dep-resolve

# Vulnetix Dependency Resolution Skill ## Use when - `/vulnetix:fix` proposed a version bump but `<pm> install` errored on peer-dep conflict. - A transitive vulnerable dep needs pinning without bumping the direct dependency. - Lockfile resolution fails after a merge — diagnose which deps disagree. - Considering a package-manager override (`npm overrides`, `pnpm overrides`, `yarn resolutions`). - Last-resort: copy patched upstream code inline as first-party (Type A0 inline). ## Don't use for - Initial fix proposal — use `/vulnetix:fix` first. - Just looking up safe versions — use `/vulnetix:safe-version`. - Multi-CVE upgrade orchestration — use `@dep-upgrade-orchestrator`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. When `/vulnetix:fix` proposes a version bump but the lockfile resolution fails (peer-dep conflict, transitive constraint, etc.), use this skill to find a compatible set. ## Step 1: Load capabilities + memory Read `.vulnetix/capabilities.yaml` (`derived.primary_package_manager` decides which lockfile to read) and `.vulnetix/memory.yaml` (decisions / safe-h...