[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-github-dependency-scanning":3,"mdc--kkvib6-key":38,"related-org-github-dependency-scanning":3380,"related-repo-github-dependency-scanning":3561},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":33,"sourceUrl":36,"mdContent":37},"dependency-scanning","scan dependencies for known vulnerabilities","Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"github","GitHub","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fgithub.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Code Analysis","code-analysis",{"name":21,"slug":22,"type":15},"Testing","testing",15,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fcopilot-advanced-security-plugin","2026-06-10T07:32:59.464749",null,4,[29,30,31,32,14],"coding-agent","copilot","ghas","mcp",{"repoUrl":24,"stars":23,"forks":27,"topics":34,"description":35},[29,30,31,32,14],"The official GitHub Copilot Advanced Security plugin","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fcopilot-advanced-security-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fdependency-scanning","---\nname: dependency-scanning\ndescription: Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.\nallowed-tools: Bash Glob Grep Read\n---\n\n# Dependency Scanning Skill\n\n## Overview\n\nThis skill uses the GitHub MCP Server's Dependabot toolset and the `check_dependency_vulnerabilities` tool to find known vulnerabilities in project dependencies. It can check existing Dependabot alerts, look up specific packages, and verify new dependencies before merging.\n\n### What counts as a dependency vulnerability?\n\nDependency vulnerabilities are known security flaws (CVEs) in third-party packages your project depends on. Examples include:\n- Outdated npm packages with remote code execution flaws\n- Python libraries with SQL injection vulnerabilities\n- Go modules with denial-of-service weaknesses\n- Ruby gems with authentication bypass issues\n- Transitive dependencies inheriting upstream vulnerabilities\n\n### Why this is important\n\nA single vulnerable dependency can allow remote code execution in your application, enable denial-of-service attacks, expose sensitive data through library flaws, fail compliance audits (SOC 2, PCI-DSS, HIPAA), or introduce supply chain attack vectors.\n\n**Important**: Only use this skill when a user explicitly asks to check dependencies or scan for vulnerabilities. Do not run dependency scanning unprompted or as part of general workflows.\n\n## Common Scenarios\n\n| User goal | How to respond | Tools needed |\n|---|---|---|\n| Check existing alerts | Check Dependabot Alerts | MCP only |\n| Check a specific package | Look Up a Specific Package | MCP only |\n| Verify new deps before pushing | Scan Local Branch Changes | Bash + MCP |\n| Full dependency audit | Audit All Dependencies | Bash + MCP |\n| Deterministic post-commit check | Post-Commit Safety Net | `dependabot` CLI + MCP |\n\n**Lightweight vs. heavyweight operations**: For lightweight operations (checking alerts, looking up a package), proceed automatically. For heavyweight operations (downloading the Dependabot CLI, running a full repository audit), ask the user for confirmation before proceeding.\n\n### Check Dependabot Alerts\n\n**When to use**: The repository is hosted on GitHub and has Dependabot enabled.\n\n**How**:\n\nList all open alerts:\n\n```\nUse the list_dependabot_alerts tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  state: open\n```\n\nThis returns all open Dependabot alerts including package name, ecosystem, severity, CVE identifiers, and patched version (if available).\n\nGet details on a specific alert:\n\n```\nUse the get_dependabot_alert tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  alert_number: \u003Cnumber>\n```\n\nThis returns the vulnerability description, CVSS score, affected version range, fixed version, and advisory links.\n\n**Fallback**: If Dependabot is not enabled on the repository, fall back to \"Look Up a Specific Package\" below.\n\n**Example (vulnerabilities found)**\n```\nYou: Check my repo for dependency vulnerabilities\nAgent: Fetching Dependabot alerts...\n       Found 3 open alerts:\n       1. Critical — lodash@4.17.15 (CVE-2021-23337: Command Injection) → Fix: 4.17.21\n       2. High — express@4.17.1 (CVE-2024-29041: Open Redirect) → Fix: 4.18.2\n       3. Medium — axios@0.21.1 (CVE-2021-3749: ReDoS) → Fix: 0.21.2\n```\n\n**Example (no alerts)**\n```\nYou: Check my repo for dependency vulnerabilities\nAgent: Fetching Dependabot alerts...\n       ✅ No open Dependabot alerts found for this repository.\n```\n\n### Look Up a Specific Package\n\n**When to use**: Checking a specific package\u002Fversion before adding it, or when Dependabot is not available.\n\n**How**: Use the `check_dependency_vulnerabilities` tool with a single dependency:\n\n```\nUse the check_dependency_vulnerabilities tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  dependencies:\n    - name: \u003Cpackage-name>\n      version: \u003Cversion>\n      ecosystem: \u003Cecosystem>\n```\n\nSupported ecosystem values: `npm`, `pip`, `maven`, `nuget`, `composer`, `pub`, `actions`, `bundler`, `gomod`, `cargo`, `hex`, `swift`.\n\nThe tool checks for high-severity, critical-severity, and malware advisories in the GitHub Advisory Database.\n\n**Example**:\n```\nYou: Is lodash 4.17.15 safe to use?\nAgent: ⚠️ lodash@4.17.15 has 1 known vulnerability:\n       - CVE-2021-23337 (Critical): Command Injection via template function\n         Fixed in: 4.17.21 — Recommendation: Update to lodash>=4.17.21\n```\n\n### Scan Local Branch Changes\n\n**When to use**: The current branch adds or updates dependencies and you want to check them before pushing.\n\n**Steps**:\n1. Detect which dependency files changed on this branch\n2. For each changed manifest\u002Flockfile, parse the new or updated dependencies\n3. Check them with `check_dependency_vulnerabilities` (batch up to 30 per call)\n\n**Step 1 — Detect changed dependency files**:\n\n```bash\n# Check which dependency files changed on the current branch vs base\n# Filter out vendor, build, and generated directories\ngit diff --name-only origin\u002Fmain...HEAD \\\n  | grep -v -E '(^|\u002F)vendor\u002F' \\\n  | grep -v -E '(^|\u002F)node_modules\u002F' \\\n  | grep -v -E '(^|\u002F)(build|dist|out|target)\u002F' \\\n  | grep -E \\\n  '(package\\.json|package-lock\\.json|yarn\\.lock|pnpm-lock\\.yaml|requirements\\.txt|Pipfile\\.lock|poetry\\.lock|pyproject\\.toml|setup\\.py|go\\.mod|go\\.sum|Gemfile|Gemfile\\.lock|Cargo\\.toml|Cargo\\.lock|pom\\.xml|build\\.gradle|build\\.gradle\\.kts|.*\\.csproj|packages\\.config|composer\\.json|composer\\.lock|pubspec\\.yaml|pubspec\\.lock|Package\\.swift|Package\\.resolved)'\n```\n\nIf no dependency files changed, no further scanning is needed — exit early.\n\n**Example (clean)**\n```\nYou: Check if the new dependencies on this branch are safe\nAgent: Scanning package-lock.json changes...\n       ✅ All new dependencies are clean — no known vulnerabilities found.\n```\n\n**Example (vulnerabilities found)**\n```\nYou: Check if the new dependencies on this branch are safe\nAgent: Scanning package-lock.json changes...\n       ⚠️ Found 1 vulnerability in newly added dependencies:\n       - lodash@4.17.15: Critical — CVE-2021-23337 (Command Injection) → Fix: 4.17.21\n```\n\n### Audit All Dependencies\n\n**When to use**: Running a full supply chain security audit of the entire project.\n\n> **Ask the user for confirmation before proceeding.** Example: \"This will scan all dependency files in the repository. For large projects this may take a few minutes. Would you like me to proceed?\"\n\n**Step 1 — Discover all dependency files**:\n\n**Supported ecosystems and manifest files**:\n- **npm**: `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`\n- **pip**: `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `pyproject.toml`, `setup.py`\n- **Go**: `go.mod`, `go.sum`\n- **RubyGems**: `Gemfile`, `Gemfile.lock`\n- **Rust**: `Cargo.toml`, `Cargo.lock`\n- **Maven**: `pom.xml`, `build.gradle`, `build.gradle.kts`\n- **NuGet**: `*.csproj`, `packages.config`, `*.deps.json`\n- **Composer**: `composer.json`, `composer.lock`\n- **Pub**: `pubspec.yaml`, `pubspec.lock`\n- **Swift**: `Package.swift`, `Package.resolved`\n\nSearch up to 4 directories deep, excluding `node_modules\u002F`, `.git\u002F`, and `vendor\u002F`.\n\n**Step 2 — Parse and check dependencies**:\n\nFor each discovered manifest\u002Flockfile, parse the dependency names, versions, and ecosystem, then check them with `check_dependency_vulnerabilities` (batch up to 30 per call):\n\n```\nUse the check_dependency_vulnerabilities tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  dependencies:\n    - name: \u003Cpackage-1>\n      version: \u003Cversion-1>\n      ecosystem: \u003Cecosystem>\n    - name: \u003Cpackage-2>\n      version: \u003Cversion-2>\n      ecosystem: \u003Cecosystem>\n    ...\n```\n\nMap manifest files to ecosystem values: `package.json`\u002F`yarn.lock`\u002F`pnpm-lock.yaml` → `npm`, `requirements.txt`\u002F`Pipfile.lock`\u002F`poetry.lock`\u002F`pyproject.toml` → `pip`, `go.mod`\u002F`go.sum` → `gomod`, `Gemfile`\u002F`Gemfile.lock` → `bundler`, `Cargo.toml`\u002F`Cargo.lock` → `cargo`, `pom.xml`\u002F`build.gradle` → `maven`, `*.csproj`\u002F`packages.config` → `nuget`, `composer.json`\u002F`composer.lock` → `composer`, `pubspec.yaml`\u002F`pubspec.lock` → `pub`, `Package.swift`\u002F`Package.resolved` → `swift`.\n\n**Example**\n```\nYou: Audit all dependencies in this repository for security issues\nAgent: Discovering dependency files...\n       Found: package-lock.json, poetry.lock, go.sum\n       Scan Results:\n       - npm: 2 vulnerabilities (1 high, 1 medium)\n       - pip: 0 vulnerabilities\n       - Go: 1 vulnerability (1 low)\n       Total: 3 vulnerabilities across 3 ecosystems\n```\n\n### Post-Commit Safety Net (Advanced)\n\n**When to use**: After the agent commits changes, before merge — a deterministic backstop that ensures nothing slips through.\n\n> **If the Dependabot CLI is not already installed, ask the user before downloading it.** Example: \"This check requires the Dependabot CLI (~50MB). Would you like me to download and install it?\"\n\n#### Pipeline Architecture\n\n```\n┌──────────────────────────────┐\n│  1. Detect Changed Manifests │  From git diff; filter vendor\u002Fbuild\n└──────────────┬───────────────┘\n               ▼\n┌──────────────────────────────┐\n│  2. Build Dependency Graphs  │  Base + HEAD using `dependabot graph`\n└──────────────┬───────────────┘\n               ▼\n┌──────────────────────────────┐\n│  3. Diff Dependency Graphs   │  Find newly added\u002Fupdated direct deps\n└──────────────┬───────────────┘\n               ▼\n┌──────────────────────────────────────────────┐\n│  4. check_dependency_vulnerabilities tool    │  Query GitHub Advisory Database\n└──────────────┬───────────────────────────────┘\n               ▼\n┌──────────────────────────────┐\n│  5. Report & Re-iterate      │  Report vulns; agent iterates to fix\n└──────────────────────────────┘\n```\n\n#### Step 1: Detect Changed Manifest\u002FLockfiles\n\nUse the same `git diff` command from \"Scan Local Branch Changes\" above. If no dependency files changed, exit early.\n\n#### Step 2: Build Before\u002FAfter Dependency Graphs\n\nMap changed files to Dependabot CLI ecosystem values (using the ecosystem table in \"Audit All Dependencies\" above — e.g., `package.json` → `npm_and_yarn`, `go.mod` → `go_modules`, `Gemfile` → `bundler`).\n\n```bash\nECOSYSTEM=\"npm_and_yarn\"  # set based on the mapping table above\n\n# Use a git worktree to get the base commit without modifying the working tree\ngit worktree add \u002Ftmp\u002Fbase-ref origin\u002Fmain --detach 2>\u002Fdev\u002Fnull\n\n# Build dependency graph at the base commit (before changes)\ndependabot graph $ECOSYSTEM \u002Ftmp\u002Fbase-ref --output=\u002Ftmp\u002Fbefore-deps.json\n\n# Build dependency graph at current HEAD (after changes)\ndependabot graph $ECOSYSTEM . --output=\u002Ftmp\u002Fafter-deps.json\n\n# Clean up the worktree\ngit worktree remove \u002Ftmp\u002Fbase-ref 2>\u002Fdev\u002Fnull\n```\n\n> **Note:** Replace `origin\u002Fmain` with your base branch. You can extract `\u003Cowner>\u002F\u003Crepo>` from your git remote: `git remote get-url origin | sed -E 's|.*github\\.com[:\u002F]([^\u002F]+\u002F[^\u002F]+?)(\\.git)?$|\\1|'`\n\n#### Step 3: Diff New\u002FUpdated Dependencies\n\nThe `dependabot graph` output is a JSON object with a `dependencies` array. Each entry has `name`, `version`, and `relationship` (`\"direct\"` or `\"transitive\"`).\n\n```bash\npython3 -c \"\nimport json\n\n# Load before\u002Fafter dependency graphs produced by 'dependabot graph'\nwith open('\u002Ftmp\u002Fbefore-deps.json') as f:\n    before_data = json.load(f)\nwith open('\u002Ftmp\u002Fafter-deps.json') as f:\n    after_data = json.load(f)\n\n# Extract direct dependencies from the graph output\ndef get_direct_deps(data):\n    deps = {}\n    for dep in data.get('dependencies', []):\n        if dep.get('relationship') == 'direct':\n            deps[dep['name']] = dep['version']\n    return deps\n\nbefore = get_direct_deps(before_data)\nafter = get_direct_deps(after_data)\n\n# Find new or version-changed direct dependencies\nchanged = []\nfor name, version in after.items():\n    if name not in before:\n        changed.append({'name': name, 'version': version, 'change': 'added'})\n    elif before[name] != version:\n        changed.append({'name': name, 'version': version, 'change': f'updated from {before[name]}'})\n\nprint(json.dumps(changed, indent=2))\nprint(f'\\n{len(changed)} direct dependencies added or updated')\n\"\n```\n\n#### Step 4: Check Against Advisory Database\n\nFeed the changed dependencies from Step 3 into the `check_dependency_vulnerabilities` tool (batch up to 30 per call):\n\n```\nUse the check_dependency_vulnerabilities tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  dependencies:\n    - name: \u003Cchanged-dep-1>\n      version: \u003Cversion>\n      ecosystem: \u003Cecosystem>\n    - name: \u003Cchanged-dep-2>\n      version: \u003Cversion>\n      ecosystem: \u003Cecosystem>\n    ...\n```\n\nMap the Dependabot CLI ecosystem to `check_dependency_vulnerabilities` ecosystem values: `npm_and_yarn` → `npm`, `pip` → `pip`, `go_modules` → `gomod`, `bundler` → `bundler`, `cargo` → `cargo`, `maven` → `maven`, `nuget` → `nuget`, `composer` → `composer`, `pub` → `pub`, `swift` → `swift`.\n\n#### Step 5: Report Vulnerabilities and Re-Iterate\n\nIf vulnerabilities are found, report them back to the agent with specific remediation instructions. The agent should fix the vulnerable dependencies and the check runs again — repeating until all newly-introduced vulnerabilities are resolved.\n\n```\nVulnerable dependencies detected in your changes:\n\n1. lodash@4.17.15 (added in package.json)\n   - GHSA-35jh-r3h4-6jhm: Command Injection (Critical, CVSS 9.8)\n   - Fixed in: 4.17.21\n   - Action: Update to lodash@4.17.21 in package.json\n\n2. requests@2.25.0 (added in requirements.txt)\n   - GHSA-j8r2-6x86-q33q: Proxy-Authorization header leak (Medium, CVSS 6.1)\n   - Fixed in: 2.31.0\n   - Action: Update to requests>=2.31.0 in requirements.txt\n\nPlease fix these vulnerabilities and commit the changes. The check will re-run automatically.