Analyzes a Dependabot PR to determine what actually changed in each bumped package and whether those changes affect this repo. Reports changed APIs/methods, which doc pages use them, and the realistic probability of any visible impact on the docs site.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Instruções da origem · Visualização somente leitura
name
dependabot-review
description
Analyzes a Dependabot PR to determine what actually changed in each bumped package and whether those changes affect this repo. Reports changed APIs/methods, which doc pages use them, and the realistic probability of any visible impact on the docs site.
Load this skill when asked to review, analyze, assess, or verify a Dependabot PR.
Goal
Give the reviewer a clear answer to: does this version bump require any action beyond merging?
Changed APIs affect output seen by users — rendered HTML, search index, Worker behavior
For security fixes: note what the vulnerability affects and whether our usage is in the vulnerable code path.
Output format
## <package-name>: <old-version> → <new-version>
**Type of update:** [security fix | bug fix | feature | breaking change]
**Dependency type:** [direct | transitive (pulled in by <package>)]
### What changed
- <bullet: specific API/behavior change>
- <bullet: ...>
### Usage in this repo
<"Not used directly — transitive only" OR list of files/callsites>
### Affected doc pages (sample)
- `/product/section/page/` — uses `<method>`
- (none)
### Impact rating: <None | Very Low | Low | Medium | High>
<1–2 sentence explanation of the rating>
If the PR bumps multiple packages, repeat the block for each. End with a one-line recommendation:
Merge — no action needed
Merge + verify — merge, then spot-check the listed pages
Investigate before merging — high-impact change, needs manual testing
Special cases
Security PRs opened outside the schedule
Dependabot opens security PRs immediately, regardless of dependabot.yml schedule. This is expected. The schedule.day setting only applies to version updates.
Security PRs are also not grouped with other packages — each gets its own PR. This is also expected GitHub behavior.
Grouped PRs
For grouped PRs (non-major group), the PR body lists each package separately. Process each package independently through steps 2–6, then give a combined recommendation.
Packages with no public changelog
If a package has no changelog and the upstream repo is private or unavailable:
Check npm for version diff: npm diff <package>@<old> <package>@<new>
If that also fails, note it explicitly and rate impact conservatively based on usage alone.
