From 47f3bedc521c15acb023ee5e32883a5ea01e778f Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 8 Jul 2026 15:16:13 +0200 Subject: [PATCH 1/2] Add dependency version pin guidance to add-rebase-rules skill Clarify when to use .rebase/add/ vs .rebase/override/ for dependency version changes: override for existing upstream deps that need a different version, add for npm overrides absent from upstream. Never use .rebase/replace/ for package.json version changes. Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 --- .claude/skills/add-rebase-rules/SKILL.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.claude/skills/add-rebase-rules/SKILL.md b/.claude/skills/add-rebase-rules/SKILL.md index 4bbd5523e96..83b4485fa56 100644 --- a/.claude/skills/add-rebase-rules/SKILL.md +++ b/.claude/skills/add-rebase-rules/SKILL.md @@ -51,6 +51,11 @@ Important: - `.rebase/override/` when overriding existing values must be explicit - It is valid to use both for one file. - Keep file formatting consistent with existing `.rebase` JSON style (2-space indentation). + - **Choosing add vs override for dependency version pins (e.g. CVE fixes):** + - If the dependency already exists in the upstream `package.json` (in `dependencies`, `devDependencies`, etc.) and we need a different version → use `.rebase/override/` with the correct section. This is an override of an existing upstream value. + - If the fix uses npm `overrides` (the npm feature that pins transitive dependency versions) and the override key does not exist in upstream's `overrides` section → use `.rebase/add/`. This is additive content absent from upstream. + - Never use `.rebase/replace/` (text replacement) for `package.json` version changes — always use the JSON merge mechanism (add or override). + - Place each entry in the file where the dependency actually lives in upstream. For example, if `@vitest/coverage-v8` is a devDependency of `code/extensions/copilot/package.json`, its override rule belongs in `.rebase/override/code/extensions/copilot/package.json`, not in a sibling package. 4. Create or update replace rules for non-JSON files - File path: `.rebase/replace/.json` From a832b8a764342de5c7acf9e265f65a003bc354b5 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Mon, 13 Jul 2026 17:40:21 +0200 Subject: [PATCH 2/2] allow .rebase/replace/ for package.json when JSON merge is insufficient Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 --- .claude/skills/add-rebase-rules/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude/skills/add-rebase-rules/SKILL.md b/.claude/skills/add-rebase-rules/SKILL.md index 83b4485fa56..382385c543b 100644 --- a/.claude/skills/add-rebase-rules/SKILL.md +++ b/.claude/skills/add-rebase-rules/SKILL.md @@ -54,7 +54,7 @@ Important: - **Choosing add vs override for dependency version pins (e.g. CVE fixes):** - If the dependency already exists in the upstream `package.json` (in `dependencies`, `devDependencies`, etc.) and we need a different version → use `.rebase/override/` with the correct section. This is an override of an existing upstream value. - If the fix uses npm `overrides` (the npm feature that pins transitive dependency versions) and the override key does not exist in upstream's `overrides` section → use `.rebase/add/`. This is additive content absent from upstream. - - Never use `.rebase/replace/` (text replacement) for `package.json` version changes — always use the JSON merge mechanism (add or override). + - Prefer the JSON merge mechanism (add or override) over `.rebase/replace/` for `package.json` changes. However, `.rebase/replace/` is acceptable when the change cannot be expressed by JSON merge alone — for example, **replacing one dependency with a different package** (e.g. swapping `gulp-untar` for `gulp-decompress` — see `.rebase/replace/code/package.json.json`) or **inserting a new entry at a specific position** among existing keys. - Place each entry in the file where the dependency actually lives in upstream. For example, if `@vitest/coverage-v8` is a devDependency of `code/extensions/copilot/package.json`, its override rule belongs in `.rebase/override/code/extensions/copilot/package.json`, not in a sibling package. 4. Create or update replace rules for non-JSON files