From 47f3bedc521c15acb023ee5e32883a5ea01e778f Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 8 Jul 2026 15:16:13 +0200 Subject: [PATCH] Add dependency version pin guidance to add-rebase-rules skill Clarify when to use .rebase/add/ vs .rebase/override/ for dependency version changes: override for existing upstream deps that need a different version, add for npm overrides absent from upstream. Never use .rebase/replace/ for package.json version changes. Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 --- .claude/skills/add-rebase-rules/SKILL.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.claude/skills/add-rebase-rules/SKILL.md b/.claude/skills/add-rebase-rules/SKILL.md index 4bbd5523e96..83b4485fa56 100644 --- a/.claude/skills/add-rebase-rules/SKILL.md +++ b/.claude/skills/add-rebase-rules/SKILL.md @@ -51,6 +51,11 @@ Important: - `.rebase/override/` when overriding existing values must be explicit - It is valid to use both for one file. - Keep file formatting consistent with existing `.rebase` JSON style (2-space indentation). + - **Choosing add vs override for dependency version pins (e.g. CVE fixes):** + - If the dependency already exists in the upstream `package.json` (in `dependencies`, `devDependencies`, etc.) and we need a different version → use `.rebase/override/` with the correct section. This is an override of an existing upstream value. + - If the fix uses npm `overrides` (the npm feature that pins transitive dependency versions) and the override key does not exist in upstream's `overrides` section → use `.rebase/add/`. This is additive content absent from upstream. + - Never use `.rebase/replace/` (text replacement) for `package.json` version changes — always use the JSON merge mechanism (add or override). + - Place each entry in the file where the dependency actually lives in upstream. For example, if `@vitest/coverage-v8` is a devDependency of `code/extensions/copilot/package.json`, its override rule belongs in `.rebase/override/code/extensions/copilot/package.json`, not in a sibling package. 4. Create or update replace rules for non-JSON files - File path: `.rebase/replace/.json`