Menü
Dependabot Agent - Review, evaluate, and batch-merge dependabot PRs
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Tester Agent - Write tests, find bugs, improve coverage
Tech Writer - Review app copy, maintain documentation site, flag inconsistencies
Changelog Drafter - Generate changelog entries from git history for human review
Security Agent - Identify OWASP Top 10 vulnerabilities and security issues
Tech Lead - Groom backlog items into iterations, produce implementation plans, and orchestrate dev/test/review subagents. Use when a backlog item is too large for a single /dev pass.
Compliance Agent - Verify architectural principles and design patterns
| name | dependabot-merger |
| description | Dependabot Agent - Review, evaluate, and batch-merge dependabot PRs |
Review open dependabot PRs, classify each for value and risk, consolidate the worthwhile ones onto a single branch via iterative cherry-pick, open a PR for review, and close the ones we're deliberately skipping.
gh must be authenticated (gh auth status)git status)Read .claude/THOUGHT_ERRORS.md to avoid past mistakes.
gh pr list --author "app/dependabot" --state open --json number,title,headRefName,labels
Work through the Include PRs in order (patch releases before minor bumps, CVE fixes first within each tier).
For each PR:
git checkout main && git pull
git checkout -b deps/batch-YYYY-MM-DD
gh pr checkout <number> --detach # puts HEAD at the PR tip
git log --oneline main..HEAD # note the commits to cherry-pick
git checkout deps/batch-YYYY-MM-DD
git cherry-pick <sha> [<sha> ...]
poetry.lock will conflict on every cherry-pick after the first — each dependabot
commit fully regenerates poetry.lock from main, so it always conflicts once the
consolidation branch has any prior bump. Treat the manual-regenerate path as the norm:
git cherry-pick --abort
# Get the pyproject.toml version change from the PR:
gh pr diff <number> | grep "^[+-]" | grep "<package>"
# Apply the version bump manually to pyproject.toml, then:
poetry lock && poetry install
git add pyproject.toml poetry.lock
git commit -m "<original dependabot commit message>"
gh pr diff <number> -- <file> does NOT work (accepts at most 1 arg). Use the
pipe-and-grep form above to extract pyproject.toml changes from the diff.poetry show <package>
make check # Must pass
make test # Must pass
If either fails: investigate root cause. If the failure is caused by a breaking change in one of the included packages, either fix the application code or downgrade that package to Skip and remove it from the branch.
Push the branch and open a PR:
git push -u origin deps/batch-YYYY-MM-DD
gh pr create \
--title "Bump <pkg1>, <pkg2>, ..." \
--body "$(cat <<'EOF'
<body — see template below>
EOF
)"
gh pr edit --add-label "run-e2e"
The run-e2e label triggers the E2E test suite in CI. Do not merge; wait for the user to
review CI results and merge with rebase-and-merge.
Do NOT manually close any dependabot PRs. Dependabot auto-closes its own PRs when it detects the target version (or a newer one) is already on main. This applies to all PRs: included, skipped, and superseded. Let dependabot handle the lifecycle.
A PR has value if it:
pip-audit / dev/deps_check.py has flaggedVersion freshness alone is not sufficient to include a minor or major runtime bump.
| Version jump | Scope | Default verdict |
|---|---|---|
| Patch | Any | Include |
| Minor | Dev-only (ruff, mypy, pytest-*) | Include |
| Minor | Runtime | Evaluate changelog; include if no breaking changes affect us |
| Major | Any | Skip (recommend separate targeted evaluation) |
| Any level | CVE fix | Include |
Always include security patches. Evaluate feature releases carefully before including:
cryptography, argon2-cffi, python3-saml, itsdangerous, pyotpfastapi, pydantic, jinja2, psycopgSkip (leave open) when:
When in doubt, skip rather than include. Dependabot will auto-close skipped PRs if a newer version is merged via a future batch.
Batch dependency update YYYY-MM-DD.
## Included
| Package | From | To | Reason |
|---|---|---|---|
| cryptography | 43.0.0 | 43.0.3 | CVE-2024-XXXX |
| ruff | 0.8.0 | 0.9.1 | Minor dev-tool bump, no runtime impact |
## Skipped
| Package | From | To | Reason |
|---|---|---|---|
| fastapi | 0.115.0 | 0.116.0 | Minor bump, changelog has routing behavior changes — needs review |
Use the original dependabot commit message when cherry-picking cleanly.
When a conflict required manual resolution:
Bump <package> from X.Y.Z to X.Y.W
Resolved poetry.lock conflict by regenerating after cherry-pick.
Some dependabot PRs only modify deploy/prod_requirements.lock.txt (a generated file). These are
transitive dependencies not directly pinned in pyproject.toml. The canonical source for
transitive dep versions is poetry.lock. deploy/prod_requirements.lock.txt is derived from it
via poetry export (automated by the sync-prod-requirements workflow).
Do not cherry-pick these PRs. Instead, after applying direct dep bumps, update transitive deps through poetry:
poetry update <pkg1> <pkg2> ...
poetry export --only main --without-hashes -f requirements.txt -o deploy/prod_requirements.lock.txt
Commit the updated pyproject.toml, poetry.lock, and deploy/prod_requirements.lock.txt together.
pyproject.toml, poetry.lock, and
deploy/prod_requirements.lock.txt (unless a breaking change forces an adjustment, which
should be called out explicitly).github/dependabot.yml (dev at /app, production at /). Base image bumps may arrive as pairs.Check gh auth status, then list open dependabot PRs and present the classification table.