“lockfile”的搜索结果

用于根据 package.json、lockfile、配置、env 示例、路由、API client 或 server routes、schema、组件、测试、CI、构建/部署配置、ADR、changelog 或迁移说明等事实源同步前端项目文档。不要用于单纯润色普通文案；中文触发词包括 文档同步、更新 README、docs sync、环境变量文档、命令清单、API 文档同步。

中文简介正在准备中。当前显示原文说明。

Use when synchronizing frontend project documentation with source-of-truth files such as package.json, lockfiles, config, env examples, routes, API clients or server routes, schemas, components, tests, CI, build/deploy config, ADRs, changelogs, or migration notes. Do not use for general prose polishing only; Chinese triggers include document synchronization, update README, docs sync, environment variable documentation, command list, API Document synchronization.

中文简介正在准备中。当前显示原文说明。

Reviews open Dependabot PRs, classifies by risk (patch/minor/major, security, lockfile-only), and merges safe ones or advises on what to do. Use when user mentions "dependabot", "dependabot PRs", "dependency updates", "merge dependabot", "review dependabot", "dependency PRs", "bump PRs", "update dependencies", or runs /dependabot-review command.

中文简介正在准备中。当前显示原文说明。

Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.

中文简介正在准备中。当前显示原文说明。

Deep behavioral security audit for AI agent skills and MCP tools. Performs deterministic static analysis (AST + Semgrep + 15 specialized scanners), cryptographic lockfile generation, and optional LLM-powered intent analysis. Use when installing, reviewing, or approving any skill, tool, plugin, or MCP server — especially before first use. Replaces basic safety summaries with full CWE-mapped, OWASP-tagged, line-referenced security reports.

中文简介正在准备中。当前显示原文说明。

Apply npm/pnpm supply-chain hardening when adding a dependency, editing package.json/.npmrc/pnpm-workspace.yaml, reviewing a lockfile change, or configuring CI install steps. Covers the 17 practices from lirantal/npm-security-best-practices.

中文简介正在准备中。当前显示原文说明。

Use when the operator asks to upgrade deps, Python, uv, pyproject or the lockfile; moves them all to upstream at once.

中文简介正在准备中。当前显示原文说明。

Update npm/yarn/pnpm dependencies using manifest-first, lockfile-aware workflows. Prefer declared version bumps over resolution overrides. Use when updating, upgrading, or patching dependencies; fixing transitive dependency versions; addressing npm audit or CVE findings; or removing stale overrides.

中文简介正在准备中。当前显示原文说明。

Dependency and license audit: production-level SBOM, lockfile, trust, copy restrictions. Use when implementing, reviewing or testing dependency and license audit for React, Vite, Next.js or Perfect_AI projects.

中文简介正在准备中。当前显示原文说明。

GitHub 公式ドキュメント (docs.github.com)。REST API, GraphQL, Webhooks, GitHub Apps, OAuth Apps, gh CLI, PAT / GITHUB_TOKEN, Actions (jobs, steps, expressions, workflow commands, concurrency, OIDC, artifact attestations, lockfile), pull requests, issues, Projects v2, immutable releases, Codespaces, Packages, Copilot API / cloud agent, code scanning, secret scanning, Dependabot, Dependency graph / SBOM, Teams, Billing, activity (events / notifications)。

中文简介正在准备中。当前显示原文说明。