48 个 · 按相关度排序
Configure GitHub Dependabot to keep dependencies, the packages a project relies on, updated. Organize update pull requests into groups, set schedules and exclusion rules, and configure security updates across projects with multiple packages or package systems.
中文简介正在准备中。当前显示英语简介。
dependabot 設定（.github/dependabot.yml）の新規作成・整備。リポジトリから ecosystem を自動検出し、lockfile コンフリクトを避ける group 設計と security fast-track を備えた設定を生成する。dependabot 設定の作成・見直し・追加の依頼時、/setup-dependabot 実行時に使用。境界: Renovate は対象外。dependabot が作った PR の対応は pr-review 等の通常フロー。
中文简介正在准备中。当前显示原文说明。
Complete a Dependabot update across a monorepo by updating matching dependency versions in other packages and regenerating bun.lock. Check the changed files, preserve existing version prefixes, then commit and push the fixes.
中文简介正在准备中。当前显示英语简介。
Reviews open Dependabot PRs, classifies by risk (patch/minor/major, security, lockfile-only), and merges safe ones or advises on what to do. Use when user mentions "dependabot", "dependabot PRs", "dependency updates", "merge dependabot", "review dependabot", "dependency PRs", "bump PRs", "update dependencies", or runs /dependabot-review command.
中文简介正在准备中。当前显示原文说明。
Collect open Dependabot alerts, group them by dependency files, and propose fixes suited to each package manager. After approval, update dependency versions or override settings and verify that patched versions are installed without introducing new audit issues.
中文简介正在准备中。当前显示英语简介。
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.
中文简介正在准备中。当前显示原文说明。
Operational guide for the NV oOS Dependabot alert triage-and-remediation loop: querying open alerts via gh api, separating stale from genuinely vulnerable lockfile entries (default-branch forensics), deciding between safe in-major override bumps, scoped overrides, or deferred major migrations (npm pack signature diffing), regenerating the 13-lockfile tree, dismissing alerts with the right reason, GitHub issue housekeeping, and triaging the known CI failure modes. Use when asked to fix dependabot alerts, close out dependabot issues, bump vulnerable npm packages, or resume a dependabot session.
中文简介正在准备中。当前显示原文说明。
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot.
中文简介正在准备中。当前显示原文说明。
GitHub Actions の SHA ピン留め（pinact 必須）と Dependabot・Renovate のクールダウン設定（14日間）をリポジトリに適用し、サプライチェーン攻撃対策を実施する。ユーザーが「サプライチェーン対策」「GHA ピン留め」「Dependabot クールダウン」「pinact」「supply chain hardening」に言及した場合に使用する。
中文简介正在准备中。当前显示原文说明。
Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.
中文简介正在准备中。当前显示英语简介。
Plan and carry out major library and framework upgrades by checking compatibility, identifying changes that require code updates, testing each stage, and preparing rollback steps if an upgrade causes problems.
中文简介正在准备中。当前显示英语简介。
Use when triaging, classifying or landing Dependabot pull requests in this repo — clearing the open Dependabot queue, deciding whether a bump needs a WW Jira ticket, or checking whether a bump's build actually passed.
中文简介正在准备中。当前显示原文说明。
Processes all open Dependabot PRs sequentially — rebases if needed, analyzes for breaking changes and security issues, then merges or requests changes. Use when you want to handle pending Dependabot dependency updates.
中文简介正在准备中。当前显示原文说明。
指定されたPR番号のDependabot PRを確認し、依存ライブラリのバージョンアップ内容をCHANGELOGとcontext7から取得して、コード修正が必要かを判定します。修正が必要な場合は修正を行い、pushまで実施します。
中文简介正在准备中。当前显示原文说明。
Use when working with Dependabot — dependabot and Renovate dependency update management. Covers vulnerability alerts, dependency update PRs, auto-merge configuration, version pinning, update scheduling, and security advisory tracking. Use when managing dependency updates, reviewing vulnerability alerts, configuring auto-merge policies, or auditing dependency health.
中文简介正在准备中。当前显示原文说明。
指定されたPR番号のDependabot PRを確認し、依存ライブラリのバージョンアップ内容をCHANGELOGとcontext7から取得して、コード修正が必要かを判定します。修正が必要な場合は修正を行い、pushまで実施します。
中文简介正在准备中。当前显示原文说明。
使用gh CLI管理GitHub仓库事务，包括问题分类、PR审查与合并条件确认、CI失败排查、发布及变更日志准备，以及依赖和敏感信息泄露警报检查。
Update GitHub Actions when workflow logs warn about deprecated runtimes. The skill guides compatible version selection, pins actions to exact commits, preserves existing workflow behavior, and checks execution results and outputs after the upgrade.
中文简介正在准备中。当前显示英语简介。
Read-only audit of a GitHub repository's security posture. Gathers ref protection (rulesets AND classic branch protection), Actions token permissions, code and supply-chain features (Dependabot, secret scanning, push protection, CodeQL), and repo hygiene toggles via `gh api`, then classifies findings against essential / recommended / advanced tiers into a PASS/GAP report. Makes NO changes. Use when reviewing a repo before open-sourcing or a release, auditing a public user-owned repo whose CI auto-commits to the default branch, verifying a hardening change actually took effect, or producing a baseline security posture report for a repository.
中文简介正在准备中。当前显示原文说明。
Fix a Dependabot PR by updating all monorepo instances of the dependency, running bun install, and pushing
中文简介正在准备中。当前显示原文说明。
ライブラリ更新pull requestのレビュー。 dependabotやrenovatebotが作成したPR、または手動で作成されたライブラリ更新PRをレビューし、 release note分析、コード更新、依存関係調査、過去の失敗調査を行う。
中文简介正在准备中。当前显示原文说明。
Review Dependabot PRs efficiently: triage, risk assessment, batching, and auto-merge policies. Use when dependency update PRs pile up or you want a sane update workflow.
中文简介正在准备中。当前显示原文说明。
Triage and fix Dependabot alerts and CodeQL findings in the ai repository. Use when the user asks to address security vulnerabilities, fix Dependabot alerts, resolve CodeQL issues, or do security maintenance.
中文简介正在准备中。当前显示原文说明。
プロジェクトの定期点検（健康診断）。「健康診断して」「ヘルスチェックして」「プロジェクトの状態を確認して」「最近ほったらかしだったので点検して」といった依頼で発動する。放置されると危険が積み上がる項目——Dependabotの更新PR、セキュリティアラート、CIの失敗、依存パッケージの脆弱性、古い作業ブランチ、未コミットの変更——をまとめて棚卸しし、優先度付きで報告する。エンジニアが常駐しないチームでは週1回の実行を推奨する運用にしており、担当者が何も覚えていなくても「健康診断して」の一言で点検が回ることを目的とする。
中文简介正在准备中。当前显示原文说明。