skills.rest
namehash
namehashOFFICIAL
Explore all skills by this author →
Website𝕏@NamehashLabsGitHub

fix-audit

Identify and remediate pnpm audit vulnerabilities in JavaScript/TypeScript monorepos.

41|19|Updated Dec 23, 2024
Search Tags:#security#dependencies#verification#audit#worktree#pnpm#overrides
One-click install
npx skills add https://github.com/namehash/ensnode --skill fix-audit-namehash
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fix-audit
Source: https://github.com/namehash/ensnode/tree/main/.agents/skills/fix-audit
Command: npx skills add https://github.com/namehash/ensnode --skill fix-audit-namehash

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Fix security vulnerabilities reported by pnpm audit using a git worktree off of main, and maintain pnpm.overrides hygiene by pruning obsolete entries and scoping overrides to avoid rewriting peer ranges.

Core Features & Use Cases

  • Identify vulnerabilities with pnpm audit and pnpm audit:osv across the workspace.
  • Patch direct dependencies or adjust overrides to neutralize issues, while keeping the dependency graph clean.
  • Prune obsolete overrides and scope those that require addressing the root cause to minimize disruption.

Quick Start

Run the audit workflow to identify vulnerabilities, apply fixes or overrides, and re-run audits until clean.

Frequently Asked Questions about fix-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix security vulnerabilities reported by pnpm audit in a monorepo?▼

To resolve pnpm audit vulnerabilities, trace origins with pnpm why, apply fixes or scoped overrides to neutralize issues, and re-run audits combined with lint, typecheck, and tests for validation.

What is the best way to prune obsolete pnpm overrides without breaking peer ranges?▼

Pruning obsolete pnpm overrides involves removing unused entries and scoping remaining overrides to target root causes, ensuring peer-range hygiene is maintained without unnecessary rewrites.

Does the pnpm audit fix workflow support JavaScript and TypeScript workspaces?▼

Yes, this pnpm audit remediation workflow supports JavaScript and TypeScript monorepos, handling direct dependencies, transitive dependencies, overrides, and peer-range hygiene across multi-package workspaces.

How do I trace the origin of a transitive dependency vulnerability found by pnpm audit?▼

Trace origins of transitive dependency vulnerabilities by running pnpm why to map dependency graphs, enabling targeted fixes or scoped overrides to neutralize identified security issues.

Why should I use a git worktree when fixing security vulnerabilities in dependencies?▼

A git worktree off main isolates security fixes and overrides pruning, allowing safe validation of dependency changes and pnpm audit cleanup before integrating into the primary branch.

Related Skills

Explore More Software Engineering Skills→
cericocerico

audit

Analyze npm audit results to classify direct and transitive vulnerabilities.

Community
Advanced
corbat-techcorbat-tech
1

worktree-finish

Merges a verified Git worktree branch and cleans it up afterward.

Official
Advanced
sanity-iosanity-io
28

pnpm

Manage Node.js monorepos with pnpm workspace-aware dependency management.

Official
Advanced
hamzaPixlhamzaPixl
2

security-scan

Scan code repositories and container images for secrets, OWASP Top 10 vulnerabilities, dependency CVEs, and RBAC misconfigurations.

Community
Intermediate