Lift a vulnerable transitive dependency
The advisory is in a package you never installed. Force it up through a lockfile override without breaking the parent.
The ticket
Raise the vulnerable transitive package to a patched version through a lockfile override, without breaking the direct dependency that pulls it in.
Acceptance criteria
- The advisory is absent from a fresh audit run
- The override is recorded in both the lockfile and the manifest
- The parent package still works, proven by the tests that cover it
- The pull request says when the override can be removed
What lands as proof
The lockfile diff showing the resolved version, a clean audit, and the parent package's own tests passing against the lifted version.
Why teams defer it
- The package is not in your manifest. The first ten minutes go on working out what pulled it in.
- Overrides get treated as temporary. The usual plan is to wait for the parent package to update instead, and that wait is often measured in months.
- Nothing is visibly broken in the meantime.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: raise the vulnerable transitive package to a patched version through a lockfile override, without breaking the direct dependency that pulls it in. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means lockfile diff plus a clean audit run in the pull request, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.