# Lift a vulnerable transitive dependency

The advisory is in a package you never installed. Force it up through a lockfile override without breaking the parent.

Category: Security patching
Source: https://letsship.ai/use-cases/lift-a-vulnerable-transitive-dependency
Published: 2026-08-25

## Goal

Raise the vulnerable transitive package to a patched version through a lockfile override, without breaking the direct dependency that pulls it in.

## Acceptance criteria

- The advisory is absent from a fresh audit run
- The override is recorded in both the lockfile and the manifest
- The parent package still works, proven by the tests that cover it
- The pull request says when the override can be removed

## What lands as proof

The lockfile diff showing the resolved version, a clean audit, and the parent package's own tests passing against the lifted version.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Override {package} to {version} to clear {advisory}

Description: A transitive dependency carries a known advisory. Force it to a patched version with a lockfile override and confirm the parent that depends on it still works.

Acceptance criteria:
- The advisory is absent from a fresh audit run
- The override is recorded in both the lockfile and the manifest
- The parent package still works, proven by the tests that cover it
- The pull request says when the override can be removed

Before you create the issue, run the audit and the dependency tree in this repository, then replace {package}, {version} and {advisory} with a real transitive finding. Name the direct dependency that pulls it in.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: raise the vulnerable transitive package to a patched version through a lockfile override, without breaking the direct dependency that pulls it in. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means lockfile diff plus a clean audit run in the pull request, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.