Results for “lockfile”

Use when synchronizing frontend project documentation with source-of-truth files such as package.json, lockfiles, config, env examples, routes, API clients or server routes, schemas, components, tests, CI, build/deploy config, ADRs, changelogs, or migration notes. Do not use for general prose polishing only; Chinese triggers include document synchronization, update README, docs sync, environment variable documentation, command list, API Document synchronization.

The English summary is being prepared. Showing the original description.

Reviews open Dependabot PRs, classifies by risk (patch/minor/major, security, lockfile-only), and merges safe ones or advises on what to do. Use when user mentions "dependabot", "dependabot PRs", "dependency updates", "merge dependabot", "review dependabot", "dependency PRs", "bump PRs", "update dependencies", or runs /dependabot-review command.

The English summary is being prepared. Showing the original description.

Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.

The English summary is being prepared. Showing the original description.

Deep behavioral security audit for AI agent skills and MCP tools. Performs deterministic static analysis (AST + Semgrep + 15 specialized scanners), cryptographic lockfile generation, and optional LLM-powered intent analysis. Use when installing, reviewing, or approving any skill, tool, plugin, or MCP server — especially before first use. Replaces basic safety summaries with full CWE-mapped, OWASP-tagged, line-referenced security reports.

The English summary is being prepared. Showing the original description.

Apply npm/pnpm supply-chain hardening when adding a dependency, editing package.json/.npmrc/pnpm-workspace.yaml, reviewing a lockfile change, or configuring CI install steps. Covers the 17 practices from lirantal/npm-security-best-practices.

The English summary is being prepared. Showing the original description.

Use when the operator asks to upgrade deps, Python, uv, pyproject or the lockfile; moves them all to upstream at once.

The English summary is being prepared. Showing the original description.

Update npm/yarn/pnpm dependencies using manifest-first, lockfile-aware workflows. Prefer declared version bumps over resolution overrides. Use when updating, upgrading, or patching dependencies; fixing transitive dependency versions; addressing npm audit or CVE findings; or removing stale overrides.

The English summary is being prepared. Showing the original description.

Dependency and license audit: production-level SBOM, lockfile, trust, copy restrictions. Use when implementing, reviewing or testing dependency and license audit for React, Vite, Next.js or Perfect_AI projects.

The English summary is being prepared. Showing the original description.

GitHub 公式ドキュメント (docs.github.com)。REST API, GraphQL, Webhooks, GitHub Apps, OAuth Apps, gh CLI, PAT / GITHUB_TOKEN, Actions (jobs, steps, expressions, workflow commands, concurrency, OIDC, artifact attestations, lockfile), pull requests, issues, Projects v2, immutable releases, Codespaces, Packages, Copilot API / cloud agent, code scanning, secret scanning, Dependabot, Dependency graph / SBOM, Teams, Billing, activity (events / notifications)。

The English summary is being prepared. Showing the original description.