Dependency Remediation
- 1 installs
- 27 repo stars
- Updated April 25, 2026
- girijashankarj/cursor-handbook
Repeatable workflow to fix npm/pnpm/yarn vulnerabilities and review Dependabot version bumps with semver and CI safety checks.
About
Provides a step-by-step process to remediate dependency vulnerabilities and safely review version-bump PRs. A developer uses it when handling npm audit, Dependabot, or Snyk findings before merging.
- Baselines with npm audit and a committed lockfile
- Reviews semver changes against CI install and tests
Dependency Remediation by the numbers
- 1 all-time installs (skills.sh)
- Ranked #1,835 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Jul 22, 2026 (Skillselion catalog sync)
npx skills add https://github.com/girijashankarj/cursor-handbook --skill dependency-remediationAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 1 |
|---|---|
| repo stars | ★ 27 |
| Last updated | April 25, 2026 |
| Repository | girijashankarj/cursor-handbook ↗ |
What it does
Repeatable workflow to fix npm/pnpm/yarn vulnerabilities and review Dependabot version bumps with semver and CI safety checks.
Files
Skill: Dependency remediation
When to use
- Vulnerabilities from
npm audit, GitHub Dependabot, Snyk, or similar - You need a repeatable review before merging version bumps
Prerequisites
- Lockfile committed (
package-lock.json,pnpm-lock.yaml, oryarn.lock) - CI that runs install + tests (or type-check)
Steps
1. Baseline
Run /audit-deps or npm audit and save severity counts (critical/high/medium/low).
2. Automated path
1. npm audit fix (non-breaking) or pnpm audit --fix / yarn equivalent. 2. Run `{{CONFIG.testing.typeCheckCommand}}` and targeted tests — not necessarily full suite unless user confirms.
3. Dependabot PR checklist
- [ ] Advisory ID and fixed version match lockfile diff
- [ ] No unexpected
postinstallscripts from new transitive deps - [ ] Changelog reviewed for breaking API changes in minors (rare but possible)
- [ ] Lockfile regenerated in CI matches local
4. Major upgrades
- Read migration guide; update code in the same PR or split PRs by package.
- Avoid
--forcewithout listing each major and risk.
5. Residual risk
If no patched version exists: document, track issue, consider pinning or removing the dependency.
Output
- Table: package, from → to, severity, verification command run
- Explicit merge / hold / split recommendation
Related commands
/fix-vulnerable-deps/audit-deps
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85