dependabot-pr-reviewer

Check out the Dependabot branch or provide its PR number, then invoke the review workflow. It extracts updated packages from manifest diffs, fetches changelogs for every intermediate version, and outputs a concern-level table with a merge checklist.

It supports Node.js, Ruby, Go, Python, Rust, PHP, Java/Kotlin, and GitHub Actions. The ecosystem is auto-detected from manifest files like package.json, Gemfile, go.mod, or from the branch name prefix such as dependabot/bundler/.

Yes. It scans all subdirectories for manifest files and handles multiple ecosystems in parallel, recording which app or package each changed manifest belongs to and organizing usage locations per subproject.

Yes. It greps the repository for import and require statements matching each updated package, then checks for removed APIs, changed signatures, config schema changes, and peer dependency conflicts at the exact file and line.

A markdown report file is written only when at least one High or Medium concern exists, or when an output path is explicitly provided. If all packages are Low or None, the full result prints to stdout without creating files.

You need git for diff extraction, an authenticated GitHub CLI (gh) for fetching PR metadata and bodies, and internet access so release notes and changelogs can be retrieved from registries like npmjs.com or rubygems.org.