diff --git a/.cve-fix/examples.md b/.cve-fix/examples.md
index a1bf7586df5..9ef46710c55 100644
--- a/.cve-fix/examples.md
+++ b/.cve-fix/examples.md
@@ -1,29 +1,44 @@
-<!-- last-analyzed: 2026-04-16 | cve-merged: 4 -->
+<!-- last-analyzed: 2026-04-20 | cve-merged: 4 | cve-closed: 0 | WARNING: limited-data since last analysis — new patterns based on 1 open PR + 2 commits, verify before relying on additions -->
 
 ## Titles
 - `Security: Fix CVE-YYYY-XXXXX (<package>)` (4/27 merged PRs)
   - e.g. `Security: Fix CVE-2026-33186 (grpc-go)`
-  - e.g. `Security: Fix CVE-2026-33186 (grpc-go)`
+- `fix(cve): CVE-YYYY-XXXXX - <package>` — alternate format used by CVE Fixer workflow (1 open PR + 1 commit)
+  - e.g. `fix(cve): CVE-2025-13465 - lodash`
 
 ## Branches
 - `fix/cve-<id>-<pkg>-<branch>-attempt-N` (4/27 merged PRs)
   - e.g. `fix/cve-2026-33186-grpc-go-release-2.14-attempt-1`
-  - e.g. `fix/cve-2026-33186-grpc-go-release-2.15-attempt-1`
+  - e.g. `fix/cve-2025-13465-lodash-release-2.14-attempt-1`
 - `dependabot/<ecosystem>/<pkg>-<version>` (3/27 merged PRs)
   - e.g. `dependabot/go_modules/github.com/golang-jwt/jwt/v5-5.2.2`
   - e.g. `dependabot/go_modules/golang.org/x/crypto-0.35.0`
 
-## Files
+## Files — Go ecosystem
 - `go.mod` + `go.sum` always change together for Go dependency updates
 - `Dockerfile` / `Containerfile.operator` may also be updated (Go version bumps)
 
+## Files — npm/JS ecosystem (web/ui)
+- `web/ui/package.json` + `web/ui/package-lock.json` change together for npm CVEs (1 open PR)
+- `web/ui/embed.go` updated when embedded assets are rebuilt (~66 files total change)
+- `web/ui/static/**/*.gz` files regenerated (compressed static assets rebuilt)
+
+## Build steps — npm/JS ecosystem (must run in order)
+1. `npm install` — resolves the override and updates `package-lock.json`
+2. `build_ui.sh --all` — rebuilds the React app
+3. `compress_assets.sh` — regenerates all `.gz` files and updates `embed.go`
+
 ## Co-upgrades
 - When bumping a Go dependency, always run `go mod tidy` to update `go.sum`
 - Go version bumps (`go.mod` directive) often require updating `Dockerfile` / `Containerfile.operator`
+- For transitive npm deps (e.g. lodash): use `overrides.<package>: "^<version>"` in `package.json` (1 open PR)
 
 ## PR Description
 - Include CVE ID, severity, and affected package in description
+- Include impact description, vulnerable version range, and fixed version
 - Reference the target branch (e.g. `release-2.16`) when targeting non-default branches
+- Include Jira reference in format: `Resolves: ACM-XXXXX` (1 open PR + commit)
+- For bot-generated PRs: preserve `🤖 Generated by CVE Fixer Workflow` and `<!-- cve-fixer-workflow -->` markers (1 open PR)
 - Include test results section
 - For multi-branch fixes, create separate PRs per branch (not a single PR)