Remediation

Not just what is wrong. What to change, and what happens if you do.

Discovery is the easy half. A tool that lists 300 vulnerabilities and stops has moved the work to you.

Quick fixes

Where a fix is mechanical, it is offered as a lightbulb on the line:

• Bump to a safe version, with the target chosen to be free of known vulnerabilities within a major-version budget you control
• Suppress, on the line, in the file, or across the repository with a recorded reason
• Triage, recording exploitability rather than hiding the finding
• Open the rule documentation

The remediation view

For dependency work, one view rather than one squiggle at a time: every fixable package, current and target version, whether it is a major bump, and what is blocking the ones that are not fixable.

Fixes are grouped by manifest, so upgrading five npm packages is one change and one npm install, not five separate edits.

Select the ones you want, preview the diff, apply.

How fixes are applied

As a workspace edit, the same mechanism as a rename. That matters:

• Ctrl+Z undoes it like any other edit
• It works on unsaved buffers rather than fighting them
• Nothing is written to disk behind your back

Lockfile regeneration cannot be an edit, because only the package manager can produce a correct lockfile. So it is offered as a task to run afterwards, visibly, rather than the extension shelling out silently.

When there is no safe version

Sometimes there is no fixed release, or the fix is three major versions away. The extension says so rather than pretending, and offers what exists:

• Workarounds: configuration changes that remove exploitability without an upgrade, with an effectiveness rating
• Upstream commits, if a fix is merged but unreleased
• Distribution patches, where your OS vendor has backported it
• CWE guidance for defending against the weakness class generally

Transitive dependencies

You cannot upgrade a package you did not add. Where a direct dependency has a newer release that pulls a fixed transitive, that is the suggested fix. Where it does not, a package-manager override is offered instead: overrides for npm, resolutions for Yarn, replace for Go, [patch] for Cargo.