| name | dep-resolve |
| description | Dependency-conflict resolution when a `/vulnetix:fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use when an upgrade is blocked by transitive constraints, a peer-dep conflict surfaces, or you need to override a vulnerable transitive without bumping the parent. |
| argument-hint | <package-name> [--target-version X] |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["version conflict","cant upgrade","peer dep","resolve dependency","upgrade blocked"] |
| chain | ["safe-version","fix","verify-fix"] |
| outputBudget | medium |
| cooldown | per-session |
Vulnetix Dependency Resolution Skill
Use when
/vulnetix:fix proposed a version bump but <pm> install errored on peer-dep conflict.- A transitive vulnerable dep needs pinning without bumping the direct dependency.
- Lockfile resolution fails after a merge — diagnose which deps disagree.
- Considering a package-manager override (
npm overrides, pnpm overrides, yarn resolutions).
- Last-resort: copy patched upstream code inline as first-party (Type A0 inline).
Don't use for
- Initial fix proposal — use
/vulnetix:fix first.
- Just looking up safe versions — use
/vulnetix:safe-version.
- Multi-CVE upgrade orchestration — use
@dep-upgrade-orchestrator.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
When /vulnetix:fix proposes a version bump but the lockfile resolution fails (peer-dep conflict, transitive constraint, etc.), use this skill to find a compatible set.
Step 1: Load capabilities + memory
Read .vulnetix/capabilities.yaml (derived.primary_package_manager decides which lockfile to read) and .vulnetix/memory.yaml (decisions / safe-harbour notes).
Step 2: Map the conflict
npm ls "$PACKAGE" 2>&1 || pnpm why "$PACKAGE" || yarn why "$PACKAGE"
pip show ""
go mod why
cargo tree -i
