skills.rest
forcedotcom
forcedotcomOFFICIAL
Explore all skills by this author →
Website𝕏@salesforcedevsGitHub

dependabot-alerts

Triage GitHub Dependabot security alerts into GUS work items for dependency bumps.

1.0k|454|Updated Jun 21, 2017
Search Tags:#triage#NPM#Monorepo#gitHub#dependabot#security alerts#dependency bump
One-click install
npx skills add https://github.com/forcedotcom/salesforcedx-vscode --skill dependabot-alerts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependabot-alerts
Source: https://github.com/forcedotcom/salesforcedx-vscode/tree/main/.claude/skills/dependabot-alerts
Command: npx skills add https://github.com/forcedotcom/salesforcedx-vscode --skill dependabot-alerts

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Open Dependabot security alerts in a monorepo require manual tracing of vulnerable packages to their outermost consumers, vetting of major-version bumps, and coordination with existing Dependabot PRs before any fix work can be scheduled.

Core Features & Use Cases

  • Alert triage: Lists open Dependabot security alerts via the GitHub API with pagination and traces each vulnerable package to its outermost consumer using npm why.
  • Fix selection: Picks the lowest consumer version that resolves the vulnerability, preferring package.json bumps over lockfile updates and skipping unfixable paths.
  • Major-bump vetting: Spawns subagents to review changelogs for every major version crossed, checking for ESM-only packages, dropped Node engine support, and breaking API changes.
  • Use Case: A repository has 33 open Dependabot alerts; the Skill dedupes against open Dependabot PRs, then creates one 1-point GUS work item per consumer-bump with an exact lockfile verification target for the auto-build-wi workflow.

Quick Start

Triage the open Dependabot security alerts in this repository and draft the GUS work items for each fixable consumer bump.

Frequently Asked Questions about dependabot-alerts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage Dependabot security alerts in an npm monorepo?▼

List open alerts with the GitHub API using --paginate, then run npm why on each vulnerable package to trace it to the outermost consumer declared in a package.json. Create one work item per consumer bump rather than per alert.

How to fix a vulnerable transitive dependency without npm overrides?▼

Trace the vulnerable package to its outermost consumer and bump that consumer to the lowest version resolving the vulnerability, or run npm update on the consumer if its semver range already allows a patched version. Never use npm overrides or blind lockfile bumps.

Does this create pull requests for the dependency bumps?▼

No, it outputs GUS work items only. The separate auto-build-wi workflow claims each work item and performs the actual build, branch, and PR creation.

What happens when a fix requires a major version bump?▼

A subagent vets every major version crossed by reading changelogs and grepping the codebase for affected APIs, checking for ESM-only packages and dropped Node engine support. If a lower major clears the vulnerability, that version is preferred and the cap is noted.

Why is a Dependabot alert skipped without creating a work item?▼

Alerts are skipped when the consumer's latest version still pins the vulnerable package, when a green mergeable Dependabot PR already proposes the same bump, or when a Dependabot PR's CI is still running.

Related Skills

Explore More Software Engineering Skills→
davepoondavepoon
3.4k

package-search

Searches package registries and assesses security risk before adding dependencies.

Community
Advanced
forcedotcomforcedotcom
1.0k

gus-cli

Query, create, and update Gus work items and epics via sf CLI.

Official
Intermediate
lightdashlightdash
6.1k

renovate-pr

Tests and assesses open Renovate dependency-bump pull requests for merge safety.

Official
Advanced
tigredonortetigredonorte

dependabot-merge

Categorize and atomically merge Dependabot PRs based on CI validation.

Community
Advanced