\n```\n\n> **Key insight**: Running this as a *post-result* hook (after the agent commits) is more reliable than a pre-commit hook. Pre-commit hooks cause agents to add warnings to the PR description rather than actually fixing the vulnerability.\n\n**Example**\n```\n[Agent finishes work and commits changes]\nHook: Detecting changed dependency files...\n      Changed: package-lock.json\n      Building dependency graphs with `dependabot graph`...\n      3 direct dependencies added: lodash (new) 4.17.15, axios 0.21.1→1.6.0, express 4.17.1→4.18.2\n      1 vulnerability found — requesting agent fix:\n      - Critical — lodash@4.17.15 (GHSA-35jh-r3h4-6jhm: Command Injection → Fix: 4.17.21)\nAgent: Updating package.json to use lodash@4.17.21... ✅ Fixed. Committing changes.\nHook: ✅ All newly-introduced dependencies are clean.\n```\n\n## Reporting Results\n\nThe `check_dependency_vulnerabilities` tool returns a formatted report with ✓\u002F⚠ per dependency, GHSA IDs, severity, and summaries. Present this output directly to the user, supplemented with remediation guidance.\n\n### Severity Legend\n\n| Severity | CVSS Score | Action |\n|----------|-----------|--------|\n| Critical | 9.0–10.0 | Fix immediately |\n| High | 7.0–8.9 | Fix as soon as possible |\n| Medium | 4.0–6.9 | Schedule fix |\n| Low | 0.1–3.9 | Track and fix when convenient |\n\nFor automated remediation, only block on **Critical** and **High** severity. Medium and low issues should be reported but should not block the agent's work. Focus remediation on direct dependencies (listed in manifests). Transitive dependencies require updating the parent to a version that pulls in the patched transitive dep, or adding `resolutions` (Yarn), `overrides` (npm), or equivalent. For each vulnerability, provide the exact package and target version, the fix command, any breaking-change warnings, and a mitigation if no patch exists.\n\n\n## Installation\n\n### Prerequisites & Inputs\n\n1. **GitHub MCP Server**: The skill requires the GitHub MCP Server with the `dependabot` toolset enabled. This repository includes a default [.mcp.json](.\u002F..\u002F..\u002F.mcp.json) configured for the GitHub MCP Server, allowing the skill to communicate with it out of the box.\n\n   Configure in your MCP settings:\n   ```json\n   {\n     \"mcpServers\": {\n       \"github\": {\n         \"type\": \"http\",\n         \"url\": \"https:\u002F\u002Fapi.githubcopilot.com\u002Fmcp\u002F\"\n       }\n     }\n   }\n   ```\n\n   > **Note:** Cursor uses `servers` instead of `mcpServers` as the top-level key.\n\n**Required information for scanning**:\n- **Repository owner**: Usually available from `git remote get-url origin` or ask the user\n- **Repository name**: Usually available from `git remote get-url origin` or ask the user\n\n2. **Optional — Dependabot CLI**: Required for the Post-Commit Safety Net use case. Ask the user before downloading.\n\n   ```bash\n   # Check if already installed\n   which dependabot 2>\u002Fdev\u002Fnull && dependabot --version\n\n   # Install via Go\n   go install github.com\u002Fdependabot\u002Fcli\u002Fcmd\u002Fdependabot@latest\n\n   # Or download a prebuilt binary from GitHub releases (Linux\u002FmacOS\u002FWindows, amd64\u002Farm64)\n   # https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli\u002Freleases\n   PLATFORM=\"linux\"   # or \"darwin\" or \"windows\"\n   ARCH=\"amd64\"       # or \"arm64\"\n   VERSION=$(curl -s https:\u002F\u002Fapi.github.com\u002Frepos\u002Fdependabot\u002Fcli\u002Freleases\u002Flatest | grep tag_name | cut -d '\"' -f4)\n   curl -fsSL -o dependabot.tar.gz \\\n     \"https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli\u002Freleases\u002Fdownload\u002F${VERSION}\u002Fdependabot-${VERSION}-${PLATFORM}-${ARCH}.tar.gz\"\n   tar xzf dependabot.tar.gz\n   chmod +x dependabot\n   mv dependabot \u002Fusr\u002Flocal\u002Fbin\u002F\n   ```\n\n## Scanning Transparency\n\n### How your data is processed\n\n- **Dependabot alerts approach**: Only the repository owner\u002Fname is sent to the GitHub MCP Server. Dependency data is already stored by GitHub.\n- **Vulnerability check approach**: Package names, versions, and ecosystems are sent to the GitHub MCP Server's `check_dependency_vulnerabilities` tool, which queries the GitHub Advisory Database.\n- **Dependabot CLI approach**: Dependency information is processed locally. Network requests go to package registries.\n\n## Learn More\n\nFor more details on dependency security, vulnerability scanning, and GitHub security features:\n- [GitHub Dependabot Documentation](https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fdependabot): How to configure and use Dependabot for automated dependency updates\n- [GitHub Advisory Database](https:\u002F\u002Fgithub.com\u002Fadvisories): Browse known vulnerabilities across ecosystems\n- [Dependabot CLI](https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli): Run Dependabot locally for offline dependency analysis\n- [GitHub MCP Server](https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgithub-mcp-server): The MCP server that powers this skill's integration\n- [GHSA (GitHub Security Advisories)](https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fsecurity-advisories): Understanding GitHub Security Advisory identifiers\n",{"data":39,"body":41},{"name":4,"description":6,"allowed-tools":40},"Bash Glob Grep Read",{"type":42,"children":43},"root",[44,53,60,75,82,87,117,123,128,139,145,272,282,287,297,307,312,324,329,334,343,348,358,366,375,383,392,397,406,422,431,522,527,536,545,550,559,568,594,603,821,826,834,843,850,859,864,873,887,896,905,1176,1203,1212,1224,1233,1438,1445,1454,1460,1469,1482,1489,1498,1504,1517,1523,1567,1793,1828,1834,1892,2169,2175,2187,2196,2328,2334,2339,2348,2369,2376,2385,2391,2402,2408,2507,2540,2546,2552,2780,2789,2825,3248,3254,3260,3300,3306,3311,3374],{"type":45,"tag":46,"props":47,"children":49},"element","h1",{"id":48},"dependency-scanning-skill",[50],{"type":51,"value":52},"text","Dependency Scanning Skill",{"type":45,"tag":54,"props":55,"children":57},"h2",{"id":56},"overview",[58],{"type":51,"value":59},"Overview",{"type":45,"tag":61,"props":62,"children":63},"p",{},[64,66,73],{"type":51,"value":65},"This skill uses the GitHub MCP Server's Dependabot toolset and the ",{"type":45,"tag":67,"props":68,"children":70},"code",{"className":69},[],[71],{"type":51,"value":72},"check_dependency_vulnerabilities",{"type":51,"value":74}," tool to find known vulnerabilities in project dependencies. It can check existing Dependabot alerts, look up specific packages, and verify new dependencies before merging.",{"type":45,"tag":76,"props":77,"children":79},"h3",{"id":78},"what-counts-as-a-dependency-vulnerability",[80],{"type":51,"value":81},"What counts as a dependency vulnerability?",{"type":45,"tag":61,"props":83,"children":84},{},[85],{"type":51,"value":86},"Dependency vulnerabilities are known security flaws (CVEs) in third-party packages your project depends on. Examples include:",{"type":45,"tag":88,"props":89,"children":90},"ul",{},[91,97,102,107,112],{"type":45,"tag":92,"props":93,"children":94},"li",{},[95],{"type":51,"value":96},"Outdated npm packages with remote code execution flaws",{"type":45,"tag":92,"props":98,"children":99},{},[100],{"type":51,"value":101},"Python libraries with SQL injection vulnerabilities",{"type":45,"tag":92,"props":103,"children":104},{},[105],{"type":51,"value":106},"Go modules with denial-of-service weaknesses",{"type":45,"tag":92,"props":108,"children":109},{},[110],{"type":51,"value":111},"Ruby gems with authentication bypass issues",{"type":45,"tag":92,"props":113,"children":114},{},[115],{"type":51,"value":116},"Transitive dependencies inheriting upstream vulnerabilities",{"type":45,"tag":76,"props":118,"children":120},{"id":119},"why-this-is-important",[121],{"type":51,"value":122},"Why this is important",{"type":45,"tag":61,"props":124,"children":125},{},[126],{"type":51,"value":127},"A single vulnerable dependency can allow remote code execution in your application, enable denial-of-service attacks, expose sensitive data through library flaws, fail compliance audits (SOC 2, PCI-DSS, HIPAA), or introduce supply chain attack vectors.",{"type":45,"tag":61,"props":129,"children":130},{},[131,137],{"type":45,"tag":132,"props":133,"children":134},"strong",{},[135],{"type":51,"value":136},"Important",{"type":51,"value":138},": Only use this skill when a user explicitly asks to check dependencies or scan for vulnerabilities. Do not run dependency scanning unprompted or as part of general workflows.",{"type":45,"tag":54,"props":140,"children":142},{"id":141},"common-scenarios",[143],{"type":51,"value":144},"Common Scenarios",{"type":45,"tag":146,"props":147,"children":148},"table",{},[149,173],{"type":45,"tag":150,"props":151,"children":152},"thead",{},[153],{"type":45,"tag":154,"props":155,"children":156},"tr",{},[157,163,168],{"type":45,"tag":158,"props":159,"children":160},"th",{},[161],{"type":51,"value":162},"User goal",{"type":45,"tag":158,"props":164,"children":165},{},[166],{"type":51,"value":167},"How to respond",{"type":45,"tag":158,"props":169,"children":170},{},[171],{"type":51,"value":172},"Tools needed",{"type":45,"tag":174,"props":175,"children":176},"tbody",{},[177,196,213,231,248],{"type":45,"tag":154,"props":178,"children":179},{},[180,186,191],{"type":45,"tag":181,"props":182,"children":183},"td",{},[184],{"type":51,"value":185},"Check existing alerts",{"type":45,"tag":181,"props":187,"children":188},{},[189],{"type":51,"value":190},"Check Dependabot Alerts",{"type":45,"tag":181,"props":192,"children":193},{},[194],{"type":51,"value":195},"MCP only",{"type":45,"tag":154,"props":197,"children":198},{},[199,204,209],{"type":45,"tag":181,"props":200,"children":201},{},[202],{"type":51,"value":203},"Check a specific package",{"type":45,"tag":181,"props":205,"children":206},{},[207],{"type":51,"value":208},"Look Up a Specific Package",{"type":45,"tag":181,"props":210,"children":211},{},[212],{"type":51,"value":195},{"type":45,"tag":154,"props":214,"children":215},{},[216,221,226],{"type":45,"tag":181,"props":217,"children":218},{},[219],{"type":51,"value":220},"Verify new deps before pushing",{"type":45,"tag":181,"props":222,"children":223},{},[224],{"type":51,"value":225},"Scan Local Branch Changes",{"type":45,"tag":181,"props":227,"children":228},{},[229],{"type":51,"value":230},"Bash + MCP",{"type":45,"tag":154,"props":232,"children":233},{},[234,239,244],{"type":45,"tag":181,"props":235,"children":236},{},[237],{"type":51,"value":238},"Full dependency audit",{"type":45,"tag":181,"props":240,"children":241},{},[242],{"type":51,"value":243},"Audit All Dependencies",{"type":45,"tag":181,"props":245,"children":246},{},[247],{"type":51,"value":230},{"type":45,"tag":154,"props":249,"children":250},{},[251,256,261],{"type":45,"tag":181,"props":252,"children":253},{},[254],{"type":51,"value":255},"Deterministic post-commit check",{"type":45,"tag":181,"props":257,"children":258},{},[259],{"type":51,"value":260},"Post-Commit Safety Net",{"type":45,"tag":181,"props":262,"children":263},{},[264,270],{"type":45,"tag":67,"props":265,"children":267},{"className":266},[],[268],{"type":51,"value":269},"dependabot",{"type":51,"value":271}," CLI + MCP",{"type":45,"tag":61,"props":273,"children":274},{},[275,280],{"type":45,"tag":132,"props":276,"children":277},{},[278],{"type":51,"value":279},"Lightweight vs. heavyweight operations",{"type":51,"value":281},": For lightweight operations (checking alerts, looking up a package), proceed automatically. For heavyweight operations (downloading the Dependabot CLI, running a full repository audit), ask the user for confirmation before proceeding.",{"type":45,"tag":76,"props":283,"children":285},{"id":284},"check-dependabot-alerts",[286],{"type":51,"value":190},{"type":45,"tag":61,"props":288,"children":289},{},[290,295],{"type":45,"tag":132,"props":291,"children":292},{},[293],{"type":51,"value":294},"When to use",{"type":51,"value":296},": The repository is hosted on GitHub and has Dependabot enabled.",{"type":45,"tag":61,"props":298,"children":299},{},[300,305],{"type":45,"tag":132,"props":301,"children":302},{},[303],{"type":51,"value":304},"How",{"type":51,"value":306},":",{"type":45,"tag":61,"props":308,"children":309},{},[310],{"type":51,"value":311},"List all open alerts:",{"type":45,"tag":313,"props":314,"children":318},"pre",{"className":315,"code":317,"language":51},[316],"language-text","Use the list_dependabot_alerts tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  state: open\n",[319],{"type":45,"tag":67,"props":320,"children":322},{"__ignoreMap":321},"",[323],{"type":51,"value":317},{"type":45,"tag":61,"props":325,"children":326},{},[327],{"type":51,"value":328},"This returns all open Dependabot alerts including package name, ecosystem, severity, CVE identifiers, and patched version (if available).",{"type":45,"tag":61,"props":330,"children":331},{},[332],{"type":51,"value":333},"Get details on a specific alert:",{"type":45,"tag":313,"props":335,"children":338},{"className":336,"code":337,"language":51},[316],"Use the get_dependabot_alert tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  alert_number: \u003Cnumber>\n",[339],{"type":45,"tag":67,"props":340,"children":341},{"__ignoreMap":321},[342],{"type":51,"value":337},{"type":45,"tag":61,"props":344,"children":345},{},[346],{"type":51,"value":347},"This returns the vulnerability description, CVSS score, affected version range, fixed version, and advisory links.",{"type":45,"tag":61,"props":349,"children":350},{},[351,356],{"type":45,"tag":132,"props":352,"children":353},{},[354],{"type":51,"value":355},"Fallback",{"type":51,"value":357},": If Dependabot is not enabled on the repository, fall back to \"Look Up a Specific Package\" below.",{"type":45,"tag":61,"props":359,"children":360},{},[361],{"type":45,"tag":132,"props":362,"children":363},{},[364],{"type":51,"value":365},"Example (vulnerabilities found)",{"type":45,"tag":313,"props":367,"children":370},{"className":368,"code":369,"language":51},[316],"You: Check my repo for dependency vulnerabilities\nAgent: Fetching Dependabot alerts...\n       Found 3 open alerts:\n       1. Critical — lodash@4.17.15 (CVE-2021-23337: Command Injection) → Fix: 4.17.21\n       2. High — express@4.17.1 (CVE-2024-29041: Open Redirect) → Fix: 4.18.2\n       3. Medium — axios@0.21.1 (CVE-2021-3749: ReDoS) → Fix: 0.21.2\n",[371],{"type":45,"tag":67,"props":372,"children":373},{"__ignoreMap":321},[374],{"type":51,"value":369},{"type":45,"tag":61,"props":376,"children":377},{},[378],{"type":45,"tag":132,"props":379,"children":380},{},[381],{"type":51,"value":382},"Example (no alerts)",{"type":45,"tag":313,"props":384,"children":387},{"className":385,"code":386,"language":51},[316],"You: Check my repo for dependency vulnerabilities\nAgent: Fetching Dependabot alerts...\n       ✅ No open Dependabot alerts found for this repository.