Dependency upgrades

Upgrades are the definition of work that nobody wants and everybody needs. The agent's discipline is one change per pull request and a green suite as the price of entry, which is what makes the review trivial.

The job on one screen

Runs when	Weekly, and immediately for advisories with a known exploit.
Reads	The lock file, the advisory feed, the changelog, and the test suite.
Decides	Which upgrades are safe to propose alone, and which need a human before anyone runs anything.
Produces	One pull request per dependency, with the changelog and test result attached.
Stops when	Green suite and PR opened, or red suite and the attempt is reported rather than merged.
Tools it needs	Package manager, CI, repository API, advisory feed.
Autonomy to start at	Approve. It does the work and stops before the irreversible step.

Optional: load a real model

Run it

The policy, in the order it is applied

First match wins, and the trace names the clause. If you cannot write your policy as a list like this, an agent is not your first problem.

Clause, in order	Outcome	Reason given
Tests fail after the upgrade	reject	No PR is opened. A red upgrade is reported as a note, never as a review request.
Critical advisory	escalate	Speed matters more than process here, so a human is paged rather than handed a PR to review whenever they get to it.
Major version change	escalate	Semver majors mean intentional breakage. The agent prepares the branch and a person reads the migration guide.
Wide blast radius	escalate	A patch bump that touches two hundred files is not a patch bump in practice.
Nothing matched	approve	Open the PR with the changelog attached. This is the boring 90% that eats a developer day every month.

Where this one goes wrong

Batching upgrades

Ten bumps in one PR means a red suite tells you nothing. One per PR, always.

Trusting semver

Patch releases break things. The test suite is the authority, not the version number.

Auto-merging on green

Your tests do not cover everything, and the gap is exactly where a dependency change hurts.

How you would know it is working

Measure	Why that one
Dependency age across the repo	The number this exists to reduce.
PRs merged without changes	High is good, and it is what earns the agent more autonomy.
Rollbacks caused by an upgrade	The cost side. Should be rare, and each one is a test you were missing.

Earning more rope

Assist	Report available upgrades and their changelogs.
Approve	Open one PR per green upgrade for human review. Right level.
Auto	Auto-merge patch bumps in low-risk repositories, with a rollback plan and a canary.

The test suite is the whole guardrail. This agent is only as safe as your coverage, which makes it an honest forcing function for the coverage conversation.

Related: PR review · Testing agents · Change log writing · all agent jobs · Agent Lab home

Free from AI School - no signup, everything runs in your browser.