safe-version

# Vulnetix Safe Version Skill ## Use when - Picking the upgrade target: "what is the newest safe version of express?". - Building a pnpm/yarn override block with the safe version as the target. - Evaluating major-version churn — `--max-major-bump 1` keeps you near the current major. - Cross-checking which versions in a range are actually clean (the safe set is sometimes non-contiguous). - Pre-pin decision: would pinning to vX.Y skip a known-vulnerable interval? ## Don't use for - Listing every version — use `vulnetix vdb versions <package>`. - Applying the bump — use `/vulnetix:fix` or `/vulnetix:dep-resolve`. - Single-CVE lookup — use `/vulnetix:vuln`. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Load capabilities Default `--ecosystem` from `derived.primary_package_manager`. ## Step 2: Pull versions and vulns ```bash vulnetix vdb versions "$PACKAGE" --ecosystem "$ECO" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/versions.jq" vulnetix vdb vulns "$PACKAGE" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/vulns.jq" vulnetix vdb purl "pkg:${ECO...