\n",[388],{"type":45,"tag":67,"props":389,"children":390},{"__ignoreMap":321},[391],{"type":51,"value":386},{"type":45,"tag":76,"props":393,"children":395},{"id":394},"look-up-a-specific-package",[396],{"type":51,"value":208},{"type":45,"tag":61,"props":398,"children":399},{},[400,404],{"type":45,"tag":132,"props":401,"children":402},{},[403],{"type":51,"value":294},{"type":51,"value":405},": Checking a specific package\u002Fversion before adding it, or when Dependabot is not available.",{"type":45,"tag":61,"props":407,"children":408},{},[409,413,415,420],{"type":45,"tag":132,"props":410,"children":411},{},[412],{"type":51,"value":304},{"type":51,"value":414},": Use the ",{"type":45,"tag":67,"props":416,"children":418},{"className":417},[],[419],{"type":51,"value":72},{"type":51,"value":421}," tool with a single dependency:",{"type":45,"tag":313,"props":423,"children":426},{"className":424,"code":425,"language":51},[316],"Use the check_dependency_vulnerabilities tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  dependencies:\n    - name: \u003Cpackage-name>\n      version: \u003Cversion>\n      ecosystem: \u003Cecosystem>\n",[427],{"type":45,"tag":67,"props":428,"children":429},{"__ignoreMap":321},[430],{"type":51,"value":425},{"type":45,"tag":61,"props":432,"children":433},{},[434,436,442,444,450,451,457,458,464,465,471,472,478,479,485,486,492,493,499,500,506,507,513,514,520],{"type":51,"value":435},"Supported ecosystem values: ",{"type":45,"tag":67,"props":437,"children":439},{"className":438},[],[440],{"type":51,"value":441},"npm",{"type":51,"value":443},", ",{"type":45,"tag":67,"props":445,"children":447},{"className":446},[],[448],{"type":51,"value":449},"pip",{"type":51,"value":443},{"type":45,"tag":67,"props":452,"children":454},{"className":453},[],[455],{"type":51,"value":456},"maven",{"type":51,"value":443},{"type":45,"tag":67,"props":459,"children":461},{"className":460},[],[462],{"type":51,"value":463},"nuget",{"type":51,"value":443},{"type":45,"tag":67,"props":466,"children":468},{"className":467},[],[469],{"type":51,"value":470},"composer",{"type":51,"value":443},{"type":45,"tag":67,"props":473,"children":475},{"className":474},[],[476],{"type":51,"value":477},"pub",{"type":51,"value":443},{"type":45,"tag":67,"props":480,"children":482},{"className":481},[],[483],{"type":51,"value":484},"actions",{"type":51,"value":443},{"type":45,"tag":67,"props":487,"children":489},{"className":488},[],[490],{"type":51,"value":491},"bundler",{"type":51,"value":443},{"type":45,"tag":67,"props":494,"children":496},{"className":495},[],[497],{"type":51,"value":498},"gomod",{"type":51,"value":443},{"type":45,"tag":67,"props":501,"children":503},{"className":502},[],[504],{"type":51,"value":505},"cargo",{"type":51,"value":443},{"type":45,"tag":67,"props":508,"children":510},{"className":509},[],[511],{"type":51,"value":512},"hex",{"type":51,"value":443},{"type":45,"tag":67,"props":515,"children":517},{"className":516},[],[518],{"type":51,"value":519},"swift",{"type":51,"value":521},".",{"type":45,"tag":61,"props":523,"children":524},{},[525],{"type":51,"value":526},"The tool checks for high-severity, critical-severity, and malware advisories in the GitHub Advisory Database.",{"type":45,"tag":61,"props":528,"children":529},{},[530,535],{"type":45,"tag":132,"props":531,"children":532},{},[533],{"type":51,"value":534},"Example",{"type":51,"value":306},{"type":45,"tag":313,"props":537,"children":540},{"className":538,"code":539,"language":51},[316],"You: Is lodash 4.17.15 safe to use?\nAgent: ⚠️ lodash@4.17.15 has 1 known vulnerability:\n       - CVE-2021-23337 (Critical): Command Injection via template function\n         Fixed in: 4.17.21 — Recommendation: Update to lodash>=4.17.21\n",[541],{"type":45,"tag":67,"props":542,"children":543},{"__ignoreMap":321},[544],{"type":51,"value":539},{"type":45,"tag":76,"props":546,"children":548},{"id":547},"scan-local-branch-changes",[549],{"type":51,"value":225},{"type":45,"tag":61,"props":551,"children":552},{},[553,557],{"type":45,"tag":132,"props":554,"children":555},{},[556],{"type":51,"value":294},{"type":51,"value":558},": The current branch adds or updates dependencies and you want to check them before pushing.",{"type":45,"tag":61,"props":560,"children":561},{},[562,567],{"type":45,"tag":132,"props":563,"children":564},{},[565],{"type":51,"value":566},"Steps",{"type":51,"value":306},{"type":45,"tag":569,"props":570,"children":571},"ol",{},[572,577,582],{"type":45,"tag":92,"props":573,"children":574},{},[575],{"type":51,"value":576},"Detect which dependency files changed on this branch",{"type":45,"tag":92,"props":578,"children":579},{},[580],{"type":51,"value":581},"For each changed manifest\u002Flockfile, parse the new or updated dependencies",{"type":45,"tag":92,"props":583,"children":584},{},[585,587,592],{"type":51,"value":586},"Check them with ",{"type":45,"tag":67,"props":588,"children":590},{"className":589},[],[591],{"type":51,"value":72},{"type":51,"value":593}," (batch up to 30 per call)",{"type":45,"tag":61,"props":595,"children":596},{},[597,602],{"type":45,"tag":132,"props":598,"children":599},{},[600],{"type":51,"value":601},"Step 1 — Detect changed dependency files",{"type":51,"value":306},{"type":45,"tag":313,"props":604,"children":608},{"className":605,"code":606,"language":607,"meta":321,"style":321},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Check which dependency files changed on the current branch vs base\n# Filter out vendor, build, and generated directories\ngit diff --name-only origin\u002Fmain...HEAD \\\n  | grep -v -E '(^|\u002F)vendor\u002F' \\\n  | grep -v -E '(^|\u002F)node_modules\u002F' \\\n  | grep -v -E '(^|\u002F)(build|dist|out|target)\u002F' \\\n  | grep -E \\\n  '(package\\.json|package-lock\\.json|yarn\\.lock|pnpm-lock\\.yaml|requirements\\.txt|Pipfile\\.lock|poetry\\.lock|pyproject\\.toml|setup\\.py|go\\.mod|go\\.sum|Gemfile|Gemfile\\.lock|Cargo\\.toml|Cargo\\.lock|pom\\.xml|build\\.gradle|build\\.gradle\\.kts|.*\\.csproj|packages\\.config|composer\\.json|composer\\.lock|pubspec\\.yaml|pubspec\\.lock|Package\\.swift|Package\\.resolved)'\n","bash",[609],{"type":45,"tag":67,"props":610,"children":611},{"__ignoreMap":321},[612,624,633,665,708,745,782,802],{"type":45,"tag":613,"props":614,"children":617},"span",{"class":615,"line":616},"line",1,[618],{"type":45,"tag":613,"props":619,"children":621},{"style":620},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[622],{"type":51,"value":623},"# Check which dependency files changed on the current branch vs base\n",{"type":45,"tag":613,"props":625,"children":627},{"class":615,"line":626},2,[628],{"type":45,"tag":613,"props":629,"children":630},{"style":620},[631],{"type":51,"value":632},"# Filter out vendor, build, and generated directories\n",{"type":45,"tag":613,"props":634,"children":636},{"class":615,"line":635},3,[637,643,649,654,659],{"type":45,"tag":613,"props":638,"children":640},{"style":639},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[641],{"type":51,"value":642},"git",{"type":45,"tag":613,"props":644,"children":646},{"style":645},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[647],{"type":51,"value":648}," diff",{"type":45,"tag":613,"props":650,"children":651},{"style":645},[652],{"type":51,"value":653}," --name-only",{"type":45,"tag":613,"props":655,"children":656},{"style":645},[657],{"type":51,"value":658}," origin\u002Fmain...HEAD",{"type":45,"tag":613,"props":660,"children":662},{"style":661},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[663],{"type":51,"value":664}," \\\n",{"type":45,"tag":613,"props":666,"children":667},{"class":615,"line":27},[668,674,679,684,689,694,699,704],{"type":45,"tag":613,"props":669,"children":671},{"style":670},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[672],{"type":51,"value":673},"  |",{"type":45,"tag":613,"props":675,"children":676},{"style":639},[677],{"type":51,"value":678}," grep",{"type":45,"tag":613,"props":680,"children":681},{"style":645},[682],{"type":51,"value":683}," -v",{"type":45,"tag":613,"props":685,"children":686},{"style":645},[687],{"type":51,"value":688}," -E",{"type":45,"tag":613,"props":690,"children":691},{"style":670},[692],{"type":51,"value":693}," '",{"type":45,"tag":613,"props":695,"children":696},{"style":645},[697],{"type":51,"value":698},"(^|\u002F)vendor\u002F",{"type":45,"tag":613,"props":700,"children":701},{"style":670},[702],{"type":51,"value":703},"'",{"type":45,"tag":613,"props":705,"children":706},{"style":661},[707],{"type":51,"value":664},{"type":45,"tag":613,"props":709,"children":711},{"class":615,"line":710},5,[712,716,720,724,728,732,737,741],{"type":45,"tag":613,"props":713,"children":714},{"style":670},[715],{"type":51,"value":673},{"type":45,"tag":613,"props":717,"children":718},{"style":639},[719],{"type":51,"value":678},{"type":45,"tag":613,"props":721,"children":722},{"style":645},[723],{"type":51,"value":683},{"type":45,"tag":613,"props":725,"children":726},{"style":645},[727],{"type":51,"value":688},{"type":45,"tag":613,"props":729,"children":730},{"style":670},[731],{"type":51,"value":693},{"type":45,"tag":613,"props":733,"children":734},{"style":645},[735],{"type":51,"value":736},"(^|\u002F)node_modules\u002F",{"type":45,"tag":613,"props":738,"children":739},{"style":670},[740],{"type":51,"value":703},{"type":45,"tag":613,"props":742,"children":743},{"style":661},[744],{"type":51,"value":664},{"type":45,"tag":613,"props":746,"children":748},{"class":615,"line":747},6,[749,753,757,761,765,769,774,778],{"type":45,"tag":613,"props":750,"children":751},{"style":670},[752],{"type":51,"value":673},{"type":45,"tag":613,"props":754,"children":755},{"style":639},[756],{"type":51,"value":678},{"type":45,"tag":613,"props":758,"children":759},{"style":645},[760],{"type":51,"value":683},{"type":45,"tag":613,"props":762,"children":763},{"style":645},[764],{"type":51,"value":688},{"type":45,"tag":613,"props":766,"children":767},{"style":670},[768],{"type":51,"value":693},{"type":45,"tag":613,"props":770,"children":771},{"style":645},[772],{"type":51,"value":773},"(^|\u002F)(build|dist|out|target)\u002F",{"type":45,"tag":613,"props":775,"children":776},{"style":670},[777],{"type":51,"value":703},{"type":45,"tag":613,"props":779,"children":780},{"style":661},[781],{"type":51,"value":664},{"type":45,"tag":613,"props":783,"children":785},{"class":615,"line":784},7,[786,790,794,798],{"type":45,"tag":613,"props":787,"children":788},{"style":670},[789],{"type":51,"value":673},{"type":45,"tag":613,"props":791,"children":792},{"style":639},[793],{"type":51,"value":678},{"type":45,"tag":613,"props":795,"children":796},{"style":645},[797],{"type":51,"value":688},{"type":45,"tag":613,"props":799,"children":800},{"style":661},[801],{"type":51,"value":664},{"type":45,"tag":613,"props":803,"children":805},{"class":615,"line":804},8,[806,811,816],{"type":45,"tag":613,"props":807,"children":808},{"style":670},[809],{"type":51,"value":810},"  '",{"type":45,"tag":613,"props":812,"children":813},{"style":645},[814],{"type":51,"value":815},"(package\\.json|package-lock\\.json|yarn\\.lock|pnpm-lock\\.yaml|requirements\\.txt|Pipfile\\.lock|poetry\\.lock|pyproject\\.toml|setup\\.py|go\\.mod|go\\.sum|Gemfile|Gemfile\\.lock|Cargo\\.toml|Cargo\\.lock|pom\\.xml|build\\.gradle|build\\.gradle\\.kts|.*\\.csproj|packages\\.config|composer\\.json|composer\\.lock|pubspec\\.yaml|pubspec\\.lock|Package\\.swift|Package\\.resolved)",{"type":45,"tag":613,"props":817,"children":818},{"style":670},[819],{"type":51,"value":820},"'\n",{"type":45,"tag":61,"props":822,"children":823},{},[824],{"type":51,"value":825},"If no dependency files changed, no further scanning is needed — exit early.",{"type":45,"tag":61,"props":827,"children":828},{},[829],{"type":45,"tag":132,"props":830,"children":831},{},[832],{"type":51,"value":833},"Example (clean)",{"type":45,"tag":313,"props":835,"children":838},{"className":836,"code":837,"language":51},[316],"You: Check if the new dependencies on this branch are safe\nAgent: Scanning package-lock.json changes...\n       ✅ All new dependencies are clean — no known vulnerabilities found.\n",[839],{"type":45,"tag":67,"props":840,"children":841},{"__ignoreMap":321},[842],{"type":51,"value":837},{"type":45,"tag":61,"props":844,"children":845},{},[846],{"type":45,"tag":132,"props":847,"children":848},{},[849],{"type":51,"value":365},{"type":45,"tag":313,"props":851,"children":854},{"className":852,"code":853,"language":51},[316],"You: Check if the new dependencies on this branch are safe\nAgent: Scanning package-lock.json changes...\n       ⚠️ Found 1 vulnerability in newly added dependencies:\n       - lodash@4.17.15: Critical — CVE-2021-23337 (Command Injection) → Fix: 4.17.21\n",[855],{"type":45,"tag":67,"props":856,"children":857},{"__ignoreMap":321},[858],{"type":51,"value":853},{"type":45,"tag":76,"props":860,"children":862},{"id":861},"audit-all-dependencies",[863],{"type":51,"value":243},{"type":45,"tag":61,"props":865,"children":866},{},[867,871],{"type":45,"tag":132,"props":868,"children":869},{},[870],{"type":51,"value":294},{"type":51,"value":872},": Running a full supply chain security audit of the entire project.",{"type":45,"tag":874,"props":875,"children":876},"blockquote",{},[877],{"type":45,"tag":61,"props":878,"children":879},{},[880,885],{"type":45,"tag":132,"props":881,"children":882},{},[883],{"type":51,"value":884},"Ask the user for confirmation before proceeding.",{"type":51,"value":886}," Example: \"This will scan all dependency files in the repository. For large projects this may take a few minutes. Would you like me to proceed?