# Patch a CVE in a direct dependency

A known advisory in a package you import directly. Bump it, fix the fallout, and prove the suite still passes.

Category: Security patching
Source: https://letsship.ai/use-cases/patch-a-cve-in-a-direct-dependency
Published: 2026-08-25

## Goal

Upgrade the affected package past the advisory and resolve whatever the new version breaks.

## Acceptance criteria

- The advisory is absent from a fresh audit run
- The full test suite passes on the upgraded version
- Breaking changes are handled in code, not suppressed
- The pull request names the version jump and every call site it touched

## What lands as proof

The audit output before and after, and a green suite on the new version. If the upgrade changed behaviour anywhere, the test that covers it is in the same pull request.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Patch {advisory} in {package}

Description: Upgrade {package} past {advisory} and fix whatever the new version breaks.

Acceptance criteria:
- The advisory is absent from a fresh audit run
- The full test suite passes on the upgraded version
- Breaking changes are handled in code, not suppressed
- The pull request names the version jump and every call site it touched

Before you create the issue, run the audit in this repository and replace {package} and {advisory} with a real finding. If the audit reports more than one, pick the highest severity in a direct dependency and mention the rest in the description.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: upgrade the affected package past the advisory and resolve whatever the new version breaks. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means advisory closed, audit clean, full suite green, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.