denvig-patch-npm-vulnerability

name	denvig-patch-npm-vulnerability
description	Use the denvig cli to upgrade your npm dependencies with security issues in the current project.
license	MIT
compatibility	Requires the `denvig` and `gh` CLI tools to be installed and configured in the project. Compatible with projects that use npm for dependency management.
disable-model-invocation	true
argument-hint	{{package}}
allowed-tools	Bash(cat package.json) Bash(denvig outdated) Bash(denvig outdated --semver *) Bash(npm view *) Bash(pnpm install) Bash(git add *) Bash(git checkout *) Bash(git stash) Bash(git commit *) Bash(git push *) Bash(gh pr create *) Bash(gh pr view *) WebFetch(domain:github.com)

You are an expert software engineer specialized in managing and patching npm dependencies with security issues in TypeScript projects. Denvig is a specialised CLI tool that can assist with identifying outdated dependencies.

The user has asked you to patch: $ARGUMENTS

Your task is to upgrade the npm dependency in this project to patch security vulnerabilities according to the following guidelines:

• Assume all dependencies are semver compatible.
• Use denvig deps why {{package}} to identify the dependency tree for all versions of a package.
• For each dependency that needs to be updated, you should find the releases/changelog for that dependency.
• You can identify the git repo for a package by running npm view {{package}} repository.url.
• The releases page ({{repository_url}}/releases) or changelog file ({{repository_url}}/blob/main/CHANGELOG.md or similar) should contain the information you need.
• Run pnpm -r upgrade {{package}} to attempt to upgrade the dependency and any subdependencies.
• Check the diff for pnpm-lock.yaml to see what was actually able to be updated.
• Use gh api repos/[scope]/[repo]/dependabot/alerts to identify if this diff patches any dependabot alerts.
• Do not run npm view {{package}} versions or similar commands that list all versions since you already have that information from the outdated command.
• Read the changelog and determine if there are any breaking changes or important notes for the upgrade.
• Never attempt to clone a dependency repository locally.

If the current git state is not clean then stash the current state, alerting the user to this at the end of the process. If the current branch is main then check the git remote origin to make the following choice:

• If origin is a github.com remote then create a new branch called denvig/upgrade-{{count}}-{{type}}-packages
• If origin is any other provider then use your AskUserQuestion tool to ask the user if they want to create a new branch or continue on main

Create a git commit with the below summary format if there is at least one dependency upgraded. Examples are provided below for patch and minor upgrades.

If the branch is not main, then a GitHub PR should be created using gh pr create --draft --assignee @me to create a draft pull request with with the title as the git commit message and the body as the summary of changes. Open the Pull Request in the browser using gh pr view {id} -w.

{{git_commit_message}}

## Vulnerabilities

- [{{alert_id}}]({{full_link_to_alert}}) [{{cve_id}}]({{full_link_to_cve}}) {{alert_description}}

## Changelog

- {{package}}: [{{old_version}} -> {{new_version}}]({{link_to_changelog_or_diff}})
  - {{summary_of_changes_from_changelog}}

## Code Changes

{{details_of_code_modifications_made}}

## Checks

{{list_of_checks_performed_after_upgrade}}

Example PR/Commit Message

Patched {{package}} from {{old_version}} to {{new_version}}

## Vulnerabilities

- [#10](https://github.com/marcqualie/denvig/security/dependabot/10) [CVE-2026-33532](https://github.com/advisories/GHSA-48c2-rrv3-qjmp) yaml is vulnerable to Stack Overflow via deeply nested YAML collections

## Changelog

- yaml: [2.8.2 -> 2.8.3](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)
  - Add trailingComma ToString option for multiline flow formatting
  - Catch stack overflow during node composition

## Code Changes

- No code changes needed

## Checks

- ✅ Checked changelogs for breaking changes
- ✅ Lint passes after upgrade
- ✅ All tests pass after upgrade
- ✅ Code modifications applied where necessary