\"",{"type":45,"tag":61,"props":888,"children":889},{},[890,895],{"type":45,"tag":132,"props":891,"children":892},{},[893],{"type":51,"value":894},"Step 1 — Discover all dependency files",{"type":51,"value":306},{"type":45,"tag":61,"props":897,"children":898},{},[899,904],{"type":45,"tag":132,"props":900,"children":901},{},[902],{"type":51,"value":903},"Supported ecosystems and manifest files",{"type":51,"value":306},{"type":45,"tag":88,"props":906,"children":907},{},[908,944,986,1008,1030,1052,1081,1110,1132,1154],{"type":45,"tag":92,"props":909,"children":910},{},[911,915,917,923,924,930,931,937,938],{"type":45,"tag":132,"props":912,"children":913},{},[914],{"type":51,"value":441},{"type":51,"value":916},": ",{"type":45,"tag":67,"props":918,"children":920},{"className":919},[],[921],{"type":51,"value":922},"package.json",{"type":51,"value":443},{"type":45,"tag":67,"props":925,"children":927},{"className":926},[],[928],{"type":51,"value":929},"package-lock.json",{"type":51,"value":443},{"type":45,"tag":67,"props":932,"children":934},{"className":933},[],[935],{"type":51,"value":936},"yarn.lock",{"type":51,"value":443},{"type":45,"tag":67,"props":939,"children":941},{"className":940},[],[942],{"type":51,"value":943},"pnpm-lock.yaml",{"type":45,"tag":92,"props":945,"children":946},{},[947,951,952,958,959,965,966,972,973,979,980],{"type":45,"tag":132,"props":948,"children":949},{},[950],{"type":51,"value":449},{"type":51,"value":916},{"type":45,"tag":67,"props":953,"children":955},{"className":954},[],[956],{"type":51,"value":957},"requirements.txt",{"type":51,"value":443},{"type":45,"tag":67,"props":960,"children":962},{"className":961},[],[963],{"type":51,"value":964},"Pipfile.lock",{"type":51,"value":443},{"type":45,"tag":67,"props":967,"children":969},{"className":968},[],[970],{"type":51,"value":971},"poetry.lock",{"type":51,"value":443},{"type":45,"tag":67,"props":974,"children":976},{"className":975},[],[977],{"type":51,"value":978},"pyproject.toml",{"type":51,"value":443},{"type":45,"tag":67,"props":981,"children":983},{"className":982},[],[984],{"type":51,"value":985},"setup.py",{"type":45,"tag":92,"props":987,"children":988},{},[989,994,995,1001,1002],{"type":45,"tag":132,"props":990,"children":991},{},[992],{"type":51,"value":993},"Go",{"type":51,"value":916},{"type":45,"tag":67,"props":996,"children":998},{"className":997},[],[999],{"type":51,"value":1000},"go.mod",{"type":51,"value":443},{"type":45,"tag":67,"props":1003,"children":1005},{"className":1004},[],[1006],{"type":51,"value":1007},"go.sum",{"type":45,"tag":92,"props":1009,"children":1010},{},[1011,1016,1017,1023,1024],{"type":45,"tag":132,"props":1012,"children":1013},{},[1014],{"type":51,"value":1015},"RubyGems",{"type":51,"value":916},{"type":45,"tag":67,"props":1018,"children":1020},{"className":1019},[],[1021],{"type":51,"value":1022},"Gemfile",{"type":51,"value":443},{"type":45,"tag":67,"props":1025,"children":1027},{"className":1026},[],[1028],{"type":51,"value":1029},"Gemfile.lock",{"type":45,"tag":92,"props":1031,"children":1032},{},[1033,1038,1039,1045,1046],{"type":45,"tag":132,"props":1034,"children":1035},{},[1036],{"type":51,"value":1037},"Rust",{"type":51,"value":916},{"type":45,"tag":67,"props":1040,"children":1042},{"className":1041},[],[1043],{"type":51,"value":1044},"Cargo.toml",{"type":51,"value":443},{"type":45,"tag":67,"props":1047,"children":1049},{"className":1048},[],[1050],{"type":51,"value":1051},"Cargo.lock",{"type":45,"tag":92,"props":1053,"children":1054},{},[1055,1060,1061,1067,1068,1074,1075],{"type":45,"tag":132,"props":1056,"children":1057},{},[1058],{"type":51,"value":1059},"Maven",{"type":51,"value":916},{"type":45,"tag":67,"props":1062,"children":1064},{"className":1063},[],[1065],{"type":51,"value":1066},"pom.xml",{"type":51,"value":443},{"type":45,"tag":67,"props":1069,"children":1071},{"className":1070},[],[1072],{"type":51,"value":1073},"build.gradle",{"type":51,"value":443},{"type":45,"tag":67,"props":1076,"children":1078},{"className":1077},[],[1079],{"type":51,"value":1080},"build.gradle.kts",{"type":45,"tag":92,"props":1082,"children":1083},{},[1084,1089,1090,1096,1097,1103,1104],{"type":45,"tag":132,"props":1085,"children":1086},{},[1087],{"type":51,"value":1088},"NuGet",{"type":51,"value":916},{"type":45,"tag":67,"props":1091,"children":1093},{"className":1092},[],[1094],{"type":51,"value":1095},"*.csproj",{"type":51,"value":443},{"type":45,"tag":67,"props":1098,"children":1100},{"className":1099},[],[1101],{"type":51,"value":1102},"packages.config",{"type":51,"value":443},{"type":45,"tag":67,"props":1105,"children":1107},{"className":1106},[],[1108],{"type":51,"value":1109},"*.deps.json",{"type":45,"tag":92,"props":1111,"children":1112},{},[1113,1118,1119,1125,1126],{"type":45,"tag":132,"props":1114,"children":1115},{},[1116],{"type":51,"value":1117},"Composer",{"type":51,"value":916},{"type":45,"tag":67,"props":1120,"children":1122},{"className":1121},[],[1123],{"type":51,"value":1124},"composer.json",{"type":51,"value":443},{"type":45,"tag":67,"props":1127,"children":1129},{"className":1128},[],[1130],{"type":51,"value":1131},"composer.lock",{"type":45,"tag":92,"props":1133,"children":1134},{},[1135,1140,1141,1147,1148],{"type":45,"tag":132,"props":1136,"children":1137},{},[1138],{"type":51,"value":1139},"Pub",{"type":51,"value":916},{"type":45,"tag":67,"props":1142,"children":1144},{"className":1143},[],[1145],{"type":51,"value":1146},"pubspec.yaml",{"type":51,"value":443},{"type":45,"tag":67,"props":1149,"children":1151},{"className":1150},[],[1152],{"type":51,"value":1153},"pubspec.lock",{"type":45,"tag":92,"props":1155,"children":1156},{},[1157,1162,1163,1169,1170],{"type":45,"tag":132,"props":1158,"children":1159},{},[1160],{"type":51,"value":1161},"Swift",{"type":51,"value":916},{"type":45,"tag":67,"props":1164,"children":1166},{"className":1165},[],[1167],{"type":51,"value":1168},"Package.swift",{"type":51,"value":443},{"type":45,"tag":67,"props":1171,"children":1173},{"className":1172},[],[1174],{"type":51,"value":1175},"Package.resolved",{"type":45,"tag":61,"props":1177,"children":1178},{},[1179,1181,1187,1188,1194,1196,1202],{"type":51,"value":1180},"Search up to 4 directories deep, excluding ",{"type":45,"tag":67,"props":1182,"children":1184},{"className":1183},[],[1185],{"type":51,"value":1186},"node_modules\u002F",{"type":51,"value":443},{"type":45,"tag":67,"props":1189,"children":1191},{"className":1190},[],[1192],{"type":51,"value":1193},".git\u002F",{"type":51,"value":1195},", and ",{"type":45,"tag":67,"props":1197,"children":1199},{"className":1198},[],[1200],{"type":51,"value":1201},"vendor\u002F",{"type":51,"value":521},{"type":45,"tag":61,"props":1204,"children":1205},{},[1206,1211],{"type":45,"tag":132,"props":1207,"children":1208},{},[1209],{"type":51,"value":1210},"Step 2 — Parse and check dependencies",{"type":51,"value":306},{"type":45,"tag":61,"props":1213,"children":1214},{},[1215,1217,1222],{"type":51,"value":1216},"For each discovered manifest\u002Flockfile, parse the dependency names, versions, and ecosystem, then check them with ",{"type":45,"tag":67,"props":1218,"children":1220},{"className":1219},[],[1221],{"type":51,"value":72},{"type":51,"value":1223}," (batch up to 30 per call):",{"type":45,"tag":313,"props":1225,"children":1228},{"className":1226,"code":1227,"language":51},[316],"Use the check_dependency_vulnerabilities tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  dependencies:\n    - name: \u003Cpackage-1>\n      version: \u003Cversion-1>\n      ecosystem: \u003Cecosystem>\n    - name: \u003Cpackage-2>\n      version: \u003Cversion-2>\n      ecosystem: \u003Cecosystem>\n    ...\n",[1229],{"type":45,"tag":67,"props":1230,"children":1231},{"__ignoreMap":321},[1232],{"type":51,"value":1227},{"type":45,"tag":61,"props":1234,"children":1235},{},[1236,1238,1243,1245,1250,1251,1256,1258,1263,1264,1269,1270,1275,1276,1281,1282,1287,1288,1293,1294,1299,1300,1305,1306,1311,1312,1317,1318,1323,1324,1329,1330,1335,1336,1341,1342,1347,1348,1353,1354,1359,1360,1365,1366,1371,1372,1377,1378,1383,1384,1389,1390,1395,1396,1401,1402,1407,1408,1413,1414,1419,1420,1425,1426,1431,1432,1437],{"type":51,"value":1237},"Map manifest files to ecosystem values: ",{"type":45,"tag":67,"props":1239,"children":1241},{"className":1240},[],[1242],{"type":51,"value":922},{"type":51,"value":1244},"\u002F",{"type":45,"tag":67,"props":1246,"children":1248},{"className":1247},[],[1249],{"type":51,"value":936},{"type":51,"value":1244},{"type":45,"tag":67,"props":1252,"children":1254},{"className":1253},[],[1255],{"type":51,"value":943},{"type":51,"value":1257}," → ",{"type":45,"tag":67,"props":1259,"children":1261},{"className":1260},[],[1262],{"type":51,"value":441},{"type":51,"value":443},{"type":45,"tag":67,"props":1265,"children":1267},{"className":1266},[],[1268],{"type":51,"value":957},{"type":51,"value":1244},{"type":45,"tag":67,"props":1271,"children":1273},{"className":1272},[],[1274],{"type":51,"value":964},{"type":51,"value":1244},{"type":45,"tag":67,"props":1277,"children":1279},{"className":1278},[],[1280],{"type":51,"value":971},{"type":51,"value":1244},{"type":45,"tag":67,"props":1283,"children":1285},{"className":1284},[],[1286],{"type":51,"value":978},{"type":51,"value":1257},{"type":45,"tag":67,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":51,"value":449},{"type":51,"value":443},{"type":45,"tag":67,"props":1295,"children":1297},{"className":1296},[],[1298],{"type":51,"value":1000},{"type":51,"value":1244},{"type":45,"tag":67,"props":1301,"children":1303},{"className":1302},[],[1304],{"type":51,"value":1007},{"type":51,"value":1257},{"type":45,"tag":67,"props":1307,"children":1309},{"className":1308},[],[1310],{"type":51,"value":498},{"type":51,"value":443},{"type":45,"tag":67,"props":1313,"children":1315},{"className":1314},[],[1316],{"type":51,"value":1022},{"type":51,"value":1244},{"type":45,"tag":67,"props":1319,"children":1321},{"className":1320},[],[1322],{"type":51,"value":1029},{"type":51,"value":1257},{"type":45,"tag":67,"props":1325,"children":1327},{"className":1326},[],[1328],{"type":51,"value":491},{"type":51,"value":443},{"type":45,"tag":67,"props":1331,"children":1333},{"className":1332},[],[1334],{"type":51,"value":1044},{"type":51,"value":1244},{"type":45,"tag":67,"props":1337,"children":1339},{"className":1338},[],[1340],{"type":51,"value":1051},{"type":51,"value":1257},{"type":45,"tag":67,"props":1343,"children":1345},{"className":1344},[],[1346],{"type":51,"value":505},{"type":51,"value":443},{"type":45,"tag":67,"props":1349,"children":1351},{"className":1350},[],[1352],{"type":51,"value":1066},{"type":51,"value":1244},{"type":45,"tag":67,"props":1355,"children":1357},{"className":1356},[],[1358],{"type":51,"value":1073},{"type":51,"value":1257},{"type":45,"tag":67,"props":1361,"children":1363},{"className":1362},[],[1364],{"type":51,"value":456},{"type":51,"value":443},{"type":45,"tag":67,"props":1367,"children":1369},{"className":1368},[],[1370],{"type":51,"value":1095},{"type":51,"value":1244},{"type":45,"tag":67,"props":1373,"children":1375},{"className":1374},[],[1376],{"type":51,"value":1102},{"type":51,"value":1257},{"type":45,"tag":67,"props":1379,"children":1381},{"className":1380},[],[1382],{"type":51,"value":463},{"type":51,"value":443},{"type":45,"tag":67,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":51,"value":1124},{"type":51,"value":1244},{"type":45,"tag":67,"props":1391,"children":1393},{"className":1392},[],[1394],{"type":51,"value":1131},{"type":51,"value":1257},{"type":45,"tag":67,"props":1397,"children":1399},{"className":1398},[],[1400],{"type":51,"value":470},{"type":51,"value":443},{"type":45,"tag":67,"props":1403,"children":1405},{"className":1404},[],[1406],{"type":51,"value":1146},{"type":51,"value":1244},{"type":45,"tag":67,"props":1409,"children":1411},{"className":1410},[],[1412],{"type":51,"value":1153},{"type":51,"value":1257},{"type":45,"tag":67,"props":1415,"children":1417},{"className":1416},[],[1418],{"type":51,"value":477},{"type":51,"value":443},{"type":45,"tag":67,"props":1421,"children":1423},{"className":1422},[],[1424],{"type":51,"value":1168},{"type":51,"value":1244},{"type":45,"tag":67,"props":1427,"children":1429},{"className":1428},[],[1430],{"type":51,"value":1175},{"type":51,"value":1257},{"type":45,"tag":67,"props":1433,"children":1435},{"className":1434},[],[1436],{"type":51,"value":519},{"type":51,"value":521},{"type":45,"tag":61,"props":1439,"children":1440},{},[1441],{"type":45,"tag":132,"props":1442,"children":1443},{},[1444],{"type":51,"value":534},{"type":45,"tag":313,"props":1446,"children":1449},{"className":1447,"code":1448,"language":51},[316],"You: Audit all dependencies in this repository for security issues\nAgent: Discovering dependency files...\n       Found: package-lock.json, poetry.lock, go.sum\n       Scan Results:\n       - npm: 2 vulnerabilities (1 high, 1 medium)\n       - pip: 0 vulnerabilities\n       - Go: 1 vulnerability (1 low)\n       Total: 3 vulnerabilities across 3 ecosystems\n",[1450],{"type":45,"tag":67,"props":1451,"children":1452},{"__ignoreMap":321},[1453],{"type":51,"value":1448},{"type":45,"tag":76,"props":1455,"children":1457},{"id":1456},"post-commit-safety-net-advanced",[1458],{"type":51,"value":1459},"Post-Commit Safety Net (Advanced)",{"type":45,"tag":61,"props":1461,"children":1462},{},[1463,1467],{"type":45,"tag":132,"props":1464,"children":1465},{},[1466],{"type":51,"value":294},{"type":51,"value":1468},": After the agent commits changes, before merge — a deterministic backstop that ensures nothing slips through.",{"type":45,"tag":874,"props":1470,"children":1471},{},[1472],{"type":45,"tag":61,"props":1473,"children":1474},{},[1475,1480],{"type":45,"tag":132,"props":1476,"children":1477},{},[1478],{"type":51,"value":1479},"If the Dependabot CLI is not already installed, ask the user before downloading it.",{"type":51,"value":1481}," Example: \"This check requires the Dependabot CLI (~50MB). Would you like me to download and install it?\"",{"type":45,"tag":1483,"props":1484,"children":1486},"h4",{"id":1485},"pipeline-architecture",[1487],{"type":51,"value":1488},"Pipeline Architecture",{"type":45,"tag":313,"props":1490,"children":1493},{"className":1491,"code":1492,"language":51},[316],"┌──────────────────────────────┐\n│  1. Detect Changed Manifests │  From git diff; filter vendor\u002Fbuild\n└──────────────┬───────────────┘\n               ▼\n┌──────────────────────────────┐\n│  2. Build Dependency Graphs  │  Base + HEAD using `dependabot graph`\n└──────────────┬───────────────┘\n               ▼\n┌──────────────────────────────┐\n│  3. Diff Dependency Graphs   │  Find newly added\u002Fupdated direct deps\n└──────────────┬───────────────┘\n               ▼\n┌──────────────────────────────────────────────┐\n│  4. check_dependency_vulnerabilities tool    │  Query GitHub Advisory Database\n└──────────────┬───────────────────────────────┘\n               ▼\n┌──────────────────────────────┐\n│  5. Report & Re-iterate      │  Report vulns; agent iterates to fix\n└──────────────────────────────┘\n",[1494],{"type":45,"tag":67,"props":1495,"children":1496},{"__ignoreMap":321},[1497],{"type":51,"value":1492},{"type":45,"tag":1483,"props":1499,"children":1501},{"id":1500},"step-1-detect-changed-manifestlockfiles",[1502],{"type":51,"value":1503},"Step 1: Detect Changed Manifest\u002FLockfiles",{"type":45,"tag":61,"props":1505,"children":1506},{},[1507,1509,1515],{"type":51,"value":1508},"Use the same ",{"type":45,"tag":67,"props":1510,"children":1512},{"className":1511},[],[1513],{"type":51,"value":1514},"git diff",{"type":51,"value":1516}," command from \"Scan Local Branch Changes\" above. If no dependency files changed, exit early.",{"type":45,"tag":1483,"props":1518,"children":1520},{"id":1519},"step-2-build-beforeafter-dependency-graphs",[1521],{"type":51,"value":1522},"Step 2: Build Before\u002FAfter Dependency Graphs",{"type":45,"tag":61,"props":1524,"children":1525},{},[1526,1528,1533,1534,1540,1541,1546,1547,1553,1554,1559,1560,1565],{"type":51,"value":1527},"Map changed files to Dependabot CLI ecosystem values (using the ecosystem table in \"Audit All Dependencies\" above — e.g., ",{"type":45,"tag":67,"props":1529,"children":1531},{"className":1530},[],[1532],{"type":51,"value":922},{"type":51,"value":1257},{"type":45,"tag":67,"props":1535,"children":1537},{"className":1536},[],[1538],{"type":51,"value":1539},"npm_and_yarn",{"type":51,"value":443},{"type":45,"tag":67,"props":1542,"children":1544},{"className":1543},[],[1545],{"type":51,"value":1000},{"type":51,"value":1257},{"type":45,"tag":67,"props":1548,"children":1550},{"className":1549},[],[1551],{"type":51,"value":1552},"go_modules",{"type":51,"value":443},{"type":45,"tag":67,"props":1555,"children":1557},{"className":1556},[],[1558],{"type":51,"value":1022},{"type":51,"value":1257},{"type":45,"tag":67,"props":1561,"children":1563},{"className":1562},[],[1564],{"type":51,"value":491},{"type":51,"value":1566},").",{"type":45,"tag":313,"props":1568,"children":1570},{"className":605,"code":1569,"language":607,"meta":321,"style":321},"ECOSYSTEM=\"npm_and_yarn\"  # set based on the mapping table above\n\n# Use a git worktree to get the base commit without modifying the working tree\ngit worktree add \u002Ftmp\u002Fbase-ref origin\u002Fmain --detach 2>\u002Fdev\u002Fnull\n\n# Build dependency graph at the base commit (before changes)\ndependabot graph $ECOSYSTEM \u002Ftmp\u002Fbase-ref --output=\u002Ftmp\u002Fbefore-deps.json\n\n# Build dependency graph at current HEAD (after changes)\ndependabot graph $ECOSYSTEM . --output=\u002Ftmp\u002Fafter-deps.json\n\n# Clean up the worktree\ngit worktree remove \u002Ftmp\u002Fbase-ref 2>\u002Fdev\u002Fnull\n",[1571],{"type":45,"tag":67,"props":1572,"children":1573},{"__ignoreMap":321},[1574,1605,1614,1622,1664,1671,1679,1706,1713,1722,1747,1755,1764],{"type":45,"tag":613,"props":1575,"children":1576},{"class":615,"line":616},[1577,1582,1587,1592,1596,1600],{"type":45,"tag":613,"props":1578,"children":1579},{"style":661},[1580],{"type":51,"value":1581},"ECOSYSTEM",{"type":45,"tag":613,"props":1583,"children":1584},{"style":670},[1585],{"type":51,"value":1586},"=",{"type":45,"tag":613,"props":1588,"children":1589},{"style":670},[1590],{"type":51,"value":1591},"\"",{"type":45,"tag":613,"props":1593,"children":1594},{"style":645},[1595],{"type":51,"value":1539},{"type":45,"tag":613,"props":1597,"children":1598},{"style":670},[1599],{"type":51,"value":1591},{"type":45,"tag":613,"props":1601,"children":1602},{"style":620},[1603],{"type":51,"value":1604},"  # set based on the mapping table above\n",{"type":45,"tag":613,"props":1606,"children":1607},{"class":615,"line":626},[1608],{"type":45,"tag":613,"props":1609,"children":1611},{"emptyLinePlaceholder":1610},true,[1612],{"type":51,"value":1613},"\n",{"type":45,"tag":613,"props":1615,"children":1616},{"class":615,"line":635},[1617],{"type":45,"tag":613,"props":1618,"children":1619},{"style":620},[1620],{"type":51,"value":1621},"# Use a git worktree to get the base commit without modifying the working tree\n",{"type":45,"tag":613,"props":1623,"children":1624},{"class":615,"line":27},[1625,1629,1634,1639,1644,1649,1654,1659],{"type":45,"tag":613,"props":1626,"children":1627},{"style":639},[1628],{"type":51,"value":642},{"type":45,"tag":613,"props":1630,"children":1631},{"style":645},[1632],{"type":51,"value":1633}," worktree",{"type":45,"tag":613,"props":1635,"children":1636},{"style":645},[1637],{"type":51,"value":1638}," add",{"type":45,"tag":613,"props":1640,"children":1641},{"style":645},[1642],{"type":51,"value":1643}," \u002Ftmp\u002Fbase-ref",{"type":45,"tag":613,"props":1645,"children":1646},{"style":645},[1647],{"type":51,"value":1648}," origin\u002Fmain",{"type":45,"tag":613,"props":1650,"children":1651},{"style":645},[1652],{"type":51,"value":1653}," --detach",{"type":45,"tag":613,"props":1655,"children":1656},{"style":670},[1657],{"type":51,"value":1658}," 2>",{"type":45,"tag":613,"props":1660,"children":1661},{"style":645},[1662],{"type":51,"value":1663},"\u002Fdev\u002Fnull\n",{"type":45,"tag":613,"props":1665,"children":1666},{"class":615,"line":710},[1667],{"type":45,"tag":613,"props":1668,"children":1669},{"emptyLinePlaceholder":1610},[1670],{"type":51,"value":1613},{"type":45,"tag":613,"props":1672,"children":1673},{"class":615,"line":747},[1674],{"type":45,"tag":613,"props":1675,"children":1676},{"style":620},[1677],{"type":51,"value":1678},"# Build dependency graph at the base commit (before changes)\n",{"type":45,"tag":613,"props":1680,"children":1681},{"class":615,"line":784},[1682,1686,1691,1696,1701],{"type":45,"tag":613,"props":1683,"children":1684},{"style":639},[1685],{"type":51,"value":269},{"type":45,"tag":613,"props":1687,"children":1688},{"style":645},[1689],{"type":51,"value":1690}," graph",{"type":45,"tag":613,"props":1692,"children":1693},{"style":661},[1694],{"type":51,"value":1695}," $ECOSYSTEM ",{"type":45,"tag":613,"props":1697,"children":1698},{"style":645},[1699],{"type":51,"value":1700},"\u002Ftmp\u002Fbase-ref",{"type":45,"tag":613,"props":1702,"children":1703},{"style":645},[1704],{"type":51,"value":1705}," --output=\u002Ftmp\u002Fbefore-deps.json\n",{"type":45,"tag":613,"props":1707,"children":1708},{"class":615,"line":804},[1709],{"type":45,"tag":613,"props":1710,"children":1711},{"emptyLinePlaceholder":1610},[1712],{"type":51,"value":1613},{"type":45,"tag":613,"props":1714,"children":1716},{"class":615,"line":1715},9,[1717],{"type":45,"tag":613,"props":1718,"children":1719},{"style":620},[1720],{"type":51,"value":1721},"# Build dependency graph at current HEAD (after changes)\n",{"type":45,"tag":613,"props":1723,"children":1725},{"class":615,"line":1724},10,[1726,1730,1734,1738,1742],{"type":45,"tag":613,"props":1727,"children":1728},{"style":639},[1729],{"type":51,"value":269},{"type":45,"tag":613,"props":1731,"children":1732},{"style":645},[1733],{"type":51,"value":1690},{"type":45,"tag":613,"props":1735,"children":1736},{"style":661},[1737],{"type":51,"value":1695},{"type":45,"tag":613,"props":1739,"children":1740},{"style":645},[1741],{"type":51,"value":521},{"type":45,"tag":613,"props":1743,"children":1744},{"style":645},[1745],{"type":51,"value":1746}," --output=\u002Ftmp\u002Fafter-deps.json\n",{"type":45,"tag":613,"props":1748,"children":1750},{"class":615,"line":1749},11,[1751],{"type":45,"tag":613,"props":1752,"children":1753},{"emptyLinePlaceholder":1610},[1754],{"type":51,"value":1613},{"type":45,"tag":613,"props":1756,"children":1758},{"class":615,"line":1757},12,[1759],{"type":45,"tag":613,"props":1760,"children":1761},{"style":620},[1762],{"type":51,"value":1763},"# Clean up the worktree\n",{"type":45,"tag":613,"props":1765,"children":1767},{"class":615,"line":1766},13,[1768,1772,1776,1781,1785,1789],{"type":45,"tag":613,"props":1769,"children":1770},{"style":639},[1771],{"type":51,"value":642},{"type":45,"tag":613,"props":1773,"children":1774},{"style":645},[1775],{"type":51,"value":1633},{"type":45,"tag":613,"props":1777,"children":1778},{"style":645},[1779],{"type":51,"value":1780}," remove",{"type":45,"tag":613,"props":1782,"children":1783},{"style":645},[1784],{"type":51,"value":1643},{"type":45,"tag":613,"props":1786,"children":1787},{"style":670},[1788],{"type":51,"value":1658},{"type":45,"tag":613,"props":1790,"children":1791},{"style":645},[1792],{"type":51,"value":1663},{"type":45,"tag":874,"props":1794,"children":1795},{},[1796],{"type":45,"tag":61,"props":1797,"children":1798},{},[1799,1804,1806,1812,1814,1820,1822],{"type":45,"tag":132,"props":1800,"children":1801},{},[1802],{"type":51,"value":1803},"Note:",{"type":51,"value":1805}," Replace ",{"type":45,"tag":67,"props":1807,"children":1809},{"className":1808},[],[1810],{"type":51,"value":1811},"origin\u002Fmain",{"type":51,"value":1813}," with your base branch. You can extract ",{"type":45,"tag":67,"props":1815,"children":1817},{"className":1816},[],[1818],{"type":51,"value":1819},"\u003Cowner>\u002F\u003Crepo>",{"type":51,"value":1821}," from your git remote: ",{"type":45,"tag":67,"props":1823,"children":1825},{"className":1824},[],[1826],{"type":51,"value":1827},"git remote get-url origin | sed -E 's|.*github\\.com[:\u002F]([^\u002F]+\u002F[^\u002F]+?)(\\.git)?$|\\1|'",{"type":45,"tag":1483,"props":1829,"children":1831},{"id":1830},"step-3-diff-newupdated-dependencies",[1832],{"type":51,"value":1833},"Step 3: Diff New\u002FUpdated Dependencies",{"type":45,"tag":61,"props":1835,"children":1836},{},[1837,1839,1845,1847,1853,1855,1861,1862,1868,1869,1875,1877,1883,1885,1891],{"type":51,"value":1838},"The ",{"type":45,"tag":67,"props":1840,"children":1842},{"className":1841},[],[1843],{"type":51,"value":1844},"dependabot graph",{"type":51,"value":1846}," output is a JSON object with a ",{"type":45,"tag":67,"props":1848,"children":1850},{"className":1849},[],[1851],{"type":51,"value":1852},"dependencies",{"type":51,"value":1854}," array. Each entry has ",{"type":45,"tag":67,"props":1856,"children":1858},{"className":1857},[],[1859],{"type":51,"value":1860},"name",{"type":51,"value":443},{"type":45,"tag":67,"props":1863,"children":1865},{"className":1864},[],[1866],{"type":51,"value":1867},"version",{"type":51,"value":1195},{"type":45,"tag":67,"props":1870,"children":1872},{"className":1871},[],[1873],{"type":51,"value":1874},"relationship",{"type":51,"value":1876}," (",{"type":45,"tag":67,"props":1878,"children":1880},{"className":1879},[],[1881],{"type":51,"value":1882},"\"direct\"",{"type":51,"value":1884}," or ",{"type":45,"tag":67,"props":1886,"children":1888},{"className":1887},[],[1889],{"type":51,"value":1890},"\"transitive\"",{"type":51,"value":1566},{"type":45,"tag":313,"props":1893,"children":1895},{"className":605,"code":1894,"language":607,"meta":321,"style":321},"python3 -c \"\nimport json\n\n# Load before\u002Fafter dependency graphs produced by 'dependabot graph'\nwith open('\u002Ftmp\u002Fbefore-deps.json') as f:\n    before_data = json.load(f)\nwith open('\u002Ftmp\u002Fafter-deps.json') as f:\n    after_data = json.load(f)\n\n# Extract direct dependencies from the graph output\ndef get_direct_deps(data):\n    deps = {}\n    for dep in data.get('dependencies', []):\n        if dep.get('relationship') == 'direct':\n            deps[dep['name']] = dep['version']\n    return deps\n\nbefore = get_direct_deps(before_data)\nafter = get_direct_deps(after_data)\n\n# Find new or version-changed direct dependencies\nchanged = []\nfor name, version in after.items():\n    if name not in before:\n        changed.append({'name': name, 'version': version, 'change': 'added'})\n    elif before[name] != version:\n        changed.append({'name': name, 'version': version, 'change': f'updated from {before[name]}'})\n\nprint(json.dumps(changed, indent=2))\nprint(f'\\n{len(changed)} direct dependencies added or updated')\n\"\n",[1896],{"type":45,"tag":67,"props":1897,"children":1898},{"__ignoreMap":321},[1899,1917,1925,1932,1940,1948,1956,1964,1972,1979,1987,1995,2003,2011,2020,2028,2037,2045,2054,2063,2071,2080,2089,2098,2107,2116,2125,2134,2142,2151,2160],{"type":45,"tag":613,"props":1900,"children":1901},{"class":615,"line":616},[1902,1907,1912],{"type":45,"tag":613,"props":1903,"children":1904},{"style":639},[1905],{"type":51,"value":1906},"python3",{"type":45,"tag":613,"props":1908,"children":1909},{"style":645},[1910],{"type":51,"value":1911}," -c",{"type":45,"tag":613,"props":1913,"children":1914},{"style":670},[1915],{"type":51,"value":1916}," \"\n",{"type":45,"tag":613,"props":1918,"children":1919},{"class":615,"line":626},[1920],{"type":45,"tag":613,"props":1921,"children":1922},{"style":645},[1923],{"type":51,"value":1924},"import json\n",{"type":45,"tag":613,"props":1926,"children":1927},{"class":615,"line":635},[1928],{"type":45,"tag":613,"props":1929,"children":1930},{"emptyLinePlaceholder":1610},[1931],{"type":51,"value":1613},{"type":45,"tag":613,"props":1933,"children":1934},{"class":615,"line":27},[1935],{"type":45,"tag":613,"props":1936,"children":1937},{"style":645},[1938],{"type":51,"value":1939},"# Load before\u002Fafter dependency graphs produced by 'dependabot graph'\n",{"type":45,"tag":613,"props":1941,"children":1942},{"class":615,"line":710},[1943],{"type":45,"tag":613,"props":1944,"children":1945},{"style":645},[1946],{"type":51,"value":1947},"with open('\u002Ftmp\u002Fbefore-deps.json') as f:\n",{"type":45,"tag":613,"props":1949,"children":1950},{"class":615,"line":747},[1951],{"type":45,"tag":613,"props":1952,"children":1953},{"style":645},[1954],{"type":51,"value":1955},"    before_data = json.load(f)\n",{"type":45,"tag":613,"props":1957,"children":1958},{"class":615,"line":784},[1959],{"type":45,"tag":613,"props":1960,"children":1961},{"style":645},[1962],{"type":51,"value":1963},"with open('\u002Ftmp\u002Fafter-deps.json') as f:\n",{"type":45,"tag":613,"props":1965,"children":1966},{"class":615,"line":804},[1967],{"type":45,"tag":613,"props":1968,"children":1969},{"style":645},[1970],{"type":51,"value":1971},"    after_data = json.load(f)\n",{"type":45,"tag":613,"props":1973,"children":1974},{"class":615,"line":1715},[1975],{"type":45,"tag":613,"props":1976,"children":1977},{"emptyLinePlaceholder":1610},[1978],{"type":51,"value":1613},{"type":45,"tag":613,"props":1980,"children":1981},{"class":615,"line":1724},[1982],{"type":45,"tag":613,"props":1983,"children":1984},{"style":645},[1985],{"type":51,"value":1986},"# Extract direct dependencies from the graph output\n",{"type":45,"tag":613,"props":1988,"children":1989},{"class":615,"line":1749},[1990],{"type":45,"tag":613,"props":1991,"children":1992},{"style":645},[1993],{"type":51,"value":1994},"def get_direct_deps(data):\n",{"type":45,"tag":613,"props":1996,"children":1997},{"class":615,"line":1757},[1998],{"type":45,"tag":613,"props":1999,"children":2000},{"style":645},[2001],{"type":51,"value":2002},"    deps = {}\n",{"type":45,"tag":613,"props":2004,"children":2005},{"class":615,"line":1766},[2006],{"type":45,"tag":613,"props":2007,"children":2008},{"style":645},[2009],{"type":51,"value":2010},"    for dep in data.get('dependencies', []):\n",{"type":45,"tag":613,"props":2012,"children":2014},{"class":615,"line":2013},14,[2015],{"type":45,"tag":613,"props":2016,"children":2017},{"style":645},[2018],{"type":51,"value":2019},"        if dep.get('relationship') == 'direct':\n",{"type":45,"tag":613,"props":2021,"children":2022},{"class":615,"line":23},[2023],{"type":45,"tag":613,"props":2024,"children":2025},{"style":645},[2026],{"type":51,"value":2027},"            deps[dep['name']] = dep['version']\n",{"type":45,"tag":613,"props":2029,"children":2031},{"class":615,"line":2030},16,[2032],{"type":45,"tag":613,"props":2033,"children":2034},{"style":645},[2035],{"type":51,"value":2036},"    return deps\n",{"type":45,"tag":613,"props":2038,"children":2040},{"class":615,"line":2039},17,[2041],{"type":45,"tag":613,"props":2042,"children":2043},{"emptyLinePlaceholder":1610},[2044],{"type":51,"value":1613},{"type":45,"tag":613,"props":2046,"children":2048},{"class":615,"line":2047},18,[2049],{"type":45,"tag":613,"props":2050,"children":2051},{"style":645},[2052],{"type":51,"value":2053},"before = get_direct_deps(before_data)\n",{"type":45,"tag":613,"props":2055,"children":2057},{"class":615,"line":2056},19,[2058],{"type":45,"tag":613,"props":2059,"children":2060},{"style":645},[2061],{"type":51,"value":2062},"after = get_direct_deps(after_data)\n",{"type":45,"tag":613,"props":2064,"children":2066},{"class":615,"line":2065},20,[2067],{"type":45,"tag":613,"props":2068,"children":2069},{"emptyLinePlaceholder":1610},[2070],{"type":51,"value":1613},{"type":45,"tag":613,"props":2072,"children":2074},{"class":615,"line":2073},21,[2075],{"type":45,"tag":613,"props":2076,"children":2077},{"style":645},[2078],{"type":51,"value":2079},"# Find new or version-changed direct dependencies\n",{"type":45,"tag":613,"props":2081,"children":2083},{"class":615,"line":2082},22,[2084],{"type":45,"tag":613,"props":2085,"children":2086},{"style":645},[2087],{"type":51,"value":2088},"changed = []\n",{"type":45,"tag":613,"props":2090,"children":2092},{"class":615,"line":2091},23,[2093],{"type":45,"tag":613,"props":2094,"children":2095},{"style":645},[2096],{"type":51,"value":2097},"for