It means a patched version of the affected package exists somewhere. It does not mean the fix is compatible with your code, that your tool can apply it, or that it reaches you through your direct dependency. Treat it as a starting point for a quick upgrade check.
What the label tells you
The scanner found an advisory with a fixed version listed. Often the fix is a patch release in the same line, which is the easiest case. Sometimes the fixed version is a new major release, which may break your code.
Three cases that look the same
- Direct dependency, patch fix. Upgrade, run tests, ship.
- Direct dependency, major fix. Read the release notes, plan the work, and check whether a backport exists for your line.
- Transitive dependency. The fix lives in a package your dependency pulls in. You may need that dependency to release an update, or you can force a newer version with an override and test carefully.
What to check before upgrading
- Which version fixes it, and what changed between yours and that one?
- Does your lockfile allow it, or does a version range block it?
- Do your tests cover the code that uses this package?
- Does the new version bring new dependencies of its own?
When there is no fix
Then the label is absent and you have other options. Reduce exposure, add a gate or validation in front of the vulnerable path, replace the package, or accept the risk with a written reason and review date.
Why it still matters
A known fix means the clock is running. Attackers read the same advisories and the patch itself shows what was wrong. A finding with a fix that you ignore for months is a choice, so make it on purpose.
Automating the easy ones
Patch upgrades with a clean test run are good candidates for an automated pull request. Leave the major ones to a person with time to read.
Try it yourself
Click through it at your own pace, or open it full screen. Open a finding with a fix and compare the current and fixed versions before you decide how to apply it.
Quick check
Does fix available mean I can upgrade safely?
No. It means a patched version exists. You still need to test for breaking changes.
What if the fix is only in a transitive dependency?
Ask the direct dependency to update, or use an override and test it.
Last reviewed: 19 October 2026.
