--- name: github-dependabot-abandoned-dependencies description: "Every Monday: open Dependabot alerts joined with npm publish dates and your imports, so the vulnerable packages with no fix coming are at the top. Use when the user asks for this, or when it runs on a schedule." --- # Vulnerable and abandoned dependencies: Dependabot and npm Every Monday: open Dependabot alerts joined with npm publish dates and your imports, so the vulnerable packages with no fix coming are at the top. Dependabot lists 11 open alerts and sorts them by severity. What it does not tell you is that three of them sit in packages whose last release was two years ago, so no patched version is coming and waiting for the bot's pull request is a plan that never ends. And it cannot say whether the package is imported by your checkout service or by a script someone ran once. This skill is for the developer who owns dependency hygiene in a JavaScript repo. Every Monday the agent joins each open npm alert with the registry's publish history and deprecation notice, then greps the code for where the package is imported. The card puts the abandoned, unpatched, production-imported ones first and asks which to turn into GitHub issues. ## Two ways to get the data Use the API or MCP route when you have an MCP server, a CLI or an API token for the app. Otherwise, if you can drive a browser the user is signed in to (Claude in Chrome, a Playwright or Chrome DevTools MCP server), use the browser route. Say which one you used. ## Route A: API or MCP server ### What you need - A fine-grained GitHub token or the GitHub MCP server with Dependabot alerts: Read and Contents: Read on the repository, plus Issues: Write if it should open issues. - A checkout of the repository with its lockfile, so `git grep` and `npm ls` (or `pnpm why`) can see imports and the dependency tree. The npm registry needs no token for public packages. - A folder-to-service map when the repo holds several services (`services/checkout` = checkout), so an alert can be named by the service that ships it. If something is missing, say what and stop; do not invent numbers. ### Steps 1. **Pull the open npm alerts** (GitHub): Call `GET /repos/{owner}/{repo}/dependabot/alerts?state=open&ecosystem=npm&per_page=100` (or `gh api` with the same path). Keep `number`, `html_url`, `dependency.package.name`, `dependency.manifest_path`, `dependency.scope` (`runtime` or `development`), `dependency.relationship`, `security_advisory.ghsa_id`, `security_advisory.severity`, `security_vulnerability.vulnerable_version_range` and `security_vulnerability.first_patched_version`. 2. **Read each package's publish history** (npm): For each distinct package, `GET https://registry.npmjs.org/` (scoped names URL-encode the slash). Last publish is the newest timestamp in `time`, ignoring the `created` and `modified` keys, since `modified` also changes on metadata edits. Note `versions[].deprecated`, and call the package abandoned when its last publish is 18 or more months old or its latest version is deprecated. 3. **Join alerts to the code that imports them**: The key is the package name exactly as npm writes it, scope included. Run `git grep -nE "(from |require\(|import\()['\"](/[^'\"]*)?['\"]"` and map each hit to a service by its top folder (`services/checkout/` is checkout). It is direct when the name is in the `package.json` next to `manifest_path` (or `relationship` is `direct`); otherwise `npm ls --all --json` or `pnpm why ` names the parent that pulls it in. A direct dependency with no import is unused and can go; a transitive one with no import is fixed by upgrading or replacing its parent. 4. **Rank by what you can actually do**: Order: abandoned with no `first_patched_version` and runtime scope first, then abandoned with a patch available (bump it now), then maintained packages (Dependabot will handle them). Development-scope alerts go last. Within each group, critical before high before moderate. 5. **Mark what is new since last week**: Read the previous card with `GET https://briefkin.dev/v1/cards/insight-github-dependabot-abandoned-dependencies` (same `item_key` every run), or a small JSON file of alert numbers kept between runs, and tag alerts that were not there last Monday. 6. **Ask, then open issues** (GitHub): Post the ranked list as an ask. For each package picked, run `gh issue create` with the alert link, the advisory, the last publish date, every import line found and a suggested replacement or the parent to upgrade. Change no code. ## Route B: the browser ### What you need - Signed in to GitHub with access to the repository's security alerts (admin or a role with Dependabot alert access) and permission to open issues. If something is missing, say what and stop; do not invent numbers. ### Steps Start at https://github.com/. The user is signed in already; never type passwords or codes, and ask if a sign-in page appears. 