fix-security-vulnerability

Automate fixing Dependabot security alerts by fetching vulnerability details, inspecting the dependency tree for direct or transitive issues, and opening a pull request with the updated package versions.

Analyze transitive dependency vulnerabilities by inspecting the dependency chain to determine the fix strategy, then apply the fix by bumping the package version, running installations, and deduplicating dependencies.

Yes, you can scan all open Dependabot alerts at once using scan-all mode, which iterates through every alert for batch processing and interactive decision-making.

Yes, it works with GitHub repositories by creating a new branch, committing the dependency changes, and opening a pull request to apply the security fix.

Handle high-severity Dependabot alerts without manual intervention by running an automated skill that proposes fixes, updates package versions, and deduplicates dependencies across all open alerts.

Limitations include handling version-specific test packages and requiring prompt injection defenses, but the skill robustly manages both direct and transitive dependency bumps to resolve vulnerabilities.