chore(claude): update audit-dependencies skill with lockfile strategy and override rules

[denolfe]

Overview

Updates the audit-dependencies skill to include a lockfile-update strategy as an intermediate fix between direct dependency bumps and pnpm overrides. Also adds documentation for common pnpm override pitfalls learned from recent audit work.

Key Changes

• Added lockfile update as a fix strategy

  • When a transitive dependency's parent uses a semver range that already includes the fixed version, pnpm update --recursive is enough. No package.json changes needed. The workflow now checks pinned vs ranged before falling back to overrides.

• Documented pnpm override syntax rules

  • Added guidance on using ^ ranges instead of >= (which can cross major versions), single-level parent scoping limitations, unsupported version selectors in keys, and risks of global overrides across multiple major versions.

• Added user confirmation step before applying fixes

  • The workflow now requires presenting a summary table of proposed fixes and getting user confirmation before making changes. This prevents wasted effort from incorrect fix strategies.

Design Decisions

The fix priority order is now: direct bump > lockfile update > override. The lockfile update step was added because several audit vulnerabilities were resolvable without any package.json changes — the parent's semver range already covered the fix, but the lockfile had a stale resolution. Recognizing this case avoids unnecessary overrides that add long-term maintenance burden.

The override syntax rules were added because pnpm's override behavior has non-obvious edge cases (e.g., >= crossing majors, no nested scoping) that caused issues in practice.

Overall Flow

flowchart TD
    A[Run audit script] --> B[Group by package]
    B --> C[Trace dependency chain]
    C --> D{Can bump direct dep?}
    D -->|yes| E[Research breaking changes]
    D -->|no| F{Pinned or ranged?}
    E --> G{Breaking changes ok?}
    G -->|yes| H[Apply direct bump]
    G -->|no| F
    F -->|ranged, fix in range| I[Lockfile update]
    F -->|pinned| J[Apply pnpm override]
    H --> K{More packages?}
    I --> K
    J --> K
    K -->|yes| C
    K -->|no| L[Present plan to user]
    L --> M[Install and verify]
    M --> N[Build and verify]
    N --> O[Commit and create PR]

Loading

[github-actions]

🚀 This is included in version v3.81.0