name, version in after.items():\n",{"type":45,"tag":613,"props":2099,"children":2101},{"class":615,"line":2100},24,[2102],{"type":45,"tag":613,"props":2103,"children":2104},{"style":645},[2105],{"type":51,"value":2106},"    if name not in before:\n",{"type":45,"tag":613,"props":2108,"children":2110},{"class":615,"line":2109},25,[2111],{"type":45,"tag":613,"props":2112,"children":2113},{"style":645},[2114],{"type":51,"value":2115},"        changed.append({'name': name, 'version': version, 'change': 'added'})\n",{"type":45,"tag":613,"props":2117,"children":2119},{"class":615,"line":2118},26,[2120],{"type":45,"tag":613,"props":2121,"children":2122},{"style":645},[2123],{"type":51,"value":2124},"    elif before[name] != version:\n",{"type":45,"tag":613,"props":2126,"children":2128},{"class":615,"line":2127},27,[2129],{"type":45,"tag":613,"props":2130,"children":2131},{"style":645},[2132],{"type":51,"value":2133},"        changed.append({'name': name, 'version': version, 'change': f'updated from {before[name]}'})\n",{"type":45,"tag":613,"props":2135,"children":2137},{"class":615,"line":2136},28,[2138],{"type":45,"tag":613,"props":2139,"children":2140},{"emptyLinePlaceholder":1610},[2141],{"type":51,"value":1613},{"type":45,"tag":613,"props":2143,"children":2145},{"class":615,"line":2144},29,[2146],{"type":45,"tag":613,"props":2147,"children":2148},{"style":645},[2149],{"type":51,"value":2150},"print(json.dumps(changed, indent=2))\n",{"type":45,"tag":613,"props":2152,"children":2154},{"class":615,"line":2153},30,[2155],{"type":45,"tag":613,"props":2156,"children":2157},{"style":645},[2158],{"type":51,"value":2159},"print(f'\\n{len(changed)} direct dependencies added or updated')\n",{"type":45,"tag":613,"props":2161,"children":2163},{"class":615,"line":2162},31,[2164],{"type":45,"tag":613,"props":2165,"children":2166},{"style":670},[2167],{"type":51,"value":2168},"\"\n",{"type":45,"tag":1483,"props":2170,"children":2172},{"id":2171},"step-4-check-against-advisory-database",[2173],{"type":51,"value":2174},"Step 4: Check Against Advisory Database",{"type":45,"tag":61,"props":2176,"children":2177},{},[2178,2180,2185],{"type":51,"value":2179},"Feed the changed dependencies from Step 3 into the ",{"type":45,"tag":67,"props":2181,"children":2183},{"className":2182},[],[2184],{"type":51,"value":72},{"type":51,"value":2186}," tool (batch up to 30 per call):",{"type":45,"tag":313,"props":2188,"children":2191},{"className":2189,"code":2190,"language":51},[316],"Use the check_dependency_vulnerabilities tool:\n  owner: \u003Crepo-owner>\n  repo: \u003Crepo-name>\n  dependencies:\n    - name: \u003Cchanged-dep-1>\n      version: \u003Cversion>\n      ecosystem: \u003Cecosystem>\n    - name: \u003Cchanged-dep-2>\n      version: \u003Cversion>\n      ecosystem: \u003Cecosystem>\n    ...\n",[2192],{"type":45,"tag":67,"props":2193,"children":2194},{"__ignoreMap":321},[2195],{"type":51,"value":2190},{"type":45,"tag":61,"props":2197,"children":2198},{},[2199,2201,2206,2208,2213,2214,2219,2220,2225,2226,2231,2232,2237,2238,2243,2244,2249,2250,2255,2256,2261,2262,2267,2268,2273,2274,2279,2280,2285,2286,2291,2292,2297,2298,2303,2304,2309,2310,2315,2316,2321,2322,2327],{"type":51,"value":2200},"Map the Dependabot CLI ecosystem to ",{"type":45,"tag":67,"props":2202,"children":2204},{"className":2203},[],[2205],{"type":51,"value":72},{"type":51,"value":2207}," ecosystem values: ",{"type":45,"tag":67,"props":2209,"children":2211},{"className":2210},[],[2212],{"type":51,"value":1539},{"type":51,"value":1257},{"type":45,"tag":67,"props":2215,"children":2217},{"className":2216},[],[2218],{"type":51,"value":441},{"type":51,"value":443},{"type":45,"tag":67,"props":2221,"children":2223},{"className":2222},[],[2224],{"type":51,"value":449},{"type":51,"value":1257},{"type":45,"tag":67,"props":2227,"children":2229},{"className":2228},[],[2230],{"type":51,"value":449},{"type":51,"value":443},{"type":45,"tag":67,"props":2233,"children":2235},{"className":2234},[],[2236],{"type":51,"value":1552},{"type":51,"value":1257},{"type":45,"tag":67,"props":2239,"children":2241},{"className":2240},[],[2242],{"type":51,"value":498},{"type":51,"value":443},{"type":45,"tag":67,"props":2245,"children":2247},{"className":2246},[],[2248],{"type":51,"value":491},{"type":51,"value":1257},{"type":45,"tag":67,"props":2251,"children":2253},{"className":2252},[],[2254],{"type":51,"value":491},{"type":51,"value":443},{"type":45,"tag":67,"props":2257,"children":2259},{"className":2258},[],[2260],{"type":51,"value":505},{"type":51,"value":1257},{"type":45,"tag":67,"props":2263,"children":2265},{"className":2264},[],[2266],{"type":51,"value":505},{"type":51,"value":443},{"type":45,"tag":67,"props":2269,"children":2271},{"className":2270},[],[2272],{"type":51,"value":456},{"type":51,"value":1257},{"type":45,"tag":67,"props":2275,"children":2277},{"className":2276},[],[2278],{"type":51,"value":456},{"type":51,"value":443},{"type":45,"tag":67,"props":2281,"children":2283},{"className":2282},[],[2284],{"type":51,"value":463},{"type":51,"value":1257},{"type":45,"tag":67,"props":2287,"children":2289},{"className":2288},[],[2290],{"type":51,"value":463},{"type":51,"value":443},{"type":45,"tag":67,"props":2293,"children":2295},{"className":2294},[],[2296],{"type":51,"value":470},{"type":51,"value":1257},{"type":45,"tag":67,"props":2299,"children":2301},{"className":2300},[],[2302],{"type":51,"value":470},{"type":51,"value":443},{"type":45,"tag":67,"props":2305,"children":2307},{"className":2306},[],[2308],{"type":51,"value":477},{"type":51,"value":1257},{"type":45,"tag":67,"props":2311,"children":2313},{"className":2312},[],[2314],{"type":51,"value":477},{"type":51,"value":443},{"type":45,"tag":67,"props":2317,"children":2319},{"className":2318},[],[2320],{"type":51,"value":519},{"type":51,"value":1257},{"type":45,"tag":67,"props":2323,"children":2325},{"className":2324},[],[2326],{"type":51,"value":519},{"type":51,"value":521},{"type":45,"tag":1483,"props":2329,"children":2331},{"id":2330},"step-5-report-vulnerabilities-and-re-iterate",[2332],{"type":51,"value":2333},"Step 5: Report Vulnerabilities and Re-Iterate",{"type":45,"tag":61,"props":2335,"children":2336},{},[2337],{"type":51,"value":2338},"If vulnerabilities are found, report them back to the agent with specific remediation instructions. The agent should fix the vulnerable dependencies and the check runs again — repeating until all newly-introduced vulnerabilities are resolved.",{"type":45,"tag":313,"props":2340,"children":2343},{"className":2341,"code":2342,"language":51},[316],"Vulnerable dependencies detected in your changes:\n\n1. lodash@4.17.15 (added in package.json)\n   - GHSA-35jh-r3h4-6jhm: Command Injection (Critical, CVSS 9.8)\n   - Fixed in: 4.17.21\n   - Action: Update to lodash@4.17.21 in package.json\n\n2. requests@2.25.0 (added in requirements.txt)\n   - GHSA-j8r2-6x86-q33q: Proxy-Authorization header leak (Medium, CVSS 6.1)\n   - Fixed in: 2.31.0\n   - Action: Update to requests>=2.31.0 in requirements.txt\n\nPlease fix these vulnerabilities and commit the changes. The check will re-run automatically.\n",[2344],{"type":45,"tag":67,"props":2345,"children":2346},{"__ignoreMap":321},[2347],{"type":51,"value":2342},{"type":45,"tag":874,"props":2349,"children":2350},{},[2351],{"type":45,"tag":61,"props":2352,"children":2353},{},[2354,2359,2361,2367],{"type":45,"tag":132,"props":2355,"children":2356},{},[2357],{"type":51,"value":2358},"Key insight",{"type":51,"value":2360},": Running this as a ",{"type":45,"tag":2362,"props":2363,"children":2364},"em",{},[2365],{"type":51,"value":2366},"post-result",{"type":51,"value":2368}," hook (after the agent commits) is more reliable than a pre-commit hook. Pre-commit hooks cause agents to add warnings to the PR description rather than actually fixing the vulnerability.",{"type":45,"tag":61,"props":2370,"children":2371},{},[2372],{"type":45,"tag":132,"props":2373,"children":2374},{},[2375],{"type":51,"value":534},{"type":45,"tag":313,"props":2377,"children":2380},{"className":2378,"code":2379,"language":51},[316],"[Agent finishes work and commits changes]\nHook: Detecting changed dependency files...\n      Changed: package-lock.json\n      Building dependency graphs with `dependabot graph`...\n      3 direct dependencies added: lodash (new) 4.17.15, axios 0.21.1→1.6.0, express 4.17.1→4.18.2\n      1 vulnerability found — requesting agent fix:\n      - Critical — lodash@4.17.15 (GHSA-35jh-r3h4-6jhm: Command Injection → Fix: 4.17.21)\nAgent: Updating package.json to use lodash@4.17.21... ✅ Fixed. Committing changes.\nHook: ✅ All newly-introduced dependencies are clean.\n",[2381],{"type":45,"tag":67,"props":2382,"children":2383},{"__ignoreMap":321},[2384],{"type":51,"value":2379},{"type":45,"tag":54,"props":2386,"children":2388},{"id":2387},"reporting-results",[2389],{"type":51,"value":2390},"Reporting Results",{"type":45,"tag":61,"props":2392,"children":2393},{},[2394,2395,2400],{"type":51,"value":1838},{"type":45,"tag":67,"props":2396,"children":2398},{"className":2397},[],[2399],{"type":51,"value":72},{"type":51,"value":2401}," tool returns a formatted report with ✓\u002F⚠ per dependency, GHSA IDs, severity, and summaries. Present this output directly to the user, supplemented with remediation guidance.",{"type":45,"tag":76,"props":2403,"children":2405},{"id":2404},"severity-legend",[2406],{"type":51,"value":2407},"Severity Legend",{"type":45,"tag":146,"props":2409,"children":2410},{},[2411,2432],{"type":45,"tag":150,"props":2412,"children":2413},{},[2414],{"type":45,"tag":154,"props":2415,"children":2416},{},[2417,2422,2427],{"type":45,"tag":158,"props":2418,"children":2419},{},[2420],{"type":51,"value":2421},"Severity",{"type":45,"tag":158,"props":2423,"children":2424},{},[2425],{"type":51,"value":2426},"CVSS Score",{"type":45,"tag":158,"props":2428,"children":2429},{},[2430],{"type":51,"value":2431},"Action",{"type":45,"tag":174,"props":2433,"children":2434},{},[2435,2453,2471,2489],{"type":45,"tag":154,"props":2436,"children":2437},{},[2438,2443,2448],{"type":45,"tag":181,"props":2439,"children":2440},{},[2441],{"type":51,"value":2442},"Critical",{"type":45,"tag":181,"props":2444,"children":2445},{},[2446],{"type":51,"value":2447},"9.0–10.0",{"type":45,"tag":181,"props":2449,"children":2450},{},[2451],{"type":51,"value":2452},"Fix immediately",{"type":45,"tag":154,"props":2454,"children":2455},{},[2456,2461,2466],{"type":45,"tag":181,"props":2457,"children":2458},{},[2459],{"type":51,"value":2460},"High",{"type":45,"tag":181,"props":2462,"children":2463},{},[2464],{"type":51,"value":2465},"7.0–8.9",{"type":45,"tag":181,"props":2467,"children":2468},{},[2469],{"type":51,"value":2470},"Fix as soon as possible",{"type":45,"tag":154,"props":2472,"children":2473},{},[2474,2479,2484],{"type":45,"tag":181,"props":2475,"children":2476},{},[2477],{"type":51,"value":2478},"Medium",{"type":45,"tag":181,"props":2480,"children":2481},{},[2482],{"type":51,"value":2483},"4.0–6.9",{"type":45,"tag":181,"props":2485,"children":2486},{},[2487],{"type":51,"value":2488},"Schedule fix",{"type":45,"tag":154,"props":2490,"children":2491},{},[2492,2497,2502],{"type":45,"tag":181,"props":2493,"children":2494},{},[2495],{"type":51,"value":2496},"Low",{"type":45,"tag":181,"props":2498,"children":2499},{},[2500],{"type":51,"value":2501},"0.1–3.9",{"type":45,"tag":181,"props":2503,"children":2504},{},[2505],{"type":51,"value":2506},"Track and fix when convenient",{"type":45,"tag":61,"props":2508,"children":2509},{},[2510,2512,2516,2518,2522,2524,2530,2532,2538],{"type":51,"value":2511},"For automated remediation, only block on ",{"type":45,"tag":132,"props":2513,"children":2514},{},[2515],{"type":51,"value":2442},{"type":51,"value":2517}," and ",{"type":45,"tag":132,"props":2519,"children":2520},{},[2521],{"type":51,"value":2460},{"type":51,"value":2523}," severity. Medium and low issues should be reported but should not block the agent's work. Focus remediation on direct dependencies (listed in manifests). Transitive dependencies require updating the parent to a version that pulls in the patched transitive dep, or adding ",{"type":45,"tag":67,"props":2525,"children":2527},{"className":2526},[],[2528],{"type":51,"value":2529},"resolutions",{"type":51,"value":2531}," (Yarn), ",{"type":45,"tag":67,"props":2533,"children":2535},{"className":2534},[],[2536],{"type":51,"value":2537},"overrides",{"type":51,"value":2539}," (npm), or equivalent. For each vulnerability, provide the exact package and target version, the fix command, any breaking-change warnings, and a mitigation if no patch exists.",{"type":45,"tag":54,"props":2541,"children":2543},{"id":2542},"installation",[2544],{"type":51,"value":2545},"Installation",{"type":45,"tag":76,"props":2547,"children":2549},{"id":2548},"prerequisites-inputs",[2550],{"type":51,"value":2551},"Prerequisites & Inputs",{"type":45,"tag":569,"props":2553,"children":2554},{},[2555],{"type":45,"tag":92,"props":2556,"children":2557},{},[2558,2563,2565,2570,2572,2579,2581,2585,2587,2753],{"type":45,"tag":132,"props":2559,"children":2560},{},[2561],{"type":51,"value":2562},"GitHub MCP Server",{"type":51,"value":2564},": The skill requires the GitHub MCP Server with the ",{"type":45,"tag":67,"props":2566,"children":2568},{"className":2567},[],[2569],{"type":51,"value":269},{"type":51,"value":2571}," toolset enabled. This repository includes a default ",{"type":45,"tag":2573,"props":2574,"children":2576},"a",{"href":2575},".\u002F..\u002F..