Skip to content

dependabot-triage v2.1.0

Choose a tag to compare

View all tags
@akshayrao14 akshayrao14 released this 07 May 05:38
· 26 commits to main since this release
v2.1.0
cf521cd

First tagged release of the dependabot-triage Claude Code skill.

Install

npx skills add akshayrao14/git-practices

Highlights

  • Two modes — Standard (defensive) and Fast-Track (low-risk).
  • Defensive minimal-patched versioning — smallest version that supersets every CVE patch in the cluster, not "latest in same major".
  • Exposure mapping — every import site bucketed into Public/API · Client-Bundle · Internal/Dev. Replaces heuristic reachability guessing.
  • Mandatory lockfile parity check between package-lock.json and pnpm-lock.yaml. Mismatch aborts the PR.
  • Changelog scrape with safety interlock (Standard mode) — flags BREAKING / DEPRECATED / MIGRATION and pauses for explicit user OK.
  • Auto-reversion — Fast-Track failures fall back to Standard mode rather than blind retries.
  • Lockfile coverage — npm, pnpm, yarn, bun.

Scope

JavaScript / TypeScript repos. Node.js services AND browser frontends.

Assets 2
Loading