Always gather dependency-chain context, verify target versions, and choose the minimal safe fix

Before proposing a dependency, runtime, or vulnerability fix, trace the complete reachable transitive chain in every relevant independently maintained lockfile: resolved versions, locations, parents, ranges, and direct consumers. Verify the advisory’s fixed version exists and is compatible; classify alerts outside the vulnerable resolved range as stale. Prefer the least-invasive safe upgrade to a fixed version—normally a patched same-major release—and use pnpm.overrides for transitive dependencies before adding direct dependencies, with separate override keys where ranges require it. Prefer upgrades over workarounds, monkey patches, rollback pins, or configuration hacks; use a workaround only if no fixed version exists. Provide concrete versions, chain evidence, and reasoning.