Security fix: manifest not supported

What it means

Returned by POST /orgs/{org}/code-security/deps/findings/{id}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-manifest-not-supported from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-manifest-not-supported until 2027-10-15. Branch on either type.

Example detail message returned with this error:

• Security fixes cannot change this kind of manifest yet. Bump the dependency by hand.

The response also carries "reason": "manifest_not_supported".

What to do

The finding is in a manifest security fixes do not change, for example an Ivy or sbt build. Gradle builds are covered (see Security fixes). Bump the dependency by hand, or let hosted Renovate open its own update.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-manifest-not-supported",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "manifest_not_supported"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.