dep-bumplisted

# Dependency Bump (CVE Override Batch) Apply one or more pnpm.overrides entries to fix CVEs in transitive dependencies, verify the audit passes, and open a single PR. ## When to use - Multiple Dependabot alerts for transitive dependency CVEs - `pnpm audit --audit-level=high` failing in CI Build job - Security issues labeled `ready` with `fix(deps): bump` titles ## Input Either: - A list of overrides to apply (e.g., from issue bodies) - Or no args — the skill scans `pnpm audit --audit-level=high` and proposes overrides automatically ## Workflow ### 1. Scan for vulnerabilities ```bash pnpm audit --audit-level=high 2>&1 ``` If no high-severity vulnerabilities, report clean and stop. ### 2. Build override entries For each vulnerability, construct the scoped override per gotchas: ``` "pkg@<patched": "^patched" ``` **NOT** the open-range form `"pkg": ">=patched"` — that can pull major bumps. ### 3. Apply overrides Edit the `pnpm.overrides` block in the root `package.json`. Add new entries; update existing entries if the patched version is higher. ### 4. Install and verify ```bash pnpm install --lockfile-only pnpm audit --audit-level=high ``` If high-severity vulnerabilities remain, iterate — some CVEs chain (e.g., `form-data` fixed but `tmp` still vulnerable). ### 5. Update antipattern baseline ```bash node scripts/check-ai-antipatterns.mjs ``` If the ratchet shows pre-existing regressions (not from your changes), update the baseline: ```bash node scripts/che