Diagnosing Dependabot Alerts

Investigate a Dependabot/security alert in the Medusa monorepo, identify the exact affected package(s), assess real-world impact, and pick the least-invasive fix. Default output is a diagnosis; only make changes when asked.

Constraints

• Diagnose first, don't default to a fix: Never jump to a root resolutions/overrides bump. Root-level overrides are the LAST resort — see the remediation ladder.
• Root overrides don't ship: resolutions (yarn) / overrides (npm) apply only to THIS repo's install. They are NOT published with packages/*, so they do not protect downstream consumers of a published package. Never present them as a full fix for a vulnerability that reaches a published package.
• Find the fix inside the affected package first: Prefer refreshing/bumping the dependency within the workspace package that owns it (transitive refresh or direct-dep bump) before touching anything at the monorepo root.
• Reachable is not pinnable: A fixed version being resolvable within existing semver ranges (a lockfile float) is weaker than a range that GUARANTEES the fix. Call out the difference — the float can regress for downstream consumers.
• Assess impact, don't assume: Determine whether the vulnerable code path is actually reachable with untrusted input in Medusa before recommending urgency.

Workflow

Follow these steps in order. Load reference/remediation-strategies.md before proposing any fix.