Automatic fixing with snyk fix
This feature is currently in beta. We would appreciate any feedback you might have - contact us at [email protected].
Snyk fix is currently only supported for Python.
The
snyk fix command is a CLI command to automatically apply the recommended updates for supported ecosystems.When you use the
snyk test command, actionable fixes for supported ecosystems appear in the scan results as shown in the example that follows.Tested 78 dependencies for known issues, found 34 issues, 145 vulnerable paths.Issues to fix by upgrading dependencies: Upgrade [email protected] to [email protected] to fix
✗ HTTP Header Injection [High Severity][https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-1290072] in [email protected]
introduced by [email protected] and 13 other path(s)
✗ Directory Traversal (new) [High Severity][https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-1298665] in [email protected]
introduced by [email protected] and 13 other path(s)
✗ Insecure Permissions [High Severity][https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-609368] in [email protected]
introduced by [email protected] and 13 other path(s)
✗ Insecure Permissions [High Severity][https://app.snyk.io/vuln/SNYK-PYTHON-DJANGO-609369] in [email protected]
introduced by [email protected] and 13 other path(s)Organization: libs
Package manager: poetry
Target file: lib/poetry.lock
Project name: libs-develop
Open source: no
Project path: lib
Licenses: enabled
The following example shows the output of running
snyk fix.► Running `snyk test` for /Users/lili/www/snyk/python-fix/packages/poetry/test/system/workspaces/with-pins✔ Looking for supported Python items
✔ Processed 1 pyproject.toml items
✔ DoneSuccessful fixes: ../python-fix/packages/poetry/test/system/workspaces/with-pins/poetry.lock
✔ Upgraded django from 2.2.13 to 2.2.18
✔ Upgraded jinja2 from 2.11.2 to 2.11.3Summary:
1 items were successfully fixed
10 issues: 4 High | 3 Medium | 3 Low
10 issues are fixable
10 issues were successfully fixed
Note that only successful test results are forwarded to
snyk fix. In addition, all unsupported ecosystem test results are skipped.To enable snyk fix during the beta period, click on Settings > Snyk Preview. Enable the snyk fix feature and click Save changes.
Enabling Snyk fix in the Snyk Preview settings
The
snyk fix command supports all the snyk test command options and has the following additional options:--quiet- Suppress all output to the command line.--dry-run- Run almost all the logic and display output, but do not make the final changes to the relevant files. Show a preview of the changes.--sequential- Install each dependency update separately one at a time (the default is to install all at once). The default is much slower, but helps increase the number of successful updates by allowing some updates to fail and the process to continue.
- Pip projects with
requirements.txtfiles (or custom named files, for exampleprod.txt) - Pipenv projects with
PipfileandPipfile.lockfiles - Poetry projects with
pyproject.tomlandPoetry.lockfiles
snyk fix --file=requirements.txtsnyk fix --file=base.txt --package-manager=pipsnyk fix --all-projectsWhere the
requirements.txt looks like this, both base.txt and requirements.txt are updated if needed:-r base.txt # this means grab all the dependencies from here
django===1.6.1
Direct dependency upgrades are applied in the relevant files. All files referenced are found and updated.
Pins are applied in the manifest file that was tested.
If multiple files are tested but are related (for example one requires the other), Snyk starts to apply changes to the files higher up in the directory structure.
Snyk detects previously fixed files and skips applying fixes to them again.
Constraints files are requirements files that control only which version of a dependency is installed, not whether it is installed or not. Their syntax and contents are nearly identical to requirements files. There is one key difference: including a package in a constraints file does not trigger installation of the package. For more information, see User Guide - pip documentation v21.0.1.
Direct dependency upgrades are applied in the relevant files. All files referenced are found and updated.
All transitive dependencies are pinned in the
constraints.txt file if referenced with the -c directive in the requirements manifest file.Snyk delegates to
pipenv directly to update dependencies to the specified recommended versions. All pipenv environment variables and behaviors are preserved as much as possible.Snyk delegates to
poetry directly to update dependencies to the specified recommended versions. All poetry environment variables and behaviors are preserved as much as possible.Run in debug mode to get more information on any errors.
DEBUG=snyk snyk fix
This provides a very verbose output that can help diagnose issues or can be sent to Snyk for debugging.
Last modified 1mo ago