Reviews Dependabot dependency upgrade pull requests to assess impact, breaking changes, and merge readiness. Works across ecosystems (npm, RubyGems, PyPI, Go modules, etc.). Works in two modes: (1) single-PR review when the user pastes a Dependabot PR URL, and (2) audit mode that discovers every open Dependabot PR in the current repo, analyzes them one by one, and produces a consolidated triage report. Use this skill whenever the user pastes a Dependabot PR URL, asks to review a dependency upgrade PR, mentions a package version bump, or wants to know if a Dependabot PR is safe to merge. Also trigger in audit mode when the user says things like "review all open dependabot PRs", "which dependabot PRs are ready to merge", "audit our dep upgrades", "go through the open dep PRs", "check dependabot", or asks for a status/report on pending dependency updates. Trigger on any GitHub PR URL related to dependabot, package upgrades, or "bump" in the title.
2026-07-10