dependabot-triage

Fetch open alerts with the GitHub CLI using gh api repos/{owner}/{repo}/dependabot/alerts, then trace each package with npm ls or uv pip list to see how it enters the project. Classify each as exploitable, theoretical, build-only, tree-shaken, or unused before deciding to dismiss.

Send a PATCH request to repos/{owner}/{repo}/dependabot/alerts/{number} with state=dismissed, a dismissed_reason such as not_used or tolerable_risk, and a one-sentence comment. Valid reasons include fix_started, inaccurate, no_bandwidth, not_used, and tolerable_risk.

Most transitive dependency alerts are not exploitable because the vulnerable code path is never exercised. Check whether the package runs in production, processes untrusted input, and whether your code calls the vulnerable function before treating it as a real risk.

Yes, it supports npm ecosystems via npm ls run in the manifest directory, and Python via pyproject.toml, requirements files, or uv pip list. The classification logic applies equally to both ecosystems.

Do not dismiss alerts classified as Exploitable or Theoretical, meaning the package runs in production and the vulnerability may be reachable. For those, summarize what updating would involve instead of dismissing.