Resolves GitHub Dependabot security alerts by bumping dependencies and validating with pnpm.
npx skills add https://github.com/crowi/crowi --skill crowi-deps
Please help me install this Agent Skill. Skill: crowi-deps Source: https://github.com/crowi/crowi/tree/main/.claude/skills/crowi-deps Command: npx skills add https://github.com/crowi/crowi --skill crowi-deps
Open Dependabot security alerts pile up in a pnpm monorepo, and fixing them properly requires distinguishing direct from transitive dependencies, choosing between version bumps and pnpm overrides, and verifying nothing breaks. This Skill automates that entire remediation workflow for the Crowi repository.
pnpm why.pnpm.overrides only when no bump path exists; defers major-upgrade-only fixes to a report.pnpm.overrides entries one by one and removes those no longer needed because parent packages now resolve patched versions.pnpm install, lint, type-check, and affected package tests before committing (never pushes without user instruction)./crowi-deps when you notice dependency maintenance has slipped; the Skill resolves all open security alerts, cleans stale overrides, and leaves verified commits ready for review.Ask the assistant to run the crowi-deps skill to fetch open Dependabot alerts, fix them with version bumps or overrides, verify with lint and tests, and commit the results.
High-intent search queries and answers about installing and using this skill.
Fetch open alerts with the GitHub CLI, classify each package as direct or transitive, then bump direct dependencies or upgrade parent packages for transitive ones. Verify with pnpm install, lint, type-check, and tests before committing.
Use pnpm overrides only for genuinely transitive dependencies whose parent package cannot be upgraded to pull a patched version. Write them per-major, like "undici@6": "^6.27.0", and record the reason in the commit message.
Remove one override entry at a time, run pnpm install, then check pnpm why to confirm all resolved versions stay at or above the pinned version. If they do, the parent now resolves the patched version naturally and the override can be deleted.
The Skill does not force major upgrades. It records the alert as pending in the report with its blocker, and a spec should be created if work is approved; pnpm outdated and Dependabot can re-derive the remaining items anytime.
No. The workflow stops at local commits after verification passes with zero lint errors, type-check, and affected package tests. Pushing waits for explicit user instruction.
paulchiuPost @dependabot rebase comments on all open Dependabot PRs in a GitHub repository.
scanbottAutomate release workflows by merging branches, running tests, bumping versions, and creating PRs.
AutomatticGuides advisory triage of Dependabot alerts and remediation PRs for wp-calypso.
microsoftConsolidate security alerts from S360/ADO, Dependabot, and npm audit into a remediation PR.