INFYNON CVE Triage Guide

CRITICAL RULE — All Fixes Go Through infynon pkg

Never run raw upgrade or install commands to fix CVEs. Not npm install <pkg>@<safe-version>, not pip install --upgrade, not cargo update, not any other raw package manager command.

Every fix must go through infynon pkg:

• infynon pkg fix --auto — auto-fix all vulnerable packages
• infynon pkg scan --fix — scan and interactively fix
• infynon pkg <cmd> --auto-fix — fix during install

If you find yourself about to write a raw upgrade command — STOP. Use the infynon pkg equivalent.

You are helping the user interpret and act on CVE scan results from infynon pkg scan.