'dependabot' 검색 결과

依存関係更新のローカル差分やPRをレビューする。人間・エージェントによる更新、Dependabot・Renovateの更新PRを対象に、upstreamの変更と利用箇所を照合し、根拠付きの判定を返す。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review OpenShell issues, pull requests, and failed main-branch checks, then build a local Markdown report with linked evidence and ranked recommendations. Saved progress helps resume an unfinished triage pass without changing GitHub.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing incoming issues and community pull requests
• Checking failed CI runs on main
• Prioritizing unresolved issues with supporting evidence

Analyze git history to map contributors to security-sensitive files and identify ownership gaps. Estimate bus factor, a measure of dependence on few people, group files that change together, and export CSV or JSON for further analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding sensitive code with stale, concentrated ownership
• Checking reliance on one person for authentication code
• Comparing CODEOWNERS with contribution history

Handle pull request review feedback by collecting comments, grouping requests, planning fixes, and validating changes before replying. The workflow covers team members and trusted GitHub automation, with individual replies and resolution of addressed discussion threads.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning responses to accumulated pull request feedback
• Addressing review comments from Copilot and GitHub Actions
• Replying to each comment and resolving addressed threads

GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release pipelines, Docker build/push, repository security settings, and AI-driven PR review. Use when setting up or improving Go project CI, writing or fixing `.github/workflows/*.yml`, adding a linter or security scanner as a pipeline job, wiring automated dependency-update bots, or adding quality gates. Covers wiring tools into a pipeline, not the analysis they perform: do NOT use for choosing or interpreting security findings (→ See `samber/cc-skills-golang@golang-security` skill) or for choosing, upgrading, or auditing dependency versions (→ See `samber/cc-skills-golang@golang-dependency-management` skill).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

[omh] Security event on the code already shipped -- a CVE in a dependency, a secret committed to the repo, a license question, an advisory: triage reachability and severity, contain in order, and never close a leaked secret before its rotation is observed. Use when the user says: security-event-response, security event response, cve, triage this cve, cve in our dependency, cve in a dependency, security advisory, dependabot alert.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check. Identify and remediate vulnerable libraries in your software supply chain. Use when managing third-party dependencies or implementing software composition analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL). Use for project setup, Actions workflows, security scanning, or encountering YAML syntax, workflow configuration, template structure errors.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dependency upgrades: outdated/vulnerable deps planned into semver waves (patch/minor batched, majors gated and changelog-read), applied incrementally with lockfiles regenerated and tests green after each. Runs on green main. Triggers on "absolute upgrade", "upgrade our dependencies", "bump deps", "update packages", "move off the deprecated X", "clear the Dependabot backlog".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Apply the changes from all open Renovate bot pull requests of a GitHub repository into the local working tree. Use this skill when asked to apply, merge locally, consolidate, batch, or try out Renovate/dependabot-style dependency update PRs so the combined upgrade can be built and tested in one go. This skill only modifies local files; it never commits, pushes, merges, or closes anything on GitHub.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Keep dependencies up-to-date. Discovers outdated deps via dependabot alerts/PRs, creates one PR per ecosystem, iterates until CI is green, then assigns for review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response. Use when reviewing package.json or lockfiles, adding or upgrading npm dependencies, setting up CI security gates, hardening a new repo, or responding to a compromised package.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dependency vulnerability remediation workflow for this repository. Use when fixing CVE, BDSA, GHSA, OSV, npm, PyPI, Dependabot, Black Duck, Snyk, or other package vulnerability findings, especially when the user asks for minimal package-only updates, validation, commits, branches, or pull requests.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Discoverability shim for the Retail-Agentic-Commerce CVE remediation Codex skill. Use for CVE, BDSA, GHSA, OSV, Dependabot, Black Duck, Snyk, npm, PyPI, or package advisory remediation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Resolve failed Renovate or Dependabot dependency update PRs by fixing version constraints, API breaking changes, and verifying build/test/format compliance. Use when a dependency bump PR fails CI, Cargo cannot select versions, or a crate update requires code migration.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Apply GitHub repository security protections tier by tier — rulesets, read-only Actions token, secret scanning + push protection, Dependabot, and (gated) required status checks / required PR with a GitHub App bypass for a CI auto-commit bot. Mutating and confirmation-gated: always assess first, apply the no-regret baseline, then decide required checks separately. Use when hardening a public user-owned repo after an audit, when a repo has no branch protection, when adding required checks without breaking a bot that pushes to the default branch, or when provisioning a GitHub App bypass actor for trusted automation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect project stack and generate GitHub Actions CI/CD workflows — PR checks with lint/test/build/security, deploy pipelines for Vercel/AWS/GCP/Fly/Docker, dependency caching, matrix testing, preview deploys, and Dependabot config

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

GitHub 公式ドキュメント (docs.github.com)。REST API, GraphQL, Webhooks, GitHub Apps, OAuth Apps, gh CLI, PAT / GITHUB_TOKEN, Actions (jobs, steps, expressions, workflow commands, concurrency, OIDC, artifact attestations, lockfile), pull requests, issues, Projects v2, immutable releases, Codespaces, Packages, Copilot API / cloud agent, code scanning, secret scanning, Dependabot, Dependency graph / SBOM, Teams, Billing, activity (events / notifications)。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

开源技术架构与生态整合——ClawHub 200+ skills + GitHub全套工具的深度驾驭。覆盖：ClawHub生态索引与组合、GitHub Actions高级工作流、开源项目评估、依赖安全管理、供应链安全。触发词：开源生态、ClawHub、GitHub、open source、开源架构、GitHub Actions、Dependabot、开源选型、供应链安全

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.