Snyk Pull or Merge Requests

How Snyk pull and merge requests fix and upgrade dependencies

Snyk is rolling out a new navigation. The steps on this page describe the classic interface. If your view looks different, visit Navigate the Snyk Web UI to map these options to the new interface.

Snyk Pull or Merge Requests

In addition to providing fix advice, Snyk enables you create automatic or manual pull requests for supported package managers and ecosystems. To create PRs automatically in implementations with Snyk Broker, your administrator must upgrade to v4.55.0 or later.

For the basic steps in fixing vulnerabilities, see Fix your vulnerabilities. To ensure your language is supported, see Languages supported for Fix Pull Requests or Merge Requests and Supported browsers pages.

Administrators and account owners can manage the settings for Snyk upgrade pull requests from the Snyk Web UI at both the Organization and Project levels. You can configure whether the feature is enabled (the default) and specify the conditions under which Snyk should submit upgrade pull requests, if at all.

Manual Fix PRs

For specific supported languages, you can create pull requests to remediate issues using the Snyk web UI. These combine Snyk fix advice with the list of remediated vulnerabilities to create a pull request that developers can review and merge into their repo's main branch.

You can start the process from any supported Project's open source vulnerability view.

Vulnerability view of an issue

PRs use a branch naming convention based on the issues they fix. If a PR already exists for a specific change, Snyk does not create a new one, even if you closed the original PR.

If you try to create a duplicate fix PR, Snyk displays an error. To resolve this, check if the branch already exists and reopen the pull request.

Defining Automatic Snyk PRs

For Projects imported through an SCM integration, Snyk offers automatic pull request generation for vulnerability fixes, package upgrades, and backlog vulnerabilities. To learn more, visit:

• Enable Automatic Fix PRs

• Enable Automatic Backlog PRs

• Enable Automatic Upgrade PRs

Reviewing Snyk PRs

After Snyk submits a pull request on your behalf, you can view the pull request and all related details directly from the relevant repository.

To quickly review the pull request, hover over it. You can see the recommended upgrade and other pull request summary details:

Recommended upgrade

Open the pull request to view in-depth details, including package release notes and vulnerabilities included in the recommended upgrade. For package upgrade pull requests, Snyk includes a breakability risk level in the PR description and posts a follow-up comment with a more detailed analysis. For risk level definitions and guidance, see Breakability risk levels.

Pull request details

Click the Issue link from the table to view all details for the specified vulnerability directly from the Snyk database.

After you have reviewed the pull request, you can approve the merge.

Generated Pull Requests report

Snyk provides a report for Enterprise customers that gives an overview of how Fix, Backlog, and Upgrade PRs are used and highlights the efficiency of PR merges. For more information, see Snyk Generated Pull Requests report.

Snyk SCM webhooks

To track pull request events, Snyk adds webhooks to your imported repositories. For more information, see the GitHub and Git repository integrations.

Snyk uses these webhooks to:

• Track the state of Snyk pull requests: when PRs are triggered, created, updated, merged, and so on.

• Send push events to trigger PR checks.