

## Prerequisites

To use Supply Chain Autofix, you must meet the following requirements:

* [Enable Semgrep Supply Chain scans](/semgrep-supply-chain/set-up-and-configure) and run a full scan on a connected repository.
* The finding has a fixed version to upgrade to.
* The project uses a supported ecosystem: JavaScript or Python.
* Semgrep needs **read and write** access to the repository so it can push a branch and open a PR or MR. See [Grant read and write access](/semgrep-appsec-platform/scm-code-access).
* If the dependency is in a private registry, [connect the registry to Semgrep](/kb/semgrep-supply-chain/connect-a-private-registry).

## Open an Autofix PR or MR

<Steps>
  <Step>
    In Semgrep AppSec Platform, go to [**Supply Chain**](https://semgrep.dev/orgs/-/supply-chain).
  </Step>

  <Step>
    Select a finding.
  </Step>

  <Step>
    Click **Fix** > **Open Autofix PR**.

    * If Autofix is unavailable, **Open Autofix PR** does not appear in the **Fix** menu, or Semgrep shows a modal with setup instructions instead of opening the PR.
  </Step>
</Steps>

Semgrep creates the branch and opens a PR or MR in the connected source code manager.

## What the PR or MR contains

The PR or MR always includes:

* Changes to the manifest or lockfile needed to upgrade the dependency.
* The dependency version Semgrep selected.
* A summary of the finding's severity and reachability.
* Details about the vulnerability and links to its CVE references.
* Relevant dependency release notes, changelogs, and commits.

If [Upgrade Guidance](/semgrep-supply-chain/upgrade-guidance) analysis has completed by the time you open the PR or MR, the description can also include affected files and functions and guidance on potential breaking changes. If analysis is still in progress or Upgrade Guidance is disabled, that information is not included.

For upgrade analysis without opening a PR or MR, see [Upgrade Guidance (beta)](/semgrep-supply-chain/upgrade-guidance).