Blog
Notes on the cleanup half of dependency security — deciding when an override that was added under pressure has stopped earning its keep.
August 12, 2026 · 6 min read
The dependency override cleanup problem nobody owns
Every team has a process for adding an override during an incident. Almost none have one for taking it out again.
Read →August 19, 2026 · 8 min read
When is it safe to delete an npm override?
The decision comes down to four questions. Here is how to answer each one, by hand and then automatically.
Read →August 26, 2026 · 7 min read
Making Dependabot and Renovate cleanup agent-ready with MCP
Bots open the upgrade PRs. Nothing closes the loop on the overrides they left behind — unless your agent can check.
Read →