Security fix: not transitive

What it means

Returned by POST /orgs/{org}/dependency-updates/security-fixes/transitive-requests (Transitive dependencies) when the finding is not a Maven finding that only an SBOM shows. No request was made.

Example detail message returned with this error:

• Only a Maven finding seen only in the SBOM is pinned this way. Use POST …/security-fixes/requests for the others.

The response also carries "reason": "not_transitive".

What to do

Request the fix with POST /orgs/{org}/dependency-updates/security-fixes/requests and finding_id. A transitive npm package is pinned through that request too.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/security-fix-not-transitive",
  "title": "Unprocessable Content",
  "status": 422,
  "detail": "...",
  "reason": "not_transitive"
}

Branch on type, not on title or detail - those are human-readable and may be reworded.