Fix pull requests

For an open vulnerability issue, Loha can open a pull request in your repository that fixes it. Merging the pull request is all you need to do: the next scan of your default branch closes the issue.

What Loha can fix

Issue comes from	What the pull request changes
An npm package in package-lock.json	The lockfile, updated within the version ranges your project already allows; package.json only when a direct pin must move
A pnpm package in pnpm-lock.yaml	The same, with pnpm
An operating-system package in a built image	The digest of the final stage's base image in your Dockerfile, re-pinned to the newest digest of the same tag

Loha never upgrades a dependency to a new major version, and never adds overrides. If only a major upgrade fixes the vulnerability, the fix shows Not possible and you upgrade it by hand.

Base images are re-pinned only when the FROM line is already pinned to a digest (registry/repo:tag@sha256:…) on a registry your Loha installation is allowed to query. An unpinned FROM repo:tag already gets the newest image on every build.

Open a fix pull request

1. Open the issue under Security issues in the workspace sidebar.
2. Under Fix pull request, choose Open fix PR.

Loha prepares the change in an isolated job, opens a pull request from a loha/fix/… branch into your default branch, and links it on the issue. If the issue had no ticket link, the pull request becomes its ticket link.

All open issues for the same package and lockfile are fixed by one pull request. Any workspace member can open a fix pull request; only administrators can change the repository settings below.

Automatic fix pull requests

On a repository's Settings page, an administrator can turn on Open fix pull requests automatically for critical and high issues and set the maximum number of open Loha pull requests (default 5). The same limit applies to fixes opened by hand. Loha does not retry a package automatically for 7 days after its last fix attempt, including a pull request you closed.

How the change is made

• Lockfiles are regenerated with --ignore-scripts (npm) or --ignore-scripts --ignore-pnpmfile (pnpm). No install script, pnpmfile or .npmrc setting from your repository runs.
• The job that runs the package manager holds no Git credential. Loha writes the branch, the commits and the pull request itself, with your repository connection.
• Before opening the pull request, Loha checks that only package.json and the lockfile changed, and that every copy of the package in the new lockfile is fixed.
• Loha never force-pushes and never commits to your default branch.

What this does not do

• Yarn, Go, Maven, pip and other ecosystems are not supported yet.
• Private npm registries configured in your repository's .npmrc are not used. Packages from them make the fix fail.
• Dockerfiles that use heredocs (RUN <<EOF) or a # escape= directive are not supported for base-image fixes. Loha leaves them unchanged and the fix shows Not possible.
• Loha does not merge the pull request, and does not rebuild it for you. Your usual checks run on it like on any other pull request.