Troubleshooting dependency updates

No security fix pull request

What you see	Why
No released version fixes every open advisory	There is no fix to propose yet. The finding stays open.
Ecosystem not covered	The finding is in an ecosystem security fixes do not cover yet; see Supported ecosystems.
Manifest not covered	The finding is in a build security fixes cannot change, such as Ivy or sbt.
From an SBOM	The finding comes from an uploaded SBOM, not a file in the repository.
Needs a Go version bump	The finding is in the Go standard library or toolchain.
Waiting for the release age	The fixed version is newer than your Release age (3 days unless you changed it on Release age), and Renovate is holding it. The console and the API (`release_age_days` on the finding’s `autofix` object) give the number of days. The hold is skipped only when the fix is for a known-exploited vulnerability. Ask again once the version is old enough. Requests from before 2026-10-13 show “No PR yet: too new”.
No PR: nothing to change	Renovate found nothing to change. A transitive npm, pnpm, Yarn 1, uv, Poetry or Gradle package is pinned automatically within about ten minutes, and a Maven one with Pin as transitive; see Transitive dependencies. Otherwise, check that the repository’s version and the fixed version are what the finding says.
No PR: manifest unreadable	Renovate could not parse the manifest the console names (its JSON, YAML, TOML or XML is not valid), so it read no dependencies from it. Fix the file’s syntax and request the fix again. In the API the request’s `reason` is `manifest_unparseable` and `unparseable_manifests` lists the files.
PR closed: out of scope	Renovate’s change touched more than the manifest and the lockfile, or moved lockfile packages to another index, so fremforge closed it.
PR closed: relock failed	The lockfile could not be refreshed (by Renovate, or for Gradle by the job in your CI, whose run is linked), so the pull request would not have built. fremforge closed it. Fix the cause and try again.
PR closed: shared version	The version is a property or catalogue entry other dependencies read too. Bump it yourself; see shared versions.

Security fixes are never proposed for malware findings, deny-list findings, the Go standard library, or findings raised on a pull request.

Every refusal of a request through the API carries a reason and a type you can look up under API errors: security-fix-<reason> on POST /orgs/{org}/dependency-updates/security-fixes/requests, autofix-<reason> on the deprecated paths.

A few more causes:

The repository is archived or a mirror (repo_archived): it takes no pull requests.
Security fixes are off (disabled): the mode is Off, or a limit is 0.
The repository is opted out of dependency updates (repo_opted_out).
A limit is reached (repo_limit, org_daily_limit): see Limits.

Version updates

My version update PRs aren’t getting opened

First check: the runs under Activity on the Dependency updates page. If runs are at status ok but prs_opened: 0, your repos really don’t have anything to bump (or your renovate.json filters out everything).
Bot lost write access: re-enabling fixes this. Disable then re-enable; the bot is re-created with a fresh token.
Rate-limited PRs: Renovate’s prHourlyLimit defaults to 2 PRs/hour. Bump it in your config if needed.

A PR is wrong / shouldn’t have been opened

Add the package to your renovate.json ignore list:

{
  "packageRules": [
    {
      "matchPackageNames": ["the-thing-i-dont-want-bumped"],
      "enabled": false
    }
  ]
}

Renovate picks up the change on the next run.

A run failed

Open the run’s Error detail under Activity. Most failures are transient (network blip on the npm registry; recover automatically next cycle).
If a specific repo fails repeatedly, check whether the bot user has access. Re-enabling re-grants write.

“Some dependencies could not be looked up”

This means Renovate couldn’t reach a private registry to discover versions. You do not need to do anything for:

Public packages — looked up on the public registries automatically, through fremforge’s egress proxy.
Your own org’s fremforge package registry — already authenticated by your Renovate bot.

You only need to act when a repo depends on an external private registry we can’t reach on your behalf — GitHub Packages, npmjs.com private packages, a private Artifactory/Nexus, or a private Docker registry.

Add a read credential for it under Private registries.

Merging