Patch a CVE in a direct dependency
A known advisory in a package you import directly. Bump it, fix the fallout, and prove the suite still passes.
Walkthrough
The ticket
Upgrade the affected package past the advisory and resolve whatever the new version breaks.
Acceptance criteria
- The advisory is absent from a fresh audit run
- The full test suite passes on the upgraded version
- Breaking changes are handled in code, not suppressed
- The pull request names the version jump and every call site it touched
What lands as proof
The audit output before and after, and a green suite on the new version. If the upgrade changed behaviour anywhere, the test that covers it is in the same pull request.
Why teams defer it
- The bump is one line. What the bump breaks can take the rest of the day, and you cannot tell which of the two you are agreeing to until you start.
- A new advisory list arrives every week. Nothing on it has an owner. It gets read properly after an incident and skimmed the rest of the time.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: upgrade the affected package past the advisory and resolve whatever the new version breaks. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means advisory closed, audit clean, full suite green, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.