1. **Open the Dependabot alerts**: Open the repository, then **Security** > **Dependabot**. Filter with `is:open ecosystem:npm` and read each row: package, severity and manifest. Open each alert to note the patched version, or that there is none. 2. **Check each package on npm**: Open `https://www.npmjs.com/package/` for each package. Read **Last publish** in the sidebar, the **Versions** tab for the newest release date, and any deprecation banner at the top. Abandoned means no release in 18 months or more, or deprecated. 3. **Find where it is imported**: In GitHub code search, search `repo:/ "from ''"` and `repo:/ "require('')"`. Note the folder of each hit, and open the `package.json` next to the alert's manifest: listed there means direct, absent means a transitive dependency of another package. 4. **Rank and ask**: Put abandoned, unpatched, runtime packages first, then those a version bump fixes, then dev-only ones. Show the table and ask which to turn into issues; open issues only for the ones picked, with the alert link and the import lines. Note: GitHub code search misses dynamic imports and paths built at runtime, and it cannot show the dependency tree, so a transitive package's parent is not visible from the browser; the API route runs `npm ls` for that. Past 30 or so alerts the browser route gets slow. ## The report - **Open npm alerts** and how many sit in abandoned packages. - **Abandoned and unpatched**: package, severity, last publish, deprecation note, and where it is imported. - **Patch available**: alerts you can close with a version bump today. - **Transitive only**: the parent package to upgrade or replace. - The ask: which ones to open issues for, with the one to fix first named, for example "replace request in services/checkout". ## Post it to Briefkin When `BRIEFKIN_TOKEN` is set, or `~/.config/briefkin/env` exists (the installer from https://briefkin.dev/docs writes it), also send the result to the user's Briefkin board as one card. Keep the `item_key` the same on every run so the card updates in place, use a new `event_id` per run, and put today's real numbers in place of the example ones. If the request fails, say so once and carry on. ```bash [ -n "${BRIEFKIN_TOKEN:-}" ] || . ~/.config/briefkin/env curl -sS -X POST "${BRIEFKIN_URL:-https://briefkin.dev}/v1/events" \ -H "authorization: Bearer $BRIEFKIN_TOKEN" \ -H "content-type: application/json" \ -d @- <<'JSON' { "v": 1, "event_id": "github-dependabot-abandoned-dependencies/", "item_key": "github-dependabot-abandoned-dependencies", "project": "acme-web", "source": "Vulnerable and abandoned dependencies: Dependabot and npm skill", "kind": "action", "title": "3 alerts are in packages not published for 18+ months", "summary": "Of **11 open Dependabot alerts**, **3** are in packages with no release in 18 months or more, and only one of those has a patched version. **1 of them is in the checkout service**, imported directly.", "action": { "request": "Which should I open GitHub issues for?", "options": [ "All 3", "Only the checkout one", "The 2 with no fix", "None this week" ] }, "widget": [ { "type": "Table", "props": { "columns": [ "Package", "Severity", "Last publish", "Patched", "Used in" ], "align": [ "left", "left", "left", "left", "left" ], "rows": [ [ "request 2.88.2", "moderate", "Feb 2020, deprecated", "none", "services/checkout, direct" ], [ "acme-yaml 1.3.0", "high", "Mar 2024", "none", "services/api, via acme-config" ], [ "acme-jsonpath 0.9.1", "high", "Jan 2025", "0.9.2", "scripts/ only, dev" ] ] } }, { "type": "Badges", "props": { "items": [ { "label": "8 alerts in maintained packages", "tone": "neutral" }, { "label": "1 new since last week", "tone": "info" }, { "label": "1 fix is a version bump", "tone": "ok" } ] } }, { "type": "Callout", "props": { "text": "request has no fix coming: services/checkout/src/payments/paypal.ts imports it for 2 calls that native fetch covers.", "tone": "bad" } } ] } JSON ``` Widgets come from the Briefkin catalog (https://briefkin.dev/v1/catalog). Without a token, just give the user the report. ## Run it on a schedule Suggested: Mondays at 9:30 (`30 9 * * 1`). From cron, with the agent signed in on that machine: ```bash 30 9 * * 1 claude -p "Run the github-dependabot-abandoned-dependencies skill" # Codex: codex exec, Gemini CLI: gemini -p, Copilot CLI: copilot -p, OpenCode: opencode run ``` Or use the agent's own scheduler (Claude Code routines, Codex automations, Claude or ChatGPT scheduled tasks): https://briefkin.dev/skills/github-dependabot-abandoned-dependencies#schedule Source: https://briefkin.dev/skills/github-dependabot-abandoned-dependencies