[mldangelo-oai]

Summary

Add $resolve-dependency-alert to investigate vulnerable packages from scanner reports and prepare an upgrade when requested.

Changes

• Trace the affected copies and their parents. Check the proposed version against the advisory and the repository’s release cooldown, then verify the upgrade with $fix-finding.
• Let the existing GitHub importer read native Dependabot alerts. Each occurrence keeps its original evidence and must match the destination repository.

Testing

• Three importer suites passed 245 tests, with one platform-specific skip. SDK types, formatting, plugin packaging and portable source checks passed.
• Exercised an offline transitive npm upgrade and a Grype report against a Python uv lockfile.
• Native CLI review is pending after an authentication failure.

Risk and rollout

Import still requires opt-in and preview. Scanner formats without an importer can be assessed directly. A human approves and executes any dismissal in the scanner.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[alandelong-oai]

Thanks for connecting dependency alerts to the existing assessment and remediation workflows. This owner-level merge-safety review found no material issues: native alert provenance is retained, package ranges are kept separate from installed-version evidence, and provider state does not become a Codex assessment. One permission-documentation clarification is inline.

Validation: 24 focused tests, 13 deterministic routing contracts, nine portable source tests, and type/format/build/package checks passed locally. Current-head CI confirms the changed local persistence and Cloud destination cases. Local persistence was not rerun because of the established environment path/ownership restriction; no live scanner, provider mutation or model-driven routing was exercised.

[alandelong-oai]

Nonblocking: please name Dependabot alerts: read beside this example and scope the following permission paragraph to code-scanning. That paragraph currently says reading alerts requires Code scanning alerts: read and code scanning enabled, but this endpoint uses the separate Dependabot read permission. This will keep users from following the wrong token setup for the new example.

[alandelong-oai]

Thanks for keeping dependency resolution on the existing import and fix paths. This owner-level merge-safety review found no material issues. Native Dependabot records retain per-alert identity and package ranges, remain unassessed, and are checked against the selected repository. Import still requires opt-in and preview; scanner dismissals remain human-operated.

Validation: 22 focused local tests, 13 deterministic routing contracts, nine portable source tests, 11 compiled-reader smoke scenarios, and build/type/format/plugin-packaging checks passed. Current-head CI confirms 224 local-import/publication tests passed, with one Windows-only skip. Local persistence was not rerun because of the established environment ownership restriction. No live scanner, Cloud upload, or model-driven workflow was exercised.