| name | update-deps |
| description | Consolidate open dependabot PRs into a single dependency update branch. Use when there are open dependabot PRs to merge. |
| allowed-tools | Bash, Read, Edit, Write, Glob, Grep, TaskCreate, TaskUpdate, TaskList |
Update Dependencies from Dependabot PRs
Consolidate all open dependabot PRs into a single dependency update branch with one commit and one PR.
Step 1: Gather open dependabot PRs
gh pr list --state open --author "app/dependabot" --json number,title,headRefName,files
If no open PRs, inform the user and stop.
Step 2: Create a feature branch
git checkout main
git pull origin main
git checkout -b chore/update-dependencies main
Step 3: Analyze what needs to change
For each dependabot PR, determine if it modifies:
uv.lock only — a lockfile-only bump (no version constraint change needed)pyproject.toml + uv.lock — a version constraint change
For PRs that modify pyproject.toml, read the diff to understand the constraint change:
gh pr diff <PR_NUMBER> -- pyproject.toml
Also check .pre-commit-config.yaml — if a PR bumps a tool that's also pinned there (e.g., ruff), update the rev there too.
Step 4: Apply changes
- For pyproject.toml constraint changes: Edit
pyproject.toml to update the version bounds. Also check if .pre-commit-config.yaml needs the same version bump (e.g., ruff rev).
- Run
uv sync to regenerate uv.lock with all updates at once.
- Run
uv lock --upgrade if uv sync alone doesn't pick up all the new versions.
Step 5: Verify
Run these commands and ensure they all pass:
make lint
make test
If tests or lint fail, investigate and fix. Common issues:
- New linter rules from ruff upgrades — run
uv run ruff check --fix src/
- Type errors from pyrefly upgrades — fix type annotations
- Breaking changes in dependencies — check changelogs from the dependabot PR bodies
Step 6: Commit and push
Stage only the changed files (typically pyproject.toml, uv.lock, .pre-commit-config.yaml):
git add pyproject.toml uv.lock .pre-commit-config.yaml
Commit with a conventional commit message:
git commit -m "$(cat <<'EOF'
build: consolidate dependabot dependency updates
<list each update as a bullet point with PR number, package, old version → new version>
Resolves #<PR1>, #<PR2>, ...
EOF
)"
Push and create a PR:
git push -u origin chore/update-dependencies
Step 7: Create the PR
Create the PR with a summary table of all updates:
gh pr create --title "build: consolidate dependabot dependency updates" --body "$(cat <<'EOF'
## Summary
- Consolidates all N open dependabot PRs into a single dependency update
## Dependency Updates
| PR | Package | Type | Update |
|----|---------|------|--------|
| #N | package-name | runtime/dev/build | old → new |
...
## Test plan
- [ ] All tests pass (`make test`)
- [ ] All linting checks pass (`make lint`)
- [ ] CI passes on PR
Resolves #PR1, #PR2, ...
EOF
)"
Step 8: Close dependabot PRs
After the consolidated PR is merged, the dependabot PRs should auto-close when their referenced issues resolve. If any remain open, close them with a comment:
gh pr close <PR_NUMBER> --comment "Consolidated into #<NEW_PR_NUMBER>"
