Fix dependency vulnerabilities

The goal is a healthier dependency tree, not a quiet audit.

An override clears a finding in one line, which is why it's the tempting first move. It also pins a version in place, can force a major version a parent never declared, and quietly blocks the next fix. Most findings have a better fix. Treat overrides as the last option, not the first.

Before you start

1. Detect the ecosystem from the lockfile:
   • pnpm-lock.yaml: pnpm.
   • uv.lock: uv.
   • requirements*.txt or a pyproject.toml with no uv.lock: pip.
   • Cargo.lock: Cargo.
   • None of these: tell the user which ecosystems this skill covers and ask whether to adapt the same ladder to theirs.
2. Read exactly one ecosystem file: references/pnpm.md, references/python.md, or references/cargo.md. It holds every command used below, under the headings named in italics (Investigating, Fixing, Overrides, Dismissals, Release age). references/report.md is used later in steps 3d and 6.
3. List existing overrides. pnpm: overrides in pnpm-workspace.yaml. On pnpm 11+, entries under pnpm.overrides or patchedDependencies in package.json are ignored (pnpm warns "The pnpm field in package.json is no longer read"); flag them for removal or migration to pnpm-workspace.yaml. uv: override-dependencies and constraint-dependencies under [tool.uv]. pip: constraints.txt. Cargo: [patch] and [replace] in the root Cargo.toml and .cargo/config.toml, plus exact = pins on direct dependencies. Existing overrides are a common cause of findings. An exact pin added for an old advisory holds the package below a newer fix.

Workflow