skills.rest
saintgo7
saintgo7COMMUNITY
Explore all skills by this author →
GitHub

dependency-vulnerability-fix

Remediate Python dependency CVEs with patch-scoped pip-audit upgrades.

Updated Apr 4, 2026
Search Tags:#regression testing#supply chain security#pip-audit#python packaging#dependency pinning#vulnerability patching#cve remediation
One-click install
npx skills add https://github.com/saintgo7/claude-skills --skill dependency-vulnerability-fix
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-vulnerability-fix
Source: https://github.com/saintgo7/claude-skills/tree/main/dependency-vulnerability-fix
Command: npx skills add https://github.com/saintgo7/claude-skills --skill dependency-vulnerability-fix

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pip-audit, jq, awk, pytest, locust, and includes scripts (resource) components.

What problem does it solve?

This Skill solves the risk of security vulnerabilities becoming urgent CVE liabilities while preserving production stability, especially in GPU-heavy Python stacks like vLLM/PyTorch where dependency changes can easily break compatibility.

Core Features & Use Cases

  • Four-step safe workflow: scan with pip-audit, classify upgrade risk, apply patch-bounded upgrades, then verify with targeted test tiers.
  • Strict compatibility guardrails: prevents major/minor jumps in large dependencies (vLLM/torch and related GPU packages) and uses patch-only constraints like <next-minor.
  • Automation support: provides a script-driven approach to extract patch-only upgrade candidates from pip-audit JSON and optionally apply them with a re-audit check.

Example use case: you receive a Dependabot/Renovate alert for an aiohttp or cryptography CVE, and you need to remediate it quickly while ensuring the vLLM runtime and CUDA environment remain unchanged.

Quick Start

Run the skill command to apply patch-only fixes after your pip-audit scan: ./install.sh dependency-vulnerability-fix

Frequently Asked Questions about dependency-vulnerability-fix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I patch Python dependency CVEs without breaking my vLLM or PyTorch stack?▼

To patch Python dependency CVEs safely, use a workflow that applies patch-scoped version pinning and prevents major or minor upgrades to large GPU dependencies like vLLM and PyTorch, ensuring production stability while remediating vulnerabilities.

Can I use pip-audit to automate vulnerability remediation in production environments?▼

Yes, you can automate vulnerability remediation by extracting patch-only upgrade candidates from pip-audit JSON output and applying them via a script-driven approach that includes post-upgrade verification and regression tests.

What is patch-scoped version pinning and why is it needed for CVE remediation?▼

Patch-scoped version pinning restricts dependency upgrades to patch-only constraints like <next-minor, avoiding major or minor version jumps that could break strict compatibility constraints in GPU-heavy Python stacks during CVE remediation.

Does this vulnerability patching workflow support regression testing after dependency upgrades?▼

Yes, the vulnerability patching workflow supports regression testing by verifying post-upgrade stability through targeted test tiers using pytest and locust, alongside a final re-audit check with pip-audit to confirm CVE resolution.

What are the limitations of applying patch-only fixes to Python supply chain vulnerabilities?▼

Patch-only fixes cannot remediate vulnerabilities requiring major or minor dependency upgrades, meaning some critical CVEs in large protected dependencies like vLLM or torch may remain unpatched to preserve strict production compatibility.

How do I safely upgrade aiohttp or cryptography after a Dependabot alert without changing my CUDA environment?▼

To safely upgrade dependencies like aiohttp or cryptography without altering your CUDA environment, apply a safety-first upgrade workflow that targets only patch-bounded versions and enforces strict compatibility guardrails on large GPU packages.

Related Skills

Explore More Software Engineering Skills→
benjaminshoemakerbenjaminshoemaker
39

security-scan

Scan codebases for dependency vulnerabilities, risky patterns, and secrets.

Community
Intermediate
bordenetbordenet
8

security-upgrade

Scan project dependencies for known vulnerabilities and upgrade affected packages.

Community
Advanced
tartinerlabstartinerlabs
7

deps

Harden npm supply chain security and enforce dependency pinning for JavaScript/TypeScript projects.

Official
Advanced
as4584as4584
2

dependency-upgrade

Manage major dependency upgrades with compatibility analysis and staged rollouts.

Community
Advanced