Security fix: no newer base fixes it

What it means

Returned by POST /orgs/{org}/code-security/images/findings/{id}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-image-no-base-fix from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-image-no-base-fix until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• No newer base image fixes this finding: fremforge scanned the newest base of the same line and the finding is still there.

The response also carries "reason": "image_no_base_fix".

What to do

The package came with the base image, but the newest base of the same line (same major version and tag shape), scanned by fremforge with the same vulnerability database, still has it, or there is no newer base. Wait for a fixed base, or move to another base by hand.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-image-no-base-fix",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "image_no_base_fix"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.