Automatic Dependency Updates
CodeStax can create dependency-fix pull requests on GitHub and Bitbucket Cloud, or merge requests on GitLab.com. When a finding has an exact, validated upgrade target, CodeStax edits one dependency manifest, creates a deterministic branch, and opens or reuses the matching provider request with the connected credential.
The current release saves update policy, runs update checks on demand, and creates eligible fix requests when a member explicitly chooses Create Fix PR. It does not run a background auto-update job or automatically merge provider requests.
Configuration
Open Dependencies (SCA) → Remediation → Auto-update for a repository:
| Toggle | Description | Default |
|---|---|---|
| Auto-Patch | Mark patch updates as eligible under the saved update policy | Off |
| Auto-Minor | Mark minor updates as eligible under the saved update policy | Off |
| Auto-Major | Mark major updates as eligible under the saved update policy | Off |
Run Update Check after an SCA scan to classify available updates using this policy. Provider permissions, manifest support, and target-version validation still apply when you create a fix request.
Merge Confidence Scoring
Each proposed update receives a confidence score from 0 to 100 that estimates the risk of merging the change. Merge confidence is calculated based on version change type, security impact, community adoption, and breaking change likelihood.
Confidence Levels
- High (80-100) — Low risk. Safe to merge with minimal review.
- Medium (50-79) — Moderate risk. Review changelog before merging.
- Low (0-49) — Higher risk. Thorough testing recommended before merge.
Creating a Fix PR
From the Dashboard
- Open Dependencies (SCA) → Remediation → Fixes, or open a vulnerability detail.
- Review the proposed version bump and merge confidence score.
- Click Create Fix PR.
- CodeStax creates a pull request on your repository with the updated manifest file.
What the PR Contains
- A branch named
codestax/fix-<package>-<version>with the manifest update applied - One supported manifest updated to the selected exact version
- A PR description summarizing the vulnerability fixed, the version change, and the confidence score
- The connected GitHub, GitLab.com, or Bitbucket Cloud credential must have permission to create branches, update repository content, and open a pull or merge request
Supported Manifests
| Manifest | Ecosystem |
|---|---|
package.json | npm, Yarn, pnpm |
requirements.txt, requirements.in, constraints.txt, Pipfile, pyproject.toml | Python |
pom.xml, build.gradle, build.gradle.kts | Maven and Gradle |
go.mod | Go modules |
Gemfile, gems.rb | Ruby |
composer.json | PHP Composer |
Cargo.toml | Rust Cargo |
When a finding points to a recognized lockfile, CodeStax resolves the companion editable manifest in the same directory-for example, apps/web/package-lock.json resolves to apps/web/package.json.
Permissions
Creating fix requests requires a connected repository with a valid provider credential and write access. The request is authored through that connected SCM identity. Organization admins and owners can configure auto-update settings; members can trigger eligible individual fix requests from the dashboard.