vulnerability-fix

name	vulnerability-fix
description	Fix Python package vulnerabilities for a single uv.lock file by updating pyproject.toml and tool.uv constraint-dependencies, then regenerating the lockfile.

Vulnerability Fix Skill

Use this skill when you need to resolve dependency vulnerabilities within a specific path or microservice in a Python monorepo using the uv package manager.

Instruction Flow

Follow these steps exactly when this skill is activated:

1. Locate the Target Path

• Check if the user specified a microservice name or path.
• If not provided, scan the repository for all directories containing pyproject.toml or uv.lock files.
• Present a clean, numbered list of these paths to the user and ask them to select one or provide a custom path.
• Once selected, execute all subsequent commands and file edits relative to that target path directory.

2. Run Vulnerability Audit

• Run uv audit --output-format json > audit.json || true (or uv audit > audit.txt || true as a fallback) in the target directory.
  • Note: Since vulnerabilities are present, uv audit returns exit code 1, which might raise terminal execution errors unless bypassed with || true. Redirecting to a file also prevents terminal truncation of long outputs.
• View the generated file (audit.json or audit.txt) using the view_file tool to inspect the full list of vulnerabilities.
• For each vulnerability, extract:
  • Package Name: The name of the package (e.g., dependency.name in JSON).
  • Current Version: The version currently installed (e.g., dependency.version in JSON).
  • Vulnerability IDs: The CVE/GHSA IDs associated with the vulnerability (e.g., id and aliases in JSON).
  • Fix Versions: The minimum version that resolves the issue (e.g., fix_versions in JSON).
• CRITICAL: Delete the temporary file (e.g., rm audit.json or rm audit.txt) once you have extracted the necessary information.

3. Determine Dependency Types and Apply Upgrades

For each vulnerable package, check pyproject.toml in the target directory:

Direct Dependencies

If the package is listed directly in the dependencies list under [project] or [project.dependencies]:

• Update the version constraint to satisfy the fix version.
• Check the existing constraint operator:
  • If it uses the compatible release operator (~=), keep the original ~= constraint and append , >= FIX_VERSION (e.g., if the constraint was ~= 6.5 and the fix is 6.5.5, update it to ~= 6.5, >= 6.5.5). Do NOT update it to ~= 6.5.5 directly, as that restricts the upper bound (preventing upgrades to 6.6) and changes the developer's intended compatibility range.
  • Otherwise, update it using >= FIX_VERSION (e.g., tornado>=6.5.5).
• CRITICAL: Do NOT add any comments (such as CVE IDs) to direct dependencies in pyproject.toml to keep the project configuration clean.

Transitive Dependencies

If the package is NOT listed directly in the dependencies list:

• Locate the [tool.uv] table in pyproject.toml. If the table does not exist, create it.
• Within the [tool.uv] table, locate or create the constraint-dependencies list.
• Add the package constraint to the constraint-dependencies list in the format:

  "package_name >= FIX_VERSION", # CVE-ID-1, CVE-ID-2
  

• Make sure to list all unique vulnerability/CVE/GHSA IDs for this package, separated by commas.

4. Regenerate the Lockfile

• Run uv lock in the target directory to regenerate the uv.lock file with the updated constraints.
• Handling Resolution Conflicts / Unsatisfiable Constraints:
  • If uv lock fails due to dependency conflicts (or if you identify a conflict beforehand that makes the upgrade impossible to satisfy):
    • Do not attempt to force the update or guess how to resolve it.
    • Collect the details of the conflict (e.g., the package being updated, its required fix version, the other packages/constraints causing the conflict, and the uv lock error output).
    • Explicitly ask the user for instructions on how to resolve the conflict (e.g., whether to relax/upgrade the conflicting dependencies, use an alternative version, or skip/ignore the package).

5. Verify the Fixes

• Run uv audit --output-format json > audit_verify.json || true (or uv audit > audit_verify.txt || true as a fallback) in the target directory.
• View the generated verification file to confirm the vulnerabilities list is empty (or the summary vulnerability count is 0).
• CRITICAL: Delete the temporary verification file (e.g., rm audit_verify.json or rm audit_verify.txt).
• If any vulnerabilities remain, repeat the process.
• Once verified clean, present a concise summary of the packages updated and confirm the path is secure.