deps

Name: deps
Availability: InStock
Author: Evolutionary-Leadership

Review and batch-merge Dependabot pull requests grouped by risk level.

Updated Aug 13, 2026

Search Tags:#github #pull requests #merge #semver #gh cli #dependency updates #dependabot

Ready to run

npx skills add https://github.com/Evolutionary-Leadership/harness --skill deps-evolutionary-leadership

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: deps
Source: https://github.com/Evolutionary-Leadership/harness/tree/main/.claude/skills/deps
Command: npx skills add https://github.com/Evolutionary-Leadership/harness --skill deps-evolutionary-leadership

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Open Dependabot pull requests pile up quickly, and manually triaging each one to decide what is safe to merge is repetitive and error-prone. This Skill reviews all open dependency PRs, groups them by risk, and merges the safe ones in a batch. ## Core Features & Use Cases - Risk-Based Grouping: Categorizes PRs into safe patches, minor updates needing review, and major/breaking changes requiring manual attention. - Batch Merging: Merges all approved patch-level updates in one action using the GitHub CLI. - Use Case: You return from vacation to find a dozen Dependabot PRs. Run this Skill to get a grouped report, merge the five safe patch updates at once, and flag the Next.js major upgrade for manual review. ## Quick Start Review my open Dependabot PRs and merge the safe patch updates.

Frequently Asked Questions about deps

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I batch merge Dependabot PRs on GitHub?▼

List open Dependabot PRs with the GitHub CLI, group them by risk level, then merge approved ones with gh pr merge. This Skill automates that flow, merging all safe patch updates in one batch and reporting any failures.

How to triage dependency updates by risk level?▼

Group updates into three tiers: patch bumps and dev dependency updates are safe to merge, minor bumps on runtime dependencies deserve a changelog review, and major version bumps or core framework updates require manual review before merging.

Which dependency updates are safe to auto-merge?▼

Patch version bumps, dev dependency updates like linters and test frameworks, and security patches are generally safe to merge. Major version bumps and core framework updates such as React, Next.js, or Express should always be reviewed manually.

What happens when a Dependabot PR merge fails?▼

The Skill reports failed merges separately, noting causes such as merge conflicts that need manual resolution. Successfully merged and skipped PRs are listed in the final summary so nothing is silently dropped.

Does this work without the GitHub CLI installed?▼

No, the workflow relies on the gh CLI to list and merge pull requests. You need gh installed and authenticated against the target repository before running the dependency review.