# Fix Node

> Apply a Node.js dependency CVE fix via lockfile-only updates. Supports npm and pnpm. Uses overrides only as fallback when direct update is insufficient.

- Skill: `quay/fix-node` (Agent Skill)
- Install (CLI): `npx skillmds@latest add quay/fix-node`
- Raw SKILL.md: https://api.skillmd.com/api/skills/quay/fix-node/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: quay (https://skillmd.com/u/quay)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/quay/fix-node

---


# Fix Node.js CVE

## Inputs

| Input | Required |
|-------|----------|
| `PACKAGE` | yes |
| `FIXED_VERSION` | yes |
| `CVE_ID` | yes |
| `REPO_DIR` | yes (cwd) |
| `NODEJS_DIRS` | default `.` `web/` |
| `USE_PNPM_WEB` | default false — set true when web/ uses pnpm |
| `PNPM_VERSION` | default `10` — CI pnpm major version |

## Strategy

1. Direct lockfile update first (sufficient for most transitive CVEs)
2. Overrides in `package.json` only when update cannot reach fixed version
3. Verify lockfile shows `package@<FIXED_VERSION>` before commit
4. Do not commit `package.json` unless overrides were required

## Steps

### 1. Update each directory

For each dir in `NODEJS_DIRS` with a `package.json`:

```bash
cd "${DIR}"

if [ "$USE_PNPM_WEB" = true ] && [ "$DIR" = "web/" ]; then
  corepack prepare "pnpm@${PNPM_VERSION}" --activate
  rm -rf node_modules
  pnpm update "${PACKAGE}@${FIXED_VERSION}" --lockfile-only 2>/dev/null || \
    pnpm update "${PACKAGE}" --lockfile-only 2>/dev/null || true
  npm update "${PACKAGE}" --package-lock-only 2>/dev/null || true
  # Fallback if lockfile-only update did not reach FIXED_VERSION:
  # python3 "${CLAUDE_PLUGIN_ROOT}/scripts/patch-pnpm-lock.py" web/pnpm-lock.yaml "$PACKAGE" "$OLD" "$FIXED"
  # Validate CI will accept the lockfile (do not use this to apply the bump):
  pnpm install --frozen-lockfile
else
  npm update "${PACKAGE}@${FIXED_VERSION}" 2>/dev/null || npm update "${PACKAGE}" 2>/dev/null || true
fi

cd "$REPO_DIR"
```

### 2. Override fallback

If lockfile version is still below `FIXED_VERSION`:

```bash
jq --arg pkg "$PACKAGE" --arg ver "${FIXED_VERSION}" \
  '.overrides[$pkg] = $ver | .pnpm.overrides[$pkg] = $ver' package.json > package.json.tmp && \
  mv package.json.tmp package.json
pnpm install --no-frozen-lockfile
```

For npm-only directories (no pnpm), use `.overrides` only and run
`npm install`.

### 3. Verify

```bash
npm audit 2>/dev/null | grep -i "${CVE_ID}" && echo "WARNING" || echo "CVE resolved"
# For pnpm web/:
grep -E "  ${PACKAGE}@" pnpm-lock.yaml | head -3
grep -q '^overrides:' pnpm-lock.yaml || { echo "ERROR: missing overrides: header"; exit 1; }
```

## Output

Modified lockfiles in the specified directories. `package.json` only if overrides added.