Automated Dependency CVE Triage & Semver Lockfile Upgrade Skill

Audit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verifie

---
name: dependency-cve-patching
description: Audit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verified PRs. Use when working with CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs.
triggers:
  - dependency cve patching
  - cve triage
  - npm / pnpm
---

# Automated Dependency CVE Triage & Semver Lockfile Upgrade Skill

## 1. When to Use This Skill
Load `skill-dependency-cve-patching` whenever an engineering or operations task involves **CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs**. Specifically:
- Audit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verified PRs.
- Designing, reviewing, or debugging production configurations without guesswork or deprecated flags.
- Running deterministic pre-flight and post-execution verification checks before reporting completion.

## 2. Prerequisites & Required Environment
- **Target Stack:** CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs
- **Permissions:** Read-only inspection by default; ask for explicit confirmation before executing destructive mutations or production deployments.
- **Reference Repository:** `https://docs.github.com/en/code-security/dependabot`

## 3. Step-by-Step Execution Playbook
1. **Context & Configuration Discovery:**
   Inspect existing project manifests (`package.json`, `wrangler.jsonc`, schema files, or environment declarations) before proposing changes. Never overwrite existing bindings or credentials blindly.
2. **Deterministic Implementation:**
   Apply the canonical patterns for **CVE Triage**:
   - Enforce strict schema/type validation at every external boundary.
   - Include explicit error handling, structured logging, and idempotency keys on all mutating calls.
   - Keep secrets in environment variables or secret stores—never hardcode tokens in source files.
3. **Verification & Regression Gate:**
   Run the verification commands below and inspect both exit codes and output payloads before marking the task complete.

## 4. Reference Commands & CLI Workflow
```bash
npm audit --json
npx npm-check-updates --target minor
```

## 5. Edge Cases & Anti-Hallucination Guardrails
- **Zero Unverified Claims:** Never claim a deployment, migration, or API call succeeded without inspecting the command output or HTTP status code.
- **Rollback Readiness:** Always record the previous state or migration version so changes can be reverted cleanly if downstream health checks fail.

Synthesized Engineering Blueprint & Setup Guide