---
name: macro-inc-dependabot
description: "Find all open Dependabot alerts for this repo and create a plan to resolve them using the appropriate package manager overrides (pnpm, bun, npm, cargo)."
license: "AGPL-3.0"
metadata:
  decimalai-skill-id: "6cf532af-c4f8-46f5-bff4-9dbc8bd634c3"
  decimalai-version-id: "0d02f33e-3292-4ec8-a047-6b37ba05d24e"
  decimalai-version: "1"
  decimalai-body-sha256: "9ae68f4eb7606a998b654310f1cc2f50b80ebfd281dd8da698600f4c3d89445c"
  decimalai-name: "macro-inc/dependabot"
  decimalai-format: "1"
  decimalai-invocation: "model"
  decimalai-category: "security"
  decimalai-source: "https://app.decimal.ai/s/macro-inc-dependabot@1/SKILL.md"
---
# Dependabot Alert Resolution

## Step 1: Fetch all open alerts

```bash
REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
gh api "repos/${REPO}/dependabot/alerts" \
  --jq '.[] | select(.state == "open") | {
    number,
    dependency: .dependency.package.name,
    ecosystem: .dependency.package.ecosystem,
    manifest: .dependency.manifest_path,
    vulnerable_range: .security_vulnerability.vulnerable_version_range,
    patched_version: .security_vulnerability.first_patched_version.identifier,
    severity: .security_vulnerability.severity,
    summary: .security_advisory.summary
  }'
```

## Step 2: Group alerts by manifest/lockfile

Group the alerts by their `manifest` field (e.g. `bun.lock`, `Cargo.lock`, `packages/loro-mirror/pnpm-lock.yaml`). This determines which override mechanism to use.

## Step 3: Determine override strategy per manifest

For each manifest/lockfile, determine the correct override mechanism:

| Lockfile | Override mechanism |
|----------|-------------------|
| `bun.lock` / `bun.lockb` | `"overrides"` in the nearest `package.json` |
| `pnpm-lock.yaml` | `"pnpm": { "overrides": { ... } }` in the workspace root `package.json` |
| `package-lock.json` | `"overrides"` in the nearest `package.json` |
| `yarn.lock` | `"resolutions"` in the nearest `package.json` |
| `Cargo.lock` | `cargo update -p <package>` or workspace `[patch.crates-io]` in `Cargo.toml` |

Read each target `package.json` or `Cargo.toml` to check for existing overrides before adding new ones.

## Step 4: Present the plan

Present a table of all alerts grouped by manifest, showing:
- Alert numbers
- Package name
- Current version (from lockfile)
- Patched version
- Severity
- Override mechanism to use

Ask the user to confirm before making changes.

## Step 5: Apply fixes

For each group:

### npm/bun/pnpm overrides
- Add override entries to the appropriate `package.json`
- Reinstall: `bun install` / `pnpm install` / `npm install`
- Verify: check the lockfile or `<pm> ls` for the patched version

### Cargo
- Try `cargo update -p <package>` first
- If that doesn't reach the patched version, also try `cargo update -p <parent-package>` (the package that depends on the vulnerable one, found via `cargo tree -i <package>`)
- Verify with `cargo tree -i <package>` and checking `Cargo.lock`

## Step 6: Verify

After all changes, confirm patched versions are in place and no new audit issues were introduced.

## Notes

- Some alerts may be false positives (e.g. `undici-types` triggering `undici` alerts). Flag these to the user.
- Prefer minimal version bumps (e.g. `>=6.14.0` not `^8.0.0`) to reduce breakage risk.
- If a `cargo update` only bumps to a version below the patch, escalate the parent dependency.