safe-version

name	safe-version
description	Find the newest version of a package that is free of known vulnerabilities, capped by a `--max-major-bump` policy. Use when picking an upgrade target for a vulnerable dep, evaluating major-version churn risk, generating a "safe pin" for a lockfile, or building an `overrides` block.
argument-hint	<package-name> [--ecosystem npm|pypi|...] [--max-major-bump 1]
user-invocable	true
allowed-tools	Bash, Read, Glob, Grep
model	sonnet
triggers	["safe version","newest safe","latest safe","upgrade target"]
chain	["fix","dep-resolve"]
outputBudget	short
cooldown	per-session

Vulnetix Safe Version Skill

Use when

• Picking the upgrade target: "what is the newest safe version of express?".
• Building a pnpm/yarn override block with the safe version as the target.
• Evaluating major-version churn — --max-major-bump 1 keeps you near the current major.
• Cross-checking which versions in a range are actually clean (the safe set is sometimes non-contiguous).
• Pre-pin decision: would pinning to vX.Y skip a known-vulnerable interval?

Don't use for

• Listing every version — use vulnetix vdb versions <package>.
• Applying the bump — use /vulnetix:fix or /vulnetix:dep-resolve.
• Single-CVE lookup — use /vulnetix:vuln.

Conventions

This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.

Step 1: Load capabilities

Default --ecosystem from derived.primary_package_manager.

Step 2: Pull versions and vulns

vulnetix vdb versions "$PACKAGE" --ecosystem "$ECO" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/versions.jq"
vulnetix vdb vulns "$PACKAGE" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/vulns.jq"
vulnetix vdb purl "pkg:${ECO}/${PACKAGE}@latest" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/purl.jq"