For one confirmed real dependency finding, show the affected installed version,
trustworthy advisory URL, dependency path, runtime/build usage, compatible fix and
required regression tests. Propose the smallest reviewed update using the project’s
existing package manager and lockfile. Check install scripts and major-version
changes before execution. After an agreed local change, run the actual build/tests
and a fresh audit; distinguish remaining known findings from operational scan
errors. Do not suppress an unresolved finding just to make CI green, and stop before
production deployment.
