Skip to main content
Upgrade Guidance is in beta. Beta features are subject to change with continued internal benchmarking and customer feedback.
Upgrade Guidance analyzes Semgrep Supply Chain findings to determine whether a vulnerable dependency can be upgraded to a fixed version without breaking your code.

​
Enable Upgrade Guidance

Upgrade Guidance is available for JavaScript or Python projects on GitHub Cloud or GitLab Cloud.
1
Enable Semgrep Multimodal.
2
In Semgrep AppSec Platform, go to Settings > General > Supply Chain and turn on Upgrade Guidance.
3
Run a full Semgrep Supply Chain scan.
If your project uses a private registry, connect it to Semgrep so dependency resolution can complete.

​
Review Upgrade Guidance

1
In Semgrep AppSec Platform, go to Supply Chain.
2
Select a finding.
3
Review the upgrade information on the finding’s Details page.

​
Upgrade results

​
How Upgrade Guidance works

After each full Supply Chain scan, Semgrep analyzes eligible findings and labels them based on the available upgrade. To verify an upgrade, Semgrep runs the package manager’s dependency resolver against the project manifest. This allows Semgrep to:
  • Confirm that a fixed version can be installed.
  • Identify dependencies that must be upgraded together.
  • Detect code that might be affected by breaking changes.
The following chart illustrates the Upgrade Guidance workflow.

In this diagram, a finding with a fix available has a patched version that remediates the vulnerability. That is separate from the Safe to upgrade badge, which means the upgrade is unlikely to cause breaking changes in your code.

​
Why Upgrade Guidance might not appear

​
The dependency has no fixed version

Only findings with a fixed version are eligible for Upgrade Guidance. If no fixed version exists, the finding displays No patch available.

​
The manifest contains inaccessible private packages

Dependency resolution requires metadata for every package in the manifest. If Semgrep cannot access one of the private packages, it cannot verify the upgrade. This limitation applies to the entire manifest. One inaccessible private package can prevent Upgrade Guidance from appearing for other findings in the same manifest or lockfile, including findings involving public packages. To give Semgrep access, connect your private registry.

​
Remediate the finding

After reviewing the guidance, you can upgrade the dependency manually, create a Jira ticket, or set the finding’s triage status to To fix. To open a PR or MR instead, see Supply Chain Autofix. You do not need to wait for Upgrade Guidance analysis to finish before using Autofix.