The Safeguard CLI fix command updates vulnerable dependencies, writes a patched SBOM and produces a fix report. Run it with the dry run option first to see the proposed changes without touching any file. Limit the scope by severity and by how big a version jump you accept, then open a pull request.
What fix does
From the CLI reference: fix updates vulnerable packages, writes a patched SBOM, and emits a fix report. The help text adds that it can run in a mode that previews changes without modifying files, and that it can open a pull request.
This is a command you run yourself, with the choices you give it. It is separate from the platform's automated remediation, which is off by default and has each category on manual until you change it.
Always start with a dry run
safeguard fix --manifest package.json --dry-run
The documentation describes the dry run as previewing the diff. Read it like you would read a teammate's change. Look for major version jumps, packages that move on more than one line, and anything that touches a package your application imports directly.
Control how far it goes
In the help text of the build we checked, these controls exist:
- A minimum severity to fix, with high as the default.
- Switches for patch only, minor and major upgrades. Minor upgrades are on by default.
- An option to allow breaking changes, which is a switch you should leave off until you have tests.
- Options to fix specific packages or specific CVEs.
- A backup option that keeps copies of the original files, on by default.
Flags can change between versions, so run the help for the build you installed.
A cautious first run looks like this:
safeguard fix --manifest package.json --severity critical --patch-only --dry-run
From preview to pull request
When the preview looks right, create the change on a branch. The help text lists options for a branch name, title, labels, reviewers and draft status. Start with a draft pull request so your normal review and CI run before anyone merges.
safeguard fix --manifest package.json --severity critical --patch-only --create-pr --draft
You need a source control token, supplied through the option or the usual environment variable for your host.
Do not skip your tests
An upgrade that the resolver considers safe can still break behaviour. The fix command cannot know what your tests cover. Treat its output as a proposal, run the suite, and read the changelog of any package with a larger jump.
Also check the patched SBOM and the report into your records, so you can later show what changed and when.
A sensible routine
- Run fix with dry run on a schedule, perhaps weekly.
- Open one draft pull request per severity band.
- Merge patch updates quickly, and review minor ones with care.
- Handle major upgrades as planned work, not as security chores.
Quick check
Does the dry run change any files?
No. It previews the changes. The default also keeps backups of originals when you do apply changes.
Should I allow breaking changes to clear more findings?
Only once your tests are good enough to catch the fallout. Start with patch only and widen gradually.
Safeguard also offers a free scan at gold.safeguard.sh/scan to see what a project looks like before you run fix.
Sources
Last reviewed: 19 October 2026.
