dependency-remediation
starsforks
How to install dependency-remediation?
girijashankarj/cursor-handbook/dependency-remediation
$npx -y skills add girijashankarj/cursor-handbook --skill dependency-remediationStep-by-step workflow to fix npm/pnpm/yarn vulnerabilities and review Dependabot PRs with semver and CI safety.
SKILL.md
| 1 | # Skill: Dependency remediation |
| 2 | |
| 3 | ## When to use |
| 4 | - Vulnerabilities from `npm audit`, GitHub Dependabot, Snyk, or similar |
| 5 | - You need a repeatable review before merging version bumps |
| 6 | |
| 7 | ## Prerequisites |
| 8 | - Lockfile committed (`package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`) |
| 9 | - CI that runs install + tests (or type-check) |
| 10 | |
| 11 | ## Steps |
| 12 | |
| 13 | ### 1. Baseline |
| 14 | Run `/audit-deps` or `npm audit` and save severity counts (critical/high/medium/low). |
| 15 | |
| 16 | ### 2. Automated path |
| 17 | 1. `npm audit fix` (non-breaking) or `pnpm audit --fix` / yarn equivalent. |
| 18 | 2. Run **`{{CONFIG.testing.typeCheckCommand}}`** and targeted tests — not necessarily full suite unless user confirms. |
| 19 | |
| 20 | ### 3. Dependabot PR checklist |
| 21 | - [ ] Advisory ID and fixed version match lockfile diff |
| 22 | - [ ] No unexpected `postinstall` scripts from new transitive deps |
| 23 | - [ ] Changelog reviewed for breaking API changes in minors (rare but possible) |
| 24 | - [ ] Lockfile regenerated in CI matches local |
| 25 | |
| 26 | ### 4. Major upgrades |
| 27 | - Read migration guide; update code in the same PR or split PRs by package. |
| 28 | - Avoid `--force` without listing each major and risk. |
| 29 | |
| 30 | ### 5. Residual risk |
| 31 | If no patched version exists: document, track issue, consider pinning or removing the dependency. |
| 32 | |
| 33 | ## Output |
| 34 | - Table: package, from → to, severity, verification command run |
| 35 | - Explicit **merge / hold / split** recommendation |
| 36 | |
| 37 | ## Related commands |
| 38 | - `/fix-vulnerable-deps` |
| 39 | - `/audit-deps` |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
