Find all open Dependabot alerts for this repo and create a plan to resolve them using the appropriate package manager overrides (pnpm, bun, npm, cargo).
The English summary is being prepared. Showing the original description.
Review the instructions the agent will receive before you install.
REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
gh api "repos/${REPO}/dependabot/alerts" \
--jq '.[] | select(.state == "open") | {
number,
dependency: .dependency.package.name,
ecosystem: .dependency.package.ecosystem,
manifest: .dependency.manifest_path,
vulnerable_range: .security_vulnerability.vulnerable_version_range,
patched_version: .security_vulnerability.first_patched_version.identifier,
severity: .security_vulnerability.severity,
summary: .security_advisory.summary
}'
Group the alerts by their manifest field (e.g. bun.lock, Cargo.lock, packages/loro-mirror/pnpm-lock.yaml). This determines which override mechanism to use.
For each manifest/lockfile, determine the correct override mechanism:
| Lockfile | Override mechanism |
|---|---|
bun.lock / bun.lockb | "overrides" in the nearest package.json |
pnpm-lock.yaml | "pnpm": { "overrides": { ... } } in the workspace root package.json |
package-lock.json | "overrides" in the nearest package.json |
yarn.lock | "resolutions" in the nearest package.json |
Cargo.lock | cargo update -p <package> or workspace [patch.crates-io] in Cargo.toml |
Read each target package.json or Cargo.toml to check for existing overrides before adding new ones.
Present a table of all alerts grouped by manifest, showing:
Ask the user to confirm before making changes.
For each group:
package.jsonbun install / pnpm install / npm install<pm> ls for the patched versioncargo update -p <package> firstcargo update -p <parent-package> (the package that depends on the vulnerable one, found via cargo tree -i <package>)cargo tree -i <package> and checking Cargo.lockAfter all changes, confirm patched versions are in place and no new audit issues were introduced.
undici-types triggering undici alerts). Flag these to the user.>=6.14.0 not ^8.0.0) to reduce breakage risk.cargo update only bumps to a version below the patch, escalate the parent dependency.No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Wrap a new backend endpoint in the TypeScript SDK (packages/sdk), or record it as skipped. Use when `just coverage` fails, or after adding an endpoint to a Rust service.
The English summary is being prepared. Showing the original description.
Add or change an in-app feature tour (a view's guided flyover) in the web app. Use when adding a tour to a view, adding or editing tour steps, pointing a step at a new control, or when a step's target needs something opened first.
The English summary is being prepared. Showing the original description.
Post-change checks before handing off. Works out which checks apply from the files changed (directory AGENTS.md Checks sections and matching .agents/rules), runs or verifies each, and reports pass/fail/skipped. Use before saying work is done, before pushing, or when asked to audit or verify a change.
The English summary is being prepared. Showing the original description.
Enforce hexagonal architecture in the Rust backend. Use before modifying crates/ or Rust services, especially inbound axum/tool/listener adapters, domain services/ports, outbound adapters, authorization, permissions, database access, or external clients.
The English summary is being prepared. Showing the original description.
Use when adding collaborative markdown, notes, or descriptions to a feature with collab surfaces. Covers parent entities, service entry points, authorization, content storage, and lifecycle.
The English summary is being prepared. Showing the original description.
Build a new AI tool end-to-end — Rust implementation, toolset wiring, infra, schema generation, and frontend UI.
The English summary is being prepared. Showing the original description.