dependency-remediation

Audit npm, pnpm, or yarn lockfiles and apply non-breaking vulnerability fixes.

28|3|Updated Mar 7, 2026

Search Tags:#dependencies #vulnerabilities #npm audit #dependabot #lockfile #remediate #ci-safety

Ready to run

npx skills add https://github.com/girijashankarj/cursor-handbook --skill dependency-remediation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-remediation
Source: https://github.com/girijashankarj/cursor-handbook/tree/main/.cursor/skills/devops/dependency-remediation
Command: npx skills add https://github.com/girijashankarj/cursor-handbook --skill dependency-remediation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Remediates insecure dependencies by auditing lockfiles, applying safe upgrades, and validating changes before merging.

Core Features & Use Cases

Automated baseline and audit: capture vulnerability counts from npm audit, pnpm audit, or yarn audit.
Automated fixes and validation: apply non-breaking fixes, run type checks and tests to verify CI safety.
PR review checklist: ensure lockfile integrity and safe upgrade paths.

Quick Start

Run an audit, apply non-breaking fixes, and verify changes with CI before merging.

Frequently Asked Questions about dependency-remediation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I remediate npm audit vulnerabilities safely in a CI workflow?▼

Remediate npm audit vulnerabilities by auditing committed lockfiles, applying safe upgrades, and running type checks and tests to verify CI safety before merging changes.

What is the best way to fix pnpm or yarn dependency advisories without breaking changes?▼

Fix pnpm or yarn dependency advisories by capturing baseline vulnerability counts, applying automated non-breaking upgrades, and validating lockfile integrity before merging.

Do I need a committed lockfile to automate dependency remediation?▼

Yes, a committed lockfile is required. Dependency remediation runs on CI to perform installation, tests, and verification steps based on tracked advisory IDs in the committed lockfile.

Can I use this to validate Dependabot PRs for open-source libraries?▼

Yes, you can validate Dependabot PRs for open-source libraries by auditing lockfiles, applying safe upgrades, and verifying changes through repeatable installation and test workflows.

How does lockfile integrity ensure ci-safety when upgrading vulnerable dependencies?▼

Lockfile integrity ensures ci-safety by providing a baseline for npm audit, allowing automated application of non-breaking fixes, and validating upgrades through type checks and tests.