'lockfile' 검색 결과

Screen dependency names on npm, PyPI, and crates.io before installation to find lookalikes of legitimate packages. This skill compares spelling patterns and registry metadata, helping review AI-generated lists, lockfile changes, and new dependencies in CI/CD.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Screening a new dependency before installation
• Reviewing dependency lists generated by AI
• Checking lockfile changes for swapped packages

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Package management discipline for any JavaScript/TypeScript project: dependency declaration, semver, scripts conventions, lockfile hygiene, package-manager detection (npm/yarn/pnpm). Stack-agnostic — referenced by every JS/TS framework plugin in the marketplace. Use this skill to: - Add a dependency correctly (right field, right semver range). - Pick the project's package manager from lockfile. - Define `scripts` entries that match conventions. - Avoid lockfile mistakes (manual edits, wrong commits). Do NOT use this skill for: - Code-level conventions (see the active framework plugin's conventions skill). - Framework-specific package patterns (NestJS modules, Angular schematics, Expo SDK choice etc.).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit project dependencies for known vulnerabilities and outdated packages. Organize findings by severity, review proposed package changes before optional automatic fixes, and rerun the audit to check whether the reported vulnerability count decreased.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing third-party packages before a release
• Checking dependencies after installation or lockfile changes
• Investigating reported CVE advisories

Review dependency manifests and lockfiles to find outdated packages and known security vulnerabilities. Group proposed updates by version change, report current and suggested versions, and identify updates that need human review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing outdated dependencies
• Checking known vulnerabilities and update options
• Separating patch, minor, and major updates

Audit npm, PyPI, and Go dependencies for version-specific advisories, inactive upstream projects, concentrated npm publishing rights, and installation scripts. Produce a report backed by collected data, with assessment coverage, action priorities, and upgrade or replacement guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing dependency risks before an engagement
• Checking advisories across a lockfile dependency tree
• Finding abandoned or archived dependencies

Audit and reduce JavaScript package dependency footprint across npm, pnpm, Yarn, and Bun projects. Use when asked to remove unused dependencies, deduplicate workspace dependency versions, lockfiles or node_modules, analyze direct dependencies' transitive lockfile closure, find low-risk upgrades that reduce dependency trees, inline trivial dependencies, or apply e18e dependency replacement recommendations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Python dependency management with Poetry and Rye -- lockfile-driven workflows, dependency groups, monorepo patterns, and migration paths. Covers pyproject.toml-centric packaging for projects not yet on uv.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

用于规划、实现或审查前端依赖升级、包迁移、lockfile 变更、框架大版本升级、CVE 修复、peer dependency 冲突、ESM/CJS 切换、构建工具兼容性或 CI 验证矩阵；中文触发词包括 依赖升级、版本升级、lockfile、peer dependency、CVE 修复、大版本迁移。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when planning, implementing, or reviewing frontend dependency upgrades, package migrations, lockfile changes, major framework version bumps, CVE remediation, peer dependency conflicts, ESM/CJS shifts, build-tool compatibility, or CI verification matrices; Chinese triggers include dependency upgrades, version upgrades, lockfile, peer dependency, CVE fixes, major version migrations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Operational guide for the NV oOS Dependabot alert triage-and-remediation loop: querying open alerts via gh api, separating stale from genuinely vulnerable lockfile entries (default-branch forensics), deciding between safe in-major override bumps, scoped overrides, or deferred major migrations (npm pack signature diffing), regenerating the 13-lockfile tree, dismissing alerts with the right reason, GitHub issue housekeeping, and triaging the known CI failure modes. Use when asked to fix dependabot alerts, close out dependabot issues, bump vulnerable npm packages, or resume a dependabot session.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

dependabot 設定（.github/dependabot.yml）の新規作成・整備。リポジトリから ecosystem を自動検出し、lockfile コンフリクトを避ける group 設計と security fast-track を備えた設定を生成する。dependabot 設定の作成・見直し・追加の依頼時、/setup-dependabot 実行時に使用。境界: Renovate は対象外。dependabot が作った PR の対応は pr-review 等の通常フロー。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review code changes before merging across correctness, readability, architecture, security, and performance. Get findings that distinguish required fixes from optional suggestions, with concrete ways to simplify code and checks on test coverage.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a pull request before merging
• Checking code written by an AI agent
• Assessing whether a refactor reduces complexity

Update Remotion’s FFmpeg dependency to a published rust-ffmpeg commit, refresh the dependency lockfile, and rebuild compositor binaries for all supported platforms. Validate the changes and open a draft pull request with source revisions and build results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Apply a published rust-ffmpeg revision to Remotion
• Rebuild compositor binaries for all supported platforms
• Verify Windows runtime library dependencies

Update Remotion and its related packages while respecting the project's package manager and workspace structure. The workflow aligns package versions, updates the lockfile and installed Remotion skills, and checks the resulting dependency changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Updating Remotion to the latest stable release
• Aligning versions across related packages
• Updating dependencies across workspaces

Transfer selected Chatbox Pro commits into the open source edition using cherry-picking, which copies individual changes. The skill handles excluded files, package names, dependency conflicts, lockfile regeneration, and version tags for manual releases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Sync recent Pro changes into the open source edition
• Transfer a specified range of Pro commits
• Resolve conflicts caused by edition differences

Set up Python projects with uv, manage required packages, and create isolated environments for each project. Covers Python versions, dependency updates, migration from existing tools, and lockfiles that record package versions for repeatable installations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Set up a new Python project
• Migrate existing package management to uv
• Manage Python versions and isolated environments

Find dependency confusion risks, where a public package can replace an internal package with the same name. Review dependency files, identify exposed names, and guide registry restrictions and recurring CI checks to prevent substitution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing projects that mix private and public package registries
• Checking exposure after internal package names have leaked
• Restricting package sources to approved private registries

Prepare Python SDK releases by updating versions, package metadata, pinned dependencies, lockfiles, and build workflows. The skill covers release process changes and publication verification, helping agents handle packaging work within the repository’s release procedures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing a Python SDK release
• Updating pinned dependency versions
• Changing packaging metadata and build workflows

Publish a Playground UI snapshot, a version for testing branch changes, through the npm release workflow. The skill checks publication results, updates the platform frontend's package versions and lockfile, and opens a pull request.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Publishing a snapshot from the latest main
• Releasing current-branch Playground UI changes
• Opening a PR to update the platform frontend

Review dependency files to find outdated packages and security vulnerabilities. Sort updates by severity and version change, identify cases needing human review, and record a prioritized update list with testing requirements.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prioritizing outdated dependencies
• Separating security fixes by severity
• Identifying major updates needing human review

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to dependency confusion, typosquatting, malicious packages, or token leakage.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.