Dependency Configuration

Overview

Software Composition Analysis (SCA) covers both dependencies and container findings. Dependency findings are configured from the Nullify dashboard — there is no checked-in config file. Query them with GET /sca/dependencies/findings (and /detailed, /preview); fetch or update a single finding with GET,PATCH /sca/dependencies/findings/{findingId}.

Autofix

Nullify drafts dependency upgrade pull requests automatically. Autofix is enabled per tenant; Manager campaign planning currently applies these PR-volume limits:

• 3 open Nullify pull requests per repository at a time.

• 5 new pull requests per remediation plan.

Pull request gate

Whether a dependency finding can fail CI is controlled from Configure → Pull Requests (PUT /admin/pr-gate-settings). See Configuration – General.

Ignore findings

Suppress a known advisory or defer remediation by allowlisting the specific finding — per-finding from the dashboard or via the API:

POST /sca/dependencies/findings/{findingId}/allowlist

Request body:

{
  "allowlistReason": "Library only used in test harnesses",
  "allowlistType": "UserAssumeRisk"
}

allowlistType is one of AI, UserFixed, UserAssumeRisk, UserFalsePositive, or UserOther.

Use campaigns to track deferred work and prevent forgotten exceptions. Container hardening findings are configured separately — see Configuration – Containers.

The documented limits of 3 open PRs per repository and 5 new PRs per plan apply to Manager campaign planning. They are not a global cap on manually triggered dashboard, API, or CLI autofix requests.