What problem does it solve? Open Dependabot security alerts require careful dependency updates that close every vulnerable range without breaking the supported Python and platform matrix, and teams often cannot tell whether a branch will actually resolve the findings before opening a PR. ## Core Features & Use Cases - Alert-Driven Remediation: Fetches all open Dependabot alerts via the GitHub API, groups them by package, severity, and vulnerable range, then applies the smallest compatible fix in pyproject.toml and uv.lock. - Local Security Verification: Compares every locked version against each alert's vulnerable range using packaging specifiers, runs uv audit, and executes Dependabot Core locally to prove findings will close. - Project Validation: Runs the repository's lint, typecheck, test, and build workflows to confirm the dependency change is safe. - Use Case: A maintainer receives several Dependabot alerts against mflux and uses this Skill to clamp the affected dependencies, regenerate the lock with targeted upgrades, and verify locally that every alert is resolved before opening the PR. ## Quick Start Audit the open Dependabot alerts for this repository and produce a minimal dependency update that closes all of them.
