Security fix: ecosystem not supported

What it means

Returned by POST /orgs/{org}/code-security/deps/findings/{id}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-ecosystem-not-supported from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-ecosystem-not-supported until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• Security fixes support npm (including Bun), Go, PyPI, Maven, Gradle, NuGet, Cargo, Composer, pub, RubyGems and Hex dependencies. This ecosystem is not supported yet.

The response also carries "reason": "ecosystem_not_supported".

What to do

Bump the dependency yourself, or let hosted Renovate open its own update. The ecosystems security fixes cover are listed on Supported ecosystems.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-ecosystem-not-supported",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "ecosystem_not_supported"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.