agent cited a CVE as the reason for the bump - the CVE was already fixed in the pinned version
Stops pointless bumps driven by already-fixed CVE citations. Use it when an upgrade PR justifies itself with a CVE that your pinned version is not actually affected by. Key trigger: the advisory's fixed-in version is at or below your pinned version. Not for: a CVE that genuinely affects your pinned version, which deserves the upgrade.
TL;DR
The CVE was already fixed in the version you have pinned, so the bump buys nothing. Check every cited advisory against your actual pinned version (OSV.dev makes this fast) and require that check in the PR before the agent bumps.
Error
agent cited a CVE as the reason for the bump - the CVE was already fixed in the pinned versionSteps
Look up the cited CVE on OSV.dev or the vendor advisory and note the fixed-in version. Expected output: You have the authoritative affected-version range.
Compare it with your pinned version in the lockfile. Expected output: Your pinned version is at or above the fixed-in version, so you are not affected.
Close the bump PR with the evidence, or repurpose it if the bump is wanted for other reasons. Expected output: No churn for zero security gain.
Add an advisory-verification step to the agent's bump instructions: every CVE citation must include the fixed-in version and the pinned version side by side. Expected output: Future PRs self-certify that the CVE actually applies.
When to use
- A bump PR cites a CVE as justification
- The scanner and the agent disagree about whether you are affected
- You are writing justification rules for security bumps
When not to use
- A CVE that genuinely affects the pinned version; do the upgrade
- Bumps motivated by features or maintenance, not CVEs
- Disputed scanner findings with no clear fixed-in version; investigate first
Variant phrasings
CVE cited for upgrade is already fixed in our version
unnecessary security bump, not actually affected
verify CVE applies to pinned version before bumping
Why it happens
The agent matched the CVE to the package name without checking the version range. Advisory databases are per-version, and a package-level match is not a vulnerability; the pinned version had the fix all along.
Edge cases
- Backported fixes can make the fixed-in version ambiguous on distro packages; check the distro advisory too.
- A CVE fixed in your version may still warrant a bump for defense in depth; decide that explicitly.
- Scanners with stale databases flag fixed CVEs; update the scanner before trusting it.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_ymONMKbaCZgH1y9w-qOfqA