Security fix: added by the Dockerfile

What it means

Returned by POST /orgs/{org}/code-security/images/findings/{id}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-image-not-from-base from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-image-not-from-base until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• This package was added by the image’s own Dockerfile, not by its base image. A base bump does not fix it: rebuild the image so it installs the fixed version.

The response also carries "reason": "image_not_from_base".

What to do

The vulnerable package is in a layer your Dockerfile adds, not in the base image. A base bump does not fix it: rebuild the image so it installs the fixed version (the finding’s fixed_version).

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-image-not-from-base",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "image_not_from_base"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.