\u002F.mcp.json",[2577],{"type":51,"value":2578},".mcp.json",{"type":51,"value":2580}," configured for the GitHub MCP Server, allowing the skill to communicate with it out of the box.",{"type":45,"tag":2582,"props":2583,"children":2584},"br",{},[],{"type":51,"value":2586},"Configure in your MCP settings:",{"type":45,"tag":313,"props":2588,"children":2592},{"className":2589,"code":2590,"language":2591,"meta":321,"style":321},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"mcpServers\": {\n    \"github\": {\n      \"type\": \"http\",\n      \"url\": \"https:\u002F\u002Fapi.githubcopilot.com\u002Fmcp\u002F\"\n    }\n  }\n}\n","json",[2593],{"type":45,"tag":67,"props":2594,"children":2595},{"__ignoreMap":321},[2596,2604,2631,2655,2696,2729,2737,2745],{"type":45,"tag":613,"props":2597,"children":2598},{"class":615,"line":616},[2599],{"type":45,"tag":613,"props":2600,"children":2601},{"style":670},[2602],{"type":51,"value":2603},"{\n",{"type":45,"tag":613,"props":2605,"children":2606},{"class":615,"line":626},[2607,2612,2618,2622,2626],{"type":45,"tag":613,"props":2608,"children":2609},{"style":670},[2610],{"type":51,"value":2611},"  \"",{"type":45,"tag":613,"props":2613,"children":2615},{"style":2614},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[2616],{"type":51,"value":2617},"mcpServers",{"type":45,"tag":613,"props":2619,"children":2620},{"style":670},[2621],{"type":51,"value":1591},{"type":45,"tag":613,"props":2623,"children":2624},{"style":670},[2625],{"type":51,"value":306},{"type":45,"tag":613,"props":2627,"children":2628},{"style":670},[2629],{"type":51,"value":2630}," {\n",{"type":45,"tag":613,"props":2632,"children":2633},{"class":615,"line":635},[2634,2639,2643,2647,2651],{"type":45,"tag":613,"props":2635,"children":2636},{"style":670},[2637],{"type":51,"value":2638},"    \"",{"type":45,"tag":613,"props":2640,"children":2641},{"style":639},[2642],{"type":51,"value":8},{"type":45,"tag":613,"props":2644,"children":2645},{"style":670},[2646],{"type":51,"value":1591},{"type":45,"tag":613,"props":2648,"children":2649},{"style":670},[2650],{"type":51,"value":306},{"type":45,"tag":613,"props":2652,"children":2653},{"style":670},[2654],{"type":51,"value":2630},{"type":45,"tag":613,"props":2656,"children":2657},{"class":615,"line":27},[2658,2663,2669,2673,2677,2682,2687,2691],{"type":45,"tag":613,"props":2659,"children":2660},{"style":670},[2661],{"type":51,"value":2662},"      \"",{"type":45,"tag":613,"props":2664,"children":2666},{"style":2665},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[2667],{"type":51,"value":2668},"type",{"type":45,"tag":613,"props":2670,"children":2671},{"style":670},[2672],{"type":51,"value":1591},{"type":45,"tag":613,"props":2674,"children":2675},{"style":670},[2676],{"type":51,"value":306},{"type":45,"tag":613,"props":2678,"children":2679},{"style":670},[2680],{"type":51,"value":2681}," \"",{"type":45,"tag":613,"props":2683,"children":2684},{"style":645},[2685],{"type":51,"value":2686},"http",{"type":45,"tag":613,"props":2688,"children":2689},{"style":670},[2690],{"type":51,"value":1591},{"type":45,"tag":613,"props":2692,"children":2693},{"style":670},[2694],{"type":51,"value":2695},",\n",{"type":45,"tag":613,"props":2697,"children":2698},{"class":615,"line":710},[2699,2703,2708,2712,2716,2720,2725],{"type":45,"tag":613,"props":2700,"children":2701},{"style":670},[2702],{"type":51,"value":2662},{"type":45,"tag":613,"props":2704,"children":2705},{"style":2665},[2706],{"type":51,"value":2707},"url",{"type":45,"tag":613,"props":2709,"children":2710},{"style":670},[2711],{"type":51,"value":1591},{"type":45,"tag":613,"props":2713,"children":2714},{"style":670},[2715],{"type":51,"value":306},{"type":45,"tag":613,"props":2717,"children":2718},{"style":670},[2719],{"type":51,"value":2681},{"type":45,"tag":613,"props":2721,"children":2722},{"style":645},[2723],{"type":51,"value":2724},"https:\u002F\u002Fapi.githubcopilot.com\u002Fmcp\u002F",{"type":45,"tag":613,"props":2726,"children":2727},{"style":670},[2728],{"type":51,"value":2168},{"type":45,"tag":613,"props":2730,"children":2731},{"class":615,"line":747},[2732],{"type":45,"tag":613,"props":2733,"children":2734},{"style":670},[2735],{"type":51,"value":2736},"    }\n",{"type":45,"tag":613,"props":2738,"children":2739},{"class":615,"line":784},[2740],{"type":45,"tag":613,"props":2741,"children":2742},{"style":670},[2743],{"type":51,"value":2744},"  }\n",{"type":45,"tag":613,"props":2746,"children":2747},{"class":615,"line":804},[2748],{"type":45,"tag":613,"props":2749,"children":2750},{"style":670},[2751],{"type":51,"value":2752},"}\n",{"type":45,"tag":874,"props":2754,"children":2755},{},[2756],{"type":45,"tag":61,"props":2757,"children":2758},{},[2759,2763,2765,2771,2773,2778],{"type":45,"tag":132,"props":2760,"children":2761},{},[2762],{"type":51,"value":1803},{"type":51,"value":2764}," Cursor uses ",{"type":45,"tag":67,"props":2766,"children":2768},{"className":2767},[],[2769],{"type":51,"value":2770},"servers",{"type":51,"value":2772}," instead of ",{"type":45,"tag":67,"props":2774,"children":2776},{"className":2775},[],[2777],{"type":51,"value":2617},{"type":51,"value":2779}," as the top-level key.",{"type":45,"tag":61,"props":2781,"children":2782},{},[2783,2788],{"type":45,"tag":132,"props":2784,"children":2785},{},[2786],{"type":51,"value":2787},"Required information for scanning",{"type":51,"value":306},{"type":45,"tag":88,"props":2790,"children":2791},{},[2792,2810],{"type":45,"tag":92,"props":2793,"children":2794},{},[2795,2800,2802,2808],{"type":45,"tag":132,"props":2796,"children":2797},{},[2798],{"type":51,"value":2799},"Repository owner",{"type":51,"value":2801},": Usually available from ",{"type":45,"tag":67,"props":2803,"children":2805},{"className":2804},[],[2806],{"type":51,"value":2807},"git remote get-url origin",{"type":51,"value":2809}," or ask the user",{"type":45,"tag":92,"props":2811,"children":2812},{},[2813,2818,2819,2824],{"type":45,"tag":132,"props":2814,"children":2815},{},[2816],{"type":51,"value":2817},"Repository name",{"type":51,"value":2801},{"type":45,"tag":67,"props":2820,"children":2822},{"className":2821},[],[2823],{"type":51,"value":2807},{"type":51,"value":2809},{"type":45,"tag":569,"props":2826,"children":2827},{"start":626},[2828],{"type":45,"tag":92,"props":2829,"children":2830},{},[2831,2836,2838],{"type":45,"tag":132,"props":2832,"children":2833},{},[2834],{"type":51,"value":2835},"Optional — Dependabot CLI",{"type":51,"value":2837},": Required for the Post-Commit Safety Net use case. Ask the user before downloading.",{"type":45,"tag":313,"props":2839,"children":2841},{"className":605,"code":2840,"language":607,"meta":321,"style":321},"# Check if already installed\nwhich dependabot 2>\u002Fdev\u002Fnull && dependabot --version\n\n# Install via Go\ngo install github.com\u002Fdependabot\u002Fcli\u002Fcmd\u002Fdependabot@latest\n\n# Or download a prebuilt binary from GitHub releases (Linux\u002FmacOS\u002FWindows, amd64\u002Farm64)\n# https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli\u002Freleases\nPLATFORM=\"linux\"   # or \"darwin\" or \"windows\"\nARCH=\"amd64\"       # or \"arm64\"\nVERSION=$(curl -s https:\u002F\u002Fapi.github.com\u002Frepos\u002Fdependabot\u002Fcli\u002Freleases\u002Flatest | grep tag_name | cut -d '\"' -f4)\ncurl -fsSL -o dependabot.tar.gz \\\n  \"https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli\u002Freleases\u002Fdownload\u002F${VERSION}\u002Fdependabot-${VERSION}-${PLATFORM}-${ARCH}.tar.gz\"\ntar xzf dependabot.tar.gz\nchmod +x dependabot\nmv dependabot \u002Fusr\u002Flocal\u002Fbin\u002F\n",[2842],{"type":45,"tag":67,"props":2843,"children":2844},{"__ignoreMap":321},[2845,2853,2890,2897,2905,2923,2930,2938,2946,2976,3006,3084,3110,3195,3213,3231],{"type":45,"tag":613,"props":2846,"children":2847},{"class":615,"line":616},[2848],{"type":45,"tag":613,"props":2849,"children":2850},{"style":620},[2851],{"type":51,"value":2852},"# Check if already installed\n",{"type":45,"tag":613,"props":2854,"children":2855},{"class":615,"line":626},[2856,2862,2867,2871,2876,2881,2885],{"type":45,"tag":613,"props":2857,"children":2859},{"style":2858},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[2860],{"type":51,"value":2861},"which",{"type":45,"tag":613,"props":2863,"children":2864},{"style":645},[2865],{"type":51,"value":2866}," dependabot",{"type":45,"tag":613,"props":2868,"children":2869},{"style":670},[2870],{"type":51,"value":1658},{"type":45,"tag":613,"props":2872,"children":2873},{"style":645},[2874],{"type":51,"value":2875},"\u002Fdev\u002Fnull",{"type":45,"tag":613,"props":2877,"children":2878},{"style":670},[2879],{"type":51,"value":2880}," &&",{"type":45,"tag":613,"props":2882,"children":2883},{"style":639},[2884],{"type":51,"value":2866},{"type":45,"tag":613,"props":2886,"children":2887},{"style":645},[2888],{"type":51,"value":2889}," --version\n",{"type":45,"tag":613,"props":2891,"children":2892},{"class":615,"line":635},[2893],{"type":45,"tag":613,"props":2894,"children":2895},{"emptyLinePlaceholder":1610},[2896],{"type":51,"value":1613},{"type":45,"tag":613,"props":2898,"children":2899},{"class":615,"line":27},[2900],{"type":45,"tag":613,"props":2901,"children":2902},{"style":620},[2903],{"type":51,"value":2904},"# Install via Go\n",{"type":45,"tag":613,"props":2906,"children":2907},{"class":615,"line":710},[2908,2913,2918],{"type":45,"tag":613,"props":2909,"children":2910},{"style":639},[2911],{"type":51,"value":2912},"go",{"type":45,"tag":613,"props":2914,"children":2915},{"style":645},[2916],{"type":51,"value":2917}," install",{"type":45,"tag":613,"props":2919,"children":2920},{"style":645},[2921],{"type":51,"value":2922}," github.com\u002Fdependabot\u002Fcli\u002Fcmd\u002Fdependabot@latest\n",{"type":45,"tag":613,"props":2924,"children":2925},{"class":615,"line":747},[2926],{"type":45,"tag":613,"props":2927,"children":2928},{"emptyLinePlaceholder":1610},[2929],{"type":51,"value":1613},{"type":45,"tag":613,"props":2931,"children":2932},{"class":615,"line":784},[2933],{"type":45,"tag":613,"props":2934,"children":2935},{"style":620},[2936],{"type":51,"value":2937},"# Or download a prebuilt binary from GitHub releases (Linux\u002FmacOS\u002FWindows, amd64\u002Farm64)\n",{"type":45,"tag":613,"props":2939,"children":2940},{"class":615,"line":804},[2941],{"type":45,"tag":613,"props":2942,"children":2943},{"style":620},[2944],{"type":51,"value":2945},"# https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli\u002Freleases\n",{"type":45,"tag":613,"props":2947,"children":2948},{"class":615,"line":1715},[2949,2954,2958,2962,2967,2971],{"type":45,"tag":613,"props":2950,"children":2951},{"style":661},[2952],{"type":51,"value":2953},"PLATFORM",{"type":45,"tag":613,"props":2955,"children":2956},{"style":670},[2957],{"type":51,"value":1586},{"type":45,"tag":613,"props":2959,"children":2960},{"style":670},[2961],{"type":51,"value":1591},{"type":45,"tag":613,"props":2963,"children":2964},{"style":645},[2965],{"type":51,"value":2966},"linux",{"type":45,"tag":613,"props":2968,"children":2969},{"style":670},[2970],{"type":51,"value":1591},{"type":45,"tag":613,"props":2972,"children":2973},{"style":620},[2974],{"type":51,"value":2975},"   # or \"darwin\" or \"windows\"\n",{"type":45,"tag":613,"props":2977,"children":2978},{"class":615,"line":1724},[2979,2984,2988,2992,2997,3001],{"type":45,"tag":613,"props":2980,"children":2981},{"style":661},[2982],{"type":51,"value":2983},"ARCH",{"type":45,"tag":613,"props":2985,"children":2986},{"style":670},[2987],{"type":51,"value":1586},{"type":45,"tag":613,"props":2989,"children":2990},{"style":670},[2991],{"type":51,"value":1591},{"type":45,"tag":613,"props":2993,"children":2994},{"style":645},[2995],{"type":51,"value":2996},"amd64",{"type":45,"tag":613,"props":2998,"children":2999},{"style":670},[3000],{"type":51,"value":1591},{"type":45,"tag":613,"props":3002,"children":3003},{"style":620},[3004],{"type":51,"value":3005},"       # or \"arm64\"\n",{"type":45,"tag":613,"props":3007,"children":3008},{"class":615,"line":1749},[3009,3014,3019,3024,3029,3034,3039,3043,3048,3052,3057,3062,3066,3070,3074,3079],{"type":45,"tag":613,"props":3010,"children":3011},{"style":661},[3012],{"type":51,"value":3013},"VERSION",{"type":45,"tag":613,"props":3015,"children":3016},{"style":670},[3017],{"type":51,"value":3018},"=$(",{"type":45,"tag":613,"props":3020,"children":3021},{"style":639},[3022],{"type":51,"value":3023},"curl",{"type":45,"tag":613,"props":3025,"children":3026},{"style":645},[3027],{"type":51,"value":3028}," -s",{"type":45,"tag":613,"props":3030,"children":3031},{"style":645},[3032],{"type":51,"value":3033}," https:\u002F\u002Fapi.github.com\u002Frepos\u002Fdependabot\u002Fcli\u002Freleases\u002Flatest",{"type":45,"tag":613,"props":3035,"children":3036},{"style":670},[3037],{"type":51,"value":3038}," |",{"type":45,"tag":613,"props":3040,"children":3041},{"style":639},[3042],{"type":51,"value":678},{"type":45,"tag":613,"props":3044,"children":3045},{"style":645},[3046],{"type":51,"value":3047}," tag_name",{"type":45,"tag":613,"props":3049,"children":3050},{"style":670},[3051],{"type":51,"value":3038},{"type":45,"tag":613,"props":3053,"children":3054},{"style":639},[3055],{"type":51,"value":3056}," cut",{"type":45,"tag":613,"props":3058,"children":3059},{"style":645},[3060],{"type":51,"value":3061}," -d",{"type":45,"tag":613,"props":3063,"children":3064},{"style":670},[3065],{"type":51,"value":693},{"type":45,"tag":613,"props":3067,"children":3068},{"style":645},[3069],{"type":51,"value":1591},{"type":45,"tag":613,"props":3071,"children":3072},{"style":670},[3073],{"type":51,"value":703},{"type":45,"tag":613,"props":3075,"children":3076},{"style":645},[3077],{"type":51,"value":3078}," -f4",{"type":45,"tag":613,"props":3080,"children":3081},{"style":670},[3082],{"type":51,"value":3083},")\n",{"type":45,"tag":613,"props":3085,"children":3086},{"class":615,"line":1757},[3087,3091,3096,3101,3106],{"type":45,"tag":613,"props":3088,"children":3089},{"style":639},[3090],{"type":51,"value":3023},{"type":45,"tag":613,"props":3092,"children":3093},{"style":645},[3094],{"type":51,"value":3095}," -fsSL",{"type":45,"tag":613,"props":3097,"children":3098},{"style":645},[3099],{"type":51,"value":3100}," -o",{"type":45,"tag":613,"props":3102,"children":3103},{"style":645},[3104],{"type":51,"value":3105}," dependabot.tar.gz",{"type":45,"tag":613,"props":3107,"children":3108},{"style":661},[3109],{"type":51,"value":664},{"type":45,"tag":613,"props":3111,"children":3112},{"class":615,"line":1766},[3113,3117,3122,3127,3131,3136,3141,3145,3149,3153,3158,3162,3166,3170,3174,3178,3182,3186,3191],{"type":45,"tag":613,"props":3114,"children":3115},{"style":670},[3116],{"type":51,"value":2611},{"type":45,"tag":613,"props":3118,"children":3119},{"style":645},[3120],{"type":51,"value":3121},"https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli\u002Freleases\u002Fdownload\u002F",{"type":45,"tag":613,"props":3123,"children":3124},{"style":670},[3125],{"type":51,"value":3126},"${",{"type":45,"tag":613,"props":3128,"children":3129},{"style":661},[3130],{"type":51,"value":3013},{"type":45,"tag":613,"props":3132,"children":3133},{"style":670},[3134],{"type":51,"value":3135},"}",{"type":45,"tag":613,"props":3137,"children":3138},{"style":645},[3139],{"type":51,"value":3140},"\u002Fdependabot-",{"type":45,"tag":613,"props":3142,"children":3143},{"style":670},[3144],{"type":51,"value":3126},{"type":45,"tag":613,"props":3146,"children":3147},{"style":661},[3148],{"type":51,"value":3013},{"type":45,"tag":613,"props":3150,"children":3151},{"style":670},[3152],{"type":51,"value":3135},{"type":45,"tag":613,"props":3154,"children":3155},{"style":645},[3156],{"type":51,"value":3157},"-",{"type":45,"tag":613,"props":3159,"children":3160},{"style":670},[3161],{"type":51,"value":3126},{"type":45,"tag":613,"props":3163,"children":3164},{"style":661},[3165],{"type":51,"value":2953},{"type":45,"tag":613,"props":3167,"children":3168},{"style":670},[3169],{"type":51,"value":3135},{"type":45,"tag":613,"props":3171,"children":3172},{"style":645},[3173],{"type":51,"value":3157},{"type":45,"tag":613,"props":3175,"children":3176},{"style":670},[3177],{"type":51,"value":3126},{"type":45,"tag":613,"props":3179,"children":3180},{"style":661},[3181],{"type":51,"value":2983},{"type":45,"tag":613,"props":3183,"children":3184},{"style":670},[3185],{"type":51,"value":3135},{"type":45,"tag":613,"props":3187,"children":3188},{"style":645},[3189],{"type":51,"value":3190},".tar.gz",{"type":45,"tag":613,"props":3192,"children":3193},{"style":670},[3194],{"type":51,"value":2168},{"type":45,"tag":613,"props":3196,"children":3197},{"class":615,"line":2013},[3198,3203,3208],{"type":45,"tag":613,"props":3199,"children":3200},{"style":639},[3201],{"type":51,"value":3202},"tar",{"type":45,"tag":613,"props":3204,"children":3205},{"style":645},[3206],{"type":51,"value":3207}," xzf",{"type":45,"tag":613,"props":3209,"children":3210},{"style":645},[3211],{"type":51,"value":3212}," dependabot.tar.gz\n",{"type":45,"tag":613,"props":3214,"children":3215},{"class":615,"line":23},[3216,3221,3226],{"type":45,"tag":613,"props":3217,"children":3218},{"style":639},[3219],{"type":51,"value":3220},"chmod",{"type":45,"tag":613,"props":3222,"children":3223},{"style":645},[3224],{"type":51,"value":3225}," +x",{"type":45,"tag":613,"props":3227,"children":3228},{"style":645},[3229],{"type":51,"value":3230}," dependabot\n",{"type":45,"tag":613,"props":3232,"children":3233},{"class":615,"line":2030},[3234,3239,3243],{"type":45,"tag":613,"props":3235,"children":3236},{"style":639},[3237],{"type":51,"value":3238},"mv",{"type":45,"tag":613,"props":3240,"children":3241},{"style":645},[3242],{"type":51,"value":2866},{"type":45,"tag":613,"props":3244,"children":3245},{"style":645},[3246],{"type":51,"value":3247}," \u002Fusr\u002Flocal\u002Fbin\u002F\n",{"type":45,"tag":54,"props":3249,"children":3251},{"id":3250},"scanning-transparency",[3252],{"type":51,"value":3253},"Scanning