We are using Agent CI (v3.7.45) in a Gitlab CI/CD pipeline and have the variable SRCCLR_PR_ON=low

along with:

export SRCCLR_SCM_TYPE=GITLAB

export EXTRA_ARGS='--update-advisor --pull-request'

curl -sSL https://download.sourceclear.com/ci.sh | sh -s -- scan $EXTRA_ARGS

According to the documentation I understood this should generate a PR for vulnerabilities of LOW and above OR vulnerable Methods.

In this particular scan we have the following results:

Security

With Vulnerable Methods            0

High Risk Vulnerabilities           1

Medium Risk Vulnerabilities          5

Low Risk Vulnerabilities            0

Issues

Issue ID  Issue Type     Severity  Description                           Library Name & Version In Use

81963524  Vulnerability    5.0     CVE-2021-23364: Regular Expression Denial Of Service (ReDoS)  browserslist 4.14.2

81963525  Vulnerability    7.5     NO-CVE: OS Command Injection                  ejs 2.7.4

81963526  Vulnerability    5.0     NO-CVE: Prototype Pollution                   request 2.88.2

81963527  Vulnerability    4.3     NO-CVE: Insecure Cipher                     request 2.88.2

81963528  Vulnerability    4.3     NO-CVE: Denial Of Service (DoS)                 ws 6.2.2

82319031  Vulnerability    5.0     CVE-2021-33587: Denial Of Service (DoS)             css-what 3.4.2

However we see:

Update Advisor

No results from Update Advisor.

Full Report Details              https://sca.analysiscenter.veracode.com/teams/XXXXX/scans/27814717

No pull request was generated because no changes were required based on the configured PR_ON value.

I would have expected a PR to be generated or does that only happen if the updater advisor returns results? If so what is required for update advisor to return results? Is it related to direct or transitive dependencies?

Thanks,