Snyk’s automated fix Pull Requests (PRs) are designed to automatically resolve security vulnerabilities found in your project’s dependencies.
Let’s see Snyk fix a vulnerability in a Node.js project. Imagine our package.json has an outdated and vulnerable version of lodash:
{
"name": "my-app",
"version": "1.0.0",
"dependencies": {
"lodash": "4.17.10"
}
}
Snyk scans this and finds a critical vulnerability in lodash version 4.17.10. Instead of just reporting it, Snyk can generate a PR.
First, Snyk identifies the vulnerable dependency and the specific CVE(s) affecting it. For lodash 4.17.10, it might be CVE-2020-28506, a prototype pollution vulnerability. Snyk’s vulnerability database maps this CVE to a safe version. In this case, lodash 4.17.21 is the first version that addresses this specific CVE.
Snyk then creates a new branch in your repository, for example, snyk-fix-lodash-4.17.10-036d5a. On this branch, it modifies your package.json to update lodash to the recommended safe version:
{
"name": "my-app",
"version": "1.0.0",
"dependencies": {
"lodash": "4.17.21"
}
}
Crucially, Snyk also updates your lock file (package-lock.json or yarn.lock) to reflect this change. This ensures deterministic builds. A package-lock.json might look like this after the update:
{
"name": "my-app",
"version": "1.0.0",
"dependencies": {
"lodash": {
"version": "4.17.21",
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
"integrity": "sha512-v2kDErB2p511p1/0p+d7cWExo+3c1z7p+2n/2z6fR77k17qFw2o9P8l1Yf/q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L7fV7q+L