Security fix: nothing fixable in the repository


`type`	`https://docs.frem.sh/reference/api/errors/autofix-nothing-fixable`
HTTP status	`422` Unprocessable Entity

What it means

Returned by POST /orgs/{org}/code-security/deps/repos/{repo}/autofix (Security fixes). No pull request was requested.

Since 2026-10-14 the same refusal is answered with the type security-fix-nothing-fixable from POST /orgs/{org}/dependency-updates/security-fixes/requests. The paths above are deprecated and keep answering autofix-nothing-fixable until 2027-10-15. Branch on either type.

Example detail message returned with this error:

No open finding in this repository can get a security fix: none has a released fix in a supported ecosystem and manifest.

The response also carries "reason": "nothing_fixable".

What to do

No open default-branch finding in the repository has a released fix in an ecosystem and manifest security fixes cover, and no image the repository built has a base a newer base fixes. Nothing was requested.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/autofix-nothing-fixable",
  "title": "Unprocessable Entity",
  "status": 422,
  "detail": "...",
  "reason": "nothing_fixable"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.

Security fix: not transitive Security fix: org daily limit