How do I install the Fix Dependabot Alert skill?

Run npx skillmds@latest add zauberzeug/fix-dependabot-alert in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Fix Dependabot Alert safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Fix Dependabot Alert?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Fix Dependabot Alert free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Fix Dependabot Alert?

zauberzeug (@zauberzeug) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Fix Dependabot Alert by zauberzeug — Agent Skill

Name: Fix Dependabot Alert
Author: zauberzeug

Fix Dependabot Alert

Fix one or more Dependabot security alerts by updating the affected packages, rebuilding bundles and vendored files, and preparing a commit. Use when asked to fix Dependabot alerts (e.g. "fix Dependabot alert 252", "fix all new Dependabot alerts").

zauberzeug Updated Sep 17, 2026

File contents

Fix the Dependabot alerts whose numbers are passed as arguments. If no numbers are given or the user asks for "all new" alerts, fetch all open ones:

gh api 'repos/zauberzeug/nicegui/dependabot/alerts?state=open'

Steps

Fetch each alert to identify the package, manifest path, and first patched version:
```
gh api repos/zauberzeug/nicegui/dependabot/alerts/<number>
```
Try the minimal fix first — npm update <pkg> inside the manifest's directory. If the existing semver range in the parent's package.json already allows the patched version, this is enough and package.json stays untouched.
Escalate to an npm override if the patched version is outside the declared range (common for transitive deps). Add the package to the overrides section of the manifest's package.json with a range that includes the patched version, then run npm install.
Rebuild if the element has a dist/ — run npm run build in the manifest's directory. Don't hand-revert the dist/ changes; let pre-commit hooks normalize any whitespace-only noise (the end-of-file-fixer will handle source-map trailing newlines).
Rebuild vendored core libraries if the root manifest changed — run npm run build in the repository root; it runs extract_core_libraries.py to refresh nicegui/static/. Whitespace-only churn in unrelated static files is normalized away by the pre-commit hooks.
Scan other lockfiles in the repo for the same vulnerable package — sometimes Dependabot is slow to raise the next alert:
```
find . -name 'package-lock.json' -not -path '*/node_modules/*' -not -path '*/.venv/*'
```
Check each one for the package and apply the same fix if needed.
Check for other open alerts that might as well be bundled into the same commit:
```
gh api 'repos/zauberzeug/nicegui/dependabot/alerts?state=open'
```
Regenerate DEPENDENCIES.md — run python3 summarize_dependencies.py; it rewrites the file from the resolved lockfile versions and belongs in the same commit.
Confirm with the user before committing. Then commit with a message following the established style:
- Single alert: fix Dependabot alert 252
- Multiple: fix Dependabot alerts 250 and 251 or fix Dependabot alerts 246, 247, 248 and 249
Reference alert numbers as plain integers, never as #252 — GitHub auto-links #N to issues/PRs, which points to the wrong ticket.
Do not push unless the user explicitly asks.

---name: fix-dependabot-alertdescription: Fix one or more Dependabot security alerts by updating the affected packages, rebuilding bundles and vendored files, and preparing a commit. Use when asked to fix Dependabot alerts (e.g. "fix Dependabot alert 252", "fix all new Dependabot alerts").---Fix the Dependabot alerts whose numbers are passed as arguments.If no numbers are given or the user asks for "all new" alerts, fetch all open ones:```gh api 'repos/zauberzeug/nicegui/dependabot/alerts?state=open'```## Steps01. **Fetch each alert** to identify the package, manifest path, and first patched version: ``` gh api repos/zauberzeug/nicegui/dependabot/alerts/<number> ```02. **Try the minimal fix first** — `npm update <pkg>` inside the manifest's directory. If the existing semver range in the parent's `package.json` already allows the patched version, this is enough and `package.json` stays untouched.03. **Escalate to an npm override** if the patched version is outside the declared range (common for transitive deps). Add the package to the `overrides` section of the manifest's `package.json` with a range that includes the patched version, then run `npm install`.04. **Rebuild if the element has a `dist/`** — run `npm run build` in the manifest's directory. Don't hand-revert the `dist/` changes; let pre-commit hooks normalize any whitespace-only noise (the end-of-file-fixer will handle source-map trailing newlines).05. **Rebuild vendored core libraries if the root manifest changed** — run `npm run build` in the repository root; it runs `extract_core_libraries.py` to refresh `nicegui/static/`. Whitespace-only churn in unrelated static files is normalized away by the pre-commit hooks.06. **Scan other lockfiles** in the repo for the same vulnerable package — sometimes Dependabot is slow to raise the next alert: ``` find . -name 'package-lock.json' -not -path '*/node_modules/*' -not -path '*/.venv/*' ``` Check each one for the package and apply the same fix if needed.07. **Check for other open alerts** that might as well be bundled into the same commit: ``` gh api 'repos/zauberzeug/nicegui/dependabot/alerts?state=open' ```08. **Regenerate `DEPENDENCIES.md`** — run `python3 summarize_dependencies.py`; it rewrites the file from the resolved lockfile versions and belongs in the same commit.09. **Confirm with the user before committing.** Then commit with a message following the established style: - Single alert: `fix Dependabot alert 252` - Multiple: `fix Dependabot alerts 250 and 251` or `fix Dependabot alerts 246, 247, 248 and 249` Reference alert numbers as plain integers, **never** as `#252` — GitHub auto-links `#N` to issues/PRs, which points to the wrong ticket.10. **Do not push** unless the user explicitly asks.

Frequently asked questions