Analyze the dependency update PRs created by Dependabot, and create a single PR that integrates all updates.
Handling of additional instructions
When the user explicitly invokes this skill, they may provide additional instructions. The additional instructions are likely to include the following information.
- Target repository and branches to process
- Range of PRs to process (number specification, package type, etc.)
- Merge/close policy (process only specific PRs, exclude some, etc.)
- Packages to exclude or updates to skip
Additional instructions are optional; if none are given, run only the standard flow. Additional instructions take precedence over other policies in this skill. However, if they conflict with the important constraints of the "Basic policy" described below (such as not merging each Dependabot PR individually but consolidating them into an integrated PR), stop immediately and ask the user for confirmation.
Basic policy
- Do not merge each Dependabot PR individually; integrate all dependency updates into a single branch
- Attempt automatic fixes wherever possible, and clearly report problems caused by breaking changes
- Provide a high-quality PR body that makes it easy for reviewers to understand the changes
Procedure
1. Assess the current state
gh pr list --author "app/dependabot" --state open --json number,title,headRefName,mergeable,statusCheckRollup
Organize the following.
- List of target PRs (number, package name, version change)
- Mergeability and CI status
- Presence or absence of conflicts
2. Analyze dependencies
Extract the following from each PR.
- Package name
- Current version → updated version
- Type of semantic versioning change (major/minor/patch)
- Check the CHANGELOG and release notes for the presence of breaking changes
3. Create an integration branch
The base branch is develop → main → master Check for the existence of in the order, and use the first one found (pr the same rule as the skill).
git checkout <base-branch>
git pull origin <base-branch>
git checkout -b chore/dependabot-sweep-YYYYMMDD
4. Batch update dependencies
- Directly edit package.json (or the relevant dependency management file)
- Update the lock file (
pnpm install/npm install/yarn install） - If there are type definition inconsistencies or build errors, fix them wherever possible
5. Quality check
Run the project's quality check commands.
- Type check
- lint
- Build
If there are errors, attempt to fix them. Record unfixable problems caused by breaking changes.
6. Commit and create PR
Commit the changes and create a PR with the following structure.
## Summary
dependabot による依存関係更新 PR を統合し、一括で更新を適用。
## Updated Packages
| Package | From | To | Type |
|---------|------|-----|------|
| xxx | 1.0.0 | 2.0.0 | major |
| yyy | 1.2.3 | 1.2.4 | patch |
## Change Highlights
### Breaking Changes
- (パッケージ名): 変更内容と影響
### Notable Updates
- (パッケージ名): 主要な新機能や修正
## Notes
- 手動対応が必要な項目（あれば）
- 動作確認のポイント
## Closed PRs
このPRにより以下のdependabot PRをクローズ:
- #123, #124, #125...
7. Closing dependabot PRs
After integration is complete, leave a comment on the original Dependabot PRs and close them. Do not merge the individual PRs.
gh pr close <number> --comment "Consolidated into #<new-pr-number>"
Output
- URL of the created PR
- List of updated packages and change types
- Items that could not be handled (those requiring manual handling due to breaking changes, etc.)
- Recommended points to verify