> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/solutions-and-use-cases/run-unattended-dependency-remediation.md).

# Run Unattended Dependency Remediation

Drive critical and high dependency vulnerabilities to zero and keep them there — fixed on the pull request where possible, and by workflow everywhere else.

**The goal:** critical and high dependency findings get fixed without anyone dispatching the work.

There are two places that happens, and you want both:

| Where                                                  | What happens                                                                                                                    |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| [**On the pull request**](#fix-it-on-the-pull-request) | A guardrail catches the risk as it's introduced, and **Fix w/Heeler** fixes it on the PR's own branch. Nothing becomes backlog. |
| [**Through workflows**](#fix-it-through-workflows)     | For findings that already exist, or that arrive outside a PR — ticketed, auto-fixed and announced on their own.                 |

```mermaid
flowchart LR
    subgraph PR["On the pull request"]
        A["Guardrail flags<br/>crit/high SCA"] --> B["Fix w/Heeler<br/>on the PR branch"]
        B --> C["Guardrail re-runs<br/>→ merged clean"]
    end
    subgraph WF["Through workflows"]
        D["New or existing<br/>crit/high finding"] --> E["Ticket + auto-fix<br/>+ notify the team"]
        E --> F["Validated PR<br/>→ Deployed"]
    end
```

{% hint style="info" %}
**This playbook assumes the setup is done.** You need [agentic remediation set up](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-automated-remediation.md), [SLOs](/mrecEO40m5D6bt7Pq5pE/operate/service-level-objectives-slos.md) for SCA, and [teams and routing](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/remediation-assignment-and-routing.md#the-simple-default-automatic-assignment) so findings reach an owner without a dispatcher.
{% endhint %}

## Fix it on the pull request

The cheapest finding to fix is one that never merges. [PR Guardrails](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails.md) evaluate **only the dependencies the PR changes**, so nobody is blocked by pre-existing debt.

Create three. **Block** requires SCM branch protection.

<table><thead><tr><th>Guardrail</th><th width="130">Scope</th><th width="100">Action</th><th>Why</th></tr></thead><tbody><tr><td>Critical/High <strong>with a fix available</strong></td><td>The PR's changed dependencies</td><td><strong>Block</strong></td><td>There's a version to move to, so there's no reason to merge it.</td></tr><tr><td>Critical/High <strong>with no fix available</strong></td><td>The PR's changed dependencies</td><td><strong>Warn</strong></td><td>Nothing to upgrade to yet — surface it for a decision rather than blocking.</td></tr><tr><td>Critical/High <strong>overdue by 5+ days</strong></td><td>The whole repository</td><td><strong>Warn</strong></td><td>Steady pressure on the backlog, not just new risk. An <a href="/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-types/slo-guardrails.md">SLO Guardrail</a>.</td></tr></tbody></table>

### Fixing it there

A blocked PR isn't a dead end. When a guardrail flags an eligible finding, Heeler offers **Fix w/Heeler** on the pull request itself:

* **GitHub** — a one-click **Apply suggestion**.
* **GitLab / Bitbucket** — a direct commit to the branch.

It upgrades the dependency on the PR's own branch, **builds it to validate the change**, pushes it back, and the guardrail re-runs automatically. The developer never leaves the pull request. See [Guardrail Auto-Fix](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-auto-fix.md).

{% hint style="success" %}
**Push it earlier still.** [Agent Skills](/mrecEO40m5D6bt7Pq5pE/prevent/agent-skills.md) let a coding agent check a dependency *as it adds it*, and the [CLI](/mrecEO40m5D6bt7Pq5pE/prevent/cli.md) fails the build at the keyboard — `heelercli vulnerabilities --fail-on-severity critical,high` as a pre-commit hook and a CI step.
{% endhint %}

## Fix it through workflows

Guardrails only see open pull requests. [Workflows](/mrecEO40m5D6bt7Pq5pE/operate/workflows.md) handle everything else — findings already in the backlog, and new ones that arrive from a scheduled scan rather than a PR.

Build these five:

<table><thead><tr><th width="44">#</th><th>When</th><th>Then</th></tr></thead><tbody><tr><td>1</td><td>A new SCA finding is <strong>Critical/High</strong></td><td>Create a ticket, trigger the <strong>auto-fix</strong>, and message the owning team — three chained actions, all auto-assigned. The message carries the ticket key and the PR link.</td></tr><tr><td>2</td><td>A PR <strong>merges with an unresolved guardrail violation</strong></td><td>Open a ticket for the owning team, so nothing merged past a block goes unaccounted.</td></tr><tr><td>3</td><td>A new finding is Critical/High <strong>with no fix available</strong></td><td>Extend its SLO, so an un-fixable finding never reads as overdue through no fault of the team.</td></tr><tr><td>4</td><td>A <strong>fix becomes available</strong> for that finding</td><td>Reset its SLO to the standard clock, so nothing hides behind "no fix".</td></tr><tr><td>5</td><td><strong>On demand</strong>, across open <strong>Urgent</strong> findings</td><td>The same ticket + auto-fix + notify as #1 — this is how you burn down the existing backlog.</td></tr></tbody></table>

{% hint style="info" %}
A workflow chains **up to three actions**, and a later action can embed an earlier one's result through [template variables](/mrecEO40m5D6bt7Pq5pE/operate/workflows/routing-and-templates.md) — that's how #1 posts a message already containing the Jira key and the PR URL.
{% endhint %}

### Burning down what's already there

Workflows #1–#4 keep new risk moving. For the existing backlog, **run #5 on demand**: from the Workflows list choose **Run**, and Heeler shows you the matching findings before it executes anything.

Scope the run to the **Urgent** band first — those are the reachable, internet-exposed and actively threatened ones. **Plan** and **Defer** stay open on their own SLOs and are worked after. See [Execution and Management](/mrecEO40m5D6bt7Pq5pE/operate/workflows/execution-and-management.md).

## Check it's working

| Signal                                                            | Where                                                                                                                                                |
| ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Findings carry **Urgent / Plan / Defer** bands, not just severity | [Remediation Workbench](/mrecEO40m5D6bt7Pq5pE/operate/dashboards/remediation-workbench.md)                                                           |
| New findings show an owning team, and ownership drift reads clean | [Remediation routing](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/remediation-assignment-and-routing.md#dependency-owner-resolution) |
| Workflows read **Healthy**, with successful executions            | [Workflows](/mrecEO40m5D6bt7Pq5pE/operate/workflows/execution-and-management.md)                                                                     |
| Fixes reach **Completed** with a pull request                     | [Agent Executions](/mrecEO40m5D6bt7Pq5pE/fix/agent-executions.md)                                                                                    |
| Throughput per team is going up, backlog down                     | [Weekly and Monthly Overviews](/mrecEO40m5D6bt7Pq5pE/operate/dashboards/weekly-and-monthly-overviews.md)                                             |

{% hint style="warning" %}
Findings with no owner, no due date, or workflows reading **Unhealthy** are almost always a missing connection or policy — see [Setup and Connection Issues](/mrecEO40m5D6bt7Pq5pE/troubleshooting-and-faq/setup-and-connection-issues.md).
{% endhint %}

## Related

* [Set Up Agentic Remediation](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-automated-remediation.md) — the prerequisites this playbook builds on.
* [Guardrail Auto-Fix](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-auto-fix.md) — the full walkthrough for fixing on the PR.
* [Run an SLO-Driven AppSec Program](/mrecEO40m5D6bt7Pq5pE/solutions-and-use-cases/run-an-slo-driven-appsec-program.md) — the same discipline across every finding type.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/solutions-and-use-cases/run-unattended-dependency-remediation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.