Transparency",{"type":45,"tag":76,"props":3255,"children":3257},{"id":3256},"how-your-data-is-processed",[3258],{"type":51,"value":3259},"How your data is processed",{"type":45,"tag":88,"props":3261,"children":3262},{},[3263,3273,3290],{"type":45,"tag":92,"props":3264,"children":3265},{},[3266,3271],{"type":45,"tag":132,"props":3267,"children":3268},{},[3269],{"type":51,"value":3270},"Dependabot alerts approach",{"type":51,"value":3272},": Only the repository owner\u002Fname is sent to the GitHub MCP Server. Dependency data is already stored by GitHub.",{"type":45,"tag":92,"props":3274,"children":3275},{},[3276,3281,3283,3288],{"type":45,"tag":132,"props":3277,"children":3278},{},[3279],{"type":51,"value":3280},"Vulnerability check approach",{"type":51,"value":3282},": Package names, versions, and ecosystems are sent to the GitHub MCP Server's ",{"type":45,"tag":67,"props":3284,"children":3286},{"className":3285},[],[3287],{"type":51,"value":72},{"type":51,"value":3289}," tool, which queries the GitHub Advisory Database.",{"type":45,"tag":92,"props":3291,"children":3292},{},[3293,3298],{"type":45,"tag":132,"props":3294,"children":3295},{},[3296],{"type":51,"value":3297},"Dependabot CLI approach",{"type":51,"value":3299},": Dependency information is processed locally. Network requests go to package registries.",{"type":45,"tag":54,"props":3301,"children":3303},{"id":3302},"learn-more",[3304],{"type":51,"value":3305},"Learn More",{"type":45,"tag":61,"props":3307,"children":3308},{},[3309],{"type":51,"value":3310},"For more details on dependency security, vulnerability scanning, and GitHub security features:",{"type":45,"tag":88,"props":3312,"children":3313},{},[3314,3327,3339,3351,3362],{"type":45,"tag":92,"props":3315,"children":3316},{},[3317,3325],{"type":45,"tag":2573,"props":3318,"children":3322},{"href":3319,"rel":3320},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fdependabot",[3321],"nofollow",[3323],{"type":51,"value":3324},"GitHub Dependabot Documentation",{"type":51,"value":3326},": How to configure and use Dependabot for automated dependency updates",{"type":45,"tag":92,"props":3328,"children":3329},{},[3330,3337],{"type":45,"tag":2573,"props":3331,"children":3334},{"href":3332,"rel":3333},"https:\u002F\u002Fgithub.com\u002Fadvisories",[3321],[3335],{"type":51,"value":3336},"GitHub Advisory Database",{"type":51,"value":3338},": Browse known vulnerabilities across ecosystems",{"type":45,"tag":92,"props":3340,"children":3341},{},[3342,3349],{"type":45,"tag":2573,"props":3343,"children":3346},{"href":3344,"rel":3345},"https:\u002F\u002Fgithub.com\u002Fdependabot\u002Fcli",[3321],[3347],{"type":51,"value":3348},"Dependabot CLI",{"type":51,"value":3350},": Run Dependabot locally for offline dependency analysis",{"type":45,"tag":92,"props":3352,"children":3353},{},[3354,3360],{"type":45,"tag":2573,"props":3355,"children":3358},{"href":3356,"rel":3357},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fgithub-mcp-server",[3321],[3359],{"type":51,"value":2562},{"type":51,"value":3361},": The MCP server that powers this skill's integration",{"type":45,"tag":92,"props":3363,"children":3364},{},[3365,3372],{"type":45,"tag":2573,"props":3366,"children":3369},{"href":3367,"rel":3368},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Fsecurity-advisories",[3321],[3370],{"type":51,"value":3371},"GHSA (GitHub Security Advisories)",{"type":51,"value":3373},": Understanding GitHub Security Advisory identifiers",{"type":45,"tag":3375,"props":3376,"children":3377},"style",{},[3378],{"type":51,"value":3379},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3381,"total":3560},[3382,3406,3424,3440,3454,3470,3484,3496,3508,3520,3536,3548],{"slug":3383,"name":3383,"fn":3384,"description":3385,"org":3386,"tags":3387,"stars":3403,"repoUrl":3404,"updatedAt":3405},"qdrant-horizontal-scaling","guide Qdrant horizontal scaling decisions","Diagnoses and guides Qdrant horizontal scaling decisions. Use when someone asks 'vertical or horizontal?', 'how many nodes?', 'how many shards?', 'how to add nodes', 'resharding', 'data doesn't fit', or 'need more capacity'. Also use when data growth outpaces current deployment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3388,3391,3394,3397,3400],{"name":3389,"slug":3390,"type":15},"AI Infrastructure","ai-infrastructure",{"name":3392,"slug":3393,"type":15},"Architecture","architecture",{"name":3395,"slug":3396,"type":15},"Capacity Planning","capacity-planning",{"name":3398,"slug":3399,"type":15},"Database","database",{"name":3401,"slug":3402,"type":15},"Qdrant","qdrant",36978,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","2026-04-18T04:46:16.349561",{"slug":3407,"name":3407,"fn":3408,"description":3409,"org":3410,"tags":3411,"stars":3403,"repoUrl":3404,"updatedAt":3423},"qdrant-indexing-performance-optimization","optimize Qdrant indexing performance","Diagnoses and fixes slow Qdrant indexing and data ingestion. Use when someone reports 'uploads are slow', 'indexing takes forever', 'optimizer is stuck', 'HNSW build time too long', or 'data uploaded but search is bad'. Also use when optimizer status shows errors, segments won't merge, or indexing threshold questions arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3412,3415,3416,3419,3422],{"name":3413,"slug":3414,"type":15},"Data Engineering","data-engineering",{"name":3398,"slug":3399,"type":15},{"name":3417,"slug":3418,"type":15},"ETL","etl",{"name":3420,"slug":3421,"type":15},"Performance","performance",{"name":3401,"slug":3402,"type":15},"2026-04-18T04:46:02.766357",{"slug":3425,"name":3425,"fn":3426,"description":3427,"org":3428,"tags":3429,"stars":3403,"repoUrl":3404,"updatedAt":3439},"qdrant-memory-usage-optimization","optimize Qdrant memory usage","Diagnoses and reduces Qdrant memory usage. Use when someone reports 'memory too high', 'RAM keeps growing', 'node crashed', 'out of memory', 'memory leak', or asks 'why is memory usage so high?', 'how to reduce RAM?'. Also use when memory doesn't match calculations, quantization didn't help, or nodes crash during recovery.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3430,3433,3434,3437,3438],{"name":3431,"slug":3432,"type":15},"Cost Optimization","cost-optimization",{"name":3398,"slug":3399,"type":15},{"name":3435,"slug":3436,"type":15},"Observability","observability",{"name":3420,"slug":3421,"type":15},{"name":3401,"slug":3402,"type":15},"2026-04-18T04:46:01.525023",{"slug":3441,"name":3441,"fn":3442,"description":3443,"org":3444,"tags":3445,"stars":3403,"repoUrl":3404,"updatedAt":3453},"qdrant-minimize-latency","minimize Qdrant query latency","Guides Qdrant query latency optimization. Use when someone asks 'search is slow', 'how to reduce latency', 'p99 is too high', 'tail latency', 'single query too slow', 'how to make search faster', or 'latency spikes'.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3446,3447,3448,3449,3450],{"name":3392,"slug":3393,"type":15},{"name":3398,"slug":3399,"type":15},{"name":3420,"slug":3421,"type":15},{"name":3401,"slug":3402,"type":15},{"name":3451,"slug":3452,"type":15},"Search","search","2026-04-18T04:46:10.126667",{"slug":3455,"name":3455,"fn":3456,"description":3457,"org":3458,"tags":3459,"stars":3403,"repoUrl":3404,"updatedAt":3469},"qdrant-monitoring-debugging","debug Qdrant production issues with metrics","Diagnoses Qdrant production issues using metrics and observability tools. Use when someone reports 'optimizer stuck', 'indexing too slow', 'memory too high', 'OOM crash', 'queries are slow', 'latency spike', or 'search was fast now it's slow'. Also use when performance degrades without obvious config changes.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3460,3463,3466,3467,3468],{"name":3461,"slug":3462,"type":15},"Debugging","debugging",{"name":3464,"slug":3465,"type":15},"Monitoring","monitoring",{"name":3435,"slug":3436,"type":15},{"name":3420,"slug":3421,"type":15},{"name":3401,"slug":3402,"type":15},"2026-04-18T04:46:06.450784",{"slug":3471,"name":3471,"fn":3472,"description":3473,"org":3474,"tags":3475,"stars":3403,"repoUrl":3404,"updatedAt":3483},"qdrant-monitoring-setup","set up Qdrant monitoring and alerting","Guides Qdrant monitoring setup including Prometheus scraping, health probes, Hybrid Cloud metrics, alerting, and log centralization. Use when someone asks 'how to set up monitoring', 'Prometheus config', 'Grafana dashboard', 'health check endpoints', 'how to scrape Hybrid Cloud', 'what alerts to set', 'how to centralize logs', or 'audit logging'.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3476,3477,3478,3479,3480],{"name":3389,"slug":3390,"type":15},{"name":3464,"slug":3465,"type":15},{"name":3435,"slug":3436,"type":15},{"name":3401,"slug":3402,"type":15},{"name":3481,"slug":3482,"type":15},"SRE","sre","2026-04-18T04:46:05.217192",{"slug":3485,"name":3485,"fn":3486,"description":3487,"org":3488,"tags":3489,"stars":3403,"repoUrl":3404,"updatedAt":3495},"qdrant-scaling-data-volume","scale Qdrant data volume","Guides Qdrant data volume scaling decisions. Use when someone asks 'data doesn't fit on one node', 'too much data', 'need more storage', 'vertical or horizontal scaling', 'tenant scaling', 'time window rotation', or 'data growth exceeds capacity'.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3490,3491,3492,3493,3494],{"name":3389,"slug":3390,"type":15},{"name":3392,"slug":3393,"type":15},{"name":3395,"slug":3396,"type":15},{"name":3398,"slug":3399,"type":15},{"name":3401,"slug":3402,"type":15},"2026-04-18T04:46:07.684464",{"slug":3497,"name":3497,"fn":3498,"description":3499,"org":3500,"tags":3501,"stars":3403,"repoUrl":3404,"updatedAt":3507},"qdrant-scaling-qps","scale Qdrant query throughput","Guides Qdrant query throughput (QPS) scaling. Use when someone asks 'how to increase QPS', 'need more throughput', 'queries per second too low', 'batch search', 'read replicas', or 'how to handle more concurrent queries'.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3502,3503,3504,3505,3506],{"name":3389,"slug":3390,"type":15},{"name":3392,"slug":3393,"type":15},{"name":3398,"slug":3399,"type":15},{"name":3420,"slug":3421,"type":15},{"name":3401,"slug":3402,"type":15},"2026-04-18T04:46:08.905219",{"slug":3509,"name":3509,"fn":3510,"description":3511,"org":3512,"tags":3513,"stars":3403,"repoUrl":3404,"updatedAt":3519},"qdrant-scaling-query-volume","scale Qdrant query volume and pagination","Guides Qdrant query volume scaling. Use when someone asks 'query returns too many results', 'scroll performance', 'large limit values', 'paginating search results', 'fetching many vectors', or 'high cardinality results'.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3514,3515,3516,3517,3518],{"name":3392,"slug":3393,"type":15},{"name":3398,"slug":3399,"type":15},{"name":3420,"slug":3421,"type":15},{"name":3401,"slug":3402,"type":15},{"name":3451,"slug":3452,"type":15},"2026-04-18T04:46:11.371326",{"slug":3521,"name":3521,"fn":3522,"description":3523,"org":3524,"tags":3525,"stars":3403,"repoUrl":3404,"updatedAt":3535},"qdrant-search-quality-diagnosis","diagnose Qdrant search quality issues","Diagnoses Qdrant search quality issues. Use when someone reports 'results are bad', 'wrong results', 'not relevant results', 'missing matches', 'recall is low', 'approximate search worse than exact', 'which embedding model', or 'quality dropped after quantization'. Also use when search quality degrades without obvious changes.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3526,3529,3532,3533,3534],{"name":3527,"slug":3528,"type":15},"Analytics","analytics",{"name":3530,"slug":3531,"type":15},"Data Quality","data-quality",{"name":3461,"slug":3462,"type":15},{"name":3401,"slug":3402,"type":15},{"name":3451,"slug":3452,"type":15},"2026-04-18T04:46:17.579894",{"slug":3537,"name":3537,"fn":3538,"description":3539,"org":3540,"tags":3541,"stars":3403,"repoUrl":3404,"updatedAt":3547},"qdrant-search-speed-optimization","optimize Qdrant search speed","Diagnoses and fixes slow Qdrant search. Use when someone reports 'search is slow', 'high latency', 'queries take too long', 'low QPS', 'throughput too low', 'filtered search is slow', or 'search was fast but now it's slow'. Also use when search performance degrades after config changes or data growth.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3542,3543,3544,3545,3546],{"name":3527,"slug":3528,"type":15},{"name":3398,"slug":3399,"type":15},{"name":3420,"slug":3421,"type":15},{"name":3401,"slug":3402,"type":15},{"name":3451,"slug":3452,"type":15},"2026-04-18T04:46:03.987332",{"slug":3549,"name":3549,"fn":3550,"description":3551,"org":3552,"tags":3553,"stars":3403,"repoUrl":3404,"updatedAt":3559},"qdrant-search-strategies","select optimal Qdrant search strategies","Guides Qdrant search strategy selection. Use when someone asks 'should I use hybrid search?', 'BM25 or sparse vectors?', 'how to rerank?', 'results are not relevant', 'I don't get needed results from my dataset but they're there', 'retrieval quality is not good enough', 'results too similar', 'need diversity', 'MMR', 'relevance feedback', 'recommendation API', 'discovery API', 'ColBERT reranking', or 'missing keyword matches'",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3554,3555,3556,3557,3558],{"name":3389,"slug":3390,"type":15},{"name":3527,"slug":3528,"type":15},{"name":3392,"slug":3393,"type":15},{"name":3401,"slug":3402,"type":15},{"name":3451,"slug":3452,"type":15},"2026-04-18T04:46:18.812306",45,{"items":3562,"total":626},[3563,3570],{"slug":4,"name":4,"fn":5,"description":6,"org":3564,"tags":3565,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3566,3567,3568,3569],{"name":18,"slug":19,"type":15},{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":21,"slug":22,"type":15},{"slug":3571,"name":3571,"fn":3572,"description":3573,"org":3574,"tags":3575,"stars":23,"repoUrl":24,"updatedAt":3579},"secret-scanning","scan files for secrets and credentials","Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3576,3577,3578],{"name":18,"slug":19,"type":15},{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},"2026-06-10T07:32:58.120497"]