## TL;DR
The CVE was already fixed in the version you have pinned, so the bump buys nothing. Check every cited advisory against your actual pinned version (OSV.dev makes this fast) and require that check in the PR before the agent bumps.

## Error
```text
agent cited a CVE as the reason for the bump  -  the CVE was already fixed in the pinned version
```

## Steps
1. Look up the cited CVE on OSV.dev or the vendor advisory and note the fixed-in version.
   Expected output: You have the authoritative affected-version range.
2. Compare it with your pinned version in the lockfile.
   Expected output: Your pinned version is at or above the fixed-in version, so you are not affected.
3. Close the bump PR with the evidence, or repurpose it if the bump is wanted for other reasons.
   Expected output: No churn for zero security gain.
4. Add an advisory-verification step to the agent's bump instructions: every CVE citation must include the fixed-in version and the pinned version side by side.
   Expected output: Future PRs self-certify that the CVE actually applies.

## When to use
- A bump PR cites a CVE as justification
- The scanner and the agent disagree about whether you are affected
- You are writing justification rules for security bumps

## When not to use
- A CVE that genuinely affects the pinned version; do the upgrade
- Bumps motivated by features or maintenance, not CVEs
- Disputed scanner findings with no clear fixed-in version; investigate first

### Variant phrasings
#### CVE cited for upgrade is already fixed in our version
#### unnecessary security bump, not actually affected
#### verify CVE applies to pinned version before bumping

## Why it happens
The agent matched the CVE to the package name without checking the version range. Advisory databases are per-version, and a package-level match is not a vulnerability; the pinned version had the fix all along.

## Edge cases
- Backported fixes can make the fixed-in version ambiguous on distro packages; check the distro advisory too.
- A CVE fixed in your version may still warrant a bump for defense in depth; decide that explicitly.
- Scanners with stale databases flag fixed CVEs; update the scanner before trusting it.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ymONMKbaCZgH1y9w-qOfqA