What problem does it solve? Updating dependencies blindly risks pulling in supply-chain attacks (like Shai-Hulud worms), leaving known vulnerabilities unpatched, and accumulating override debt in pnpm.overrides or Cargo [patch.crates-io] that never gets cleaned up. This Skill turns dependency upgrades into a repeatable, security-first workflow. ## Core Features & Use Cases - Vulnerability-first triage: Starts from pnpm audit / cargo audit results and accepted-advisory ledgers to prioritize what actually needs updating, rather than bumping everything at once. - Supply-chain hardening: Respects pnpm defenses like minimumReleaseAge cooldowns, strictDepBuilds, and blockExoticSubdeps, and requires human review of lockfile diffs for unexpected transitive deps or new build scripts. - Override debt management: Treats overrides as a last resort, exhausts alternatives first (upgrading direct deps, checking upstream, accepting with records), and audits existing overrides on every run to remove ones that are no longer needed. - Use Case: When dependabot opens a PR or pnpm audit reports a new GHSA, run this workflow to safely update the package, verify the lockfile diff, decide whether an override is justified, add the right changeset, and report what debt was paid down. ## Quick Start Ask the AI to update the project's vulnerable dependencies safely and check whether any existing pnpm overrides can now be removed.
