Dependabot Alerts

Triage open Dependabot security alerts into GUS work items. Output is work items only — no branches, bumps, or PRs. The auto-build-wi workflow claims each WI and does the build/PR.

User-invoked only. Never auto-fire.

Never

• No npm overrides in package.json. Ever.
• No blind lockfile bumps. Trace the dependency to its outermost consumer first.

Input

• Bare invocation → list open alerts: gh api repos/forcedotcom/salesforcedx-vscode/dependabot/alerts --paginate --jq '[.[] | select(.state=="open")]' | jq -s add. --paginate is required — the API defaults to 30/page and silently returns only page 1 without it (e.g. 33 open alerts, not the ~14 page 1 shows).
• User-specified package / GHSA / CVE → act on that alert only.

(Repo is a monorepo, workspaces packages/*. npm 11.)

Per alert: trace the thread