99% of the time it's a minor update patch that you really should just apply, or Snyk will add a patch to the build to fix the security hole directly. Honestly

99% of the time it's a minor update patch that you really should just apply, or Snyk will add a patch to the build to fix the security hole directly. Honestly it's just not worth worrying about whether a security hole is exploitable when the decision is whether to accept a minor update patch. Just accept the patch PR and move on. The times you need to do a major update to get a patch fix it's equally important to just make that upgrade, since that means the ancient version you're using is likely out of maintenance and likely is throwing warnings that you're using a deprecated version. Yes, it's more work to perform a major upgrade. But that doesn't mean it isn't good engineering to keep your tools up to date.