Security fix: binary Bun lockfile

What it means

Returned by POST /orgs/{org}/code-security/deps/findings/{id}/autofix (Security fixes). No pull request was requested.

The same refusal is answered with the type security-fix-binary-lockfile from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-binary-lockfile until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• This repository uses bun.lockb, Bun’s binary lockfile, which only Bun itself can rewrite. Run bun install --save-text-lockfile once to switch to bun.lock (Bun 1.2 and later write it by default); security fixes work on bun.lock.

The response also carries "reason": "binary_lockfile".

What to do

The finding was read from bun.lockb, Bun’s binary lockfile. Only Bun can rewrite it, and fremforge never runs a repository’s tools for a security fix, so no pull request is opened.

Switch the repository to Bun’s text lockfile: run bun install --save-text-lockfile once and commit bun.lock (and delete bun.lockb). Bun 1.2 and later write bun.lock by default. Security fixes then work on bun.lock; see Supported ecosystems.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-binary-lockfile",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "binary_lockfile"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.