fix-dependabot by MoizIbnYousaf

Decision brief

What it does—and where it fits

1. Get PR info — Use gh pr view --json headRefName,files,title,body to identify the branch name, which dependency was bumped, and the old/new versions.

Best for

Not for

Tasks that require unconfirmed production actions or broad system permissions.
Environments where the pinned source and install steps cannot be inspected.

Compatibility matrix

Platform support, with evidence labels

Platform	Status	Evidence	What to check
Codex	Not declared	No explicit evidence	Portability before use
Claude Code	Not declared	No explicit evidence	Portability before use
Cursor	Not declared	No explicit evidence	Portability before use
Gemini CLI	Not declared	No explicit evidence	Portability before use

Open the compatibility checker

Installation

Inspect first. Install second.

The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

Source-detected install commandSource

npx skills add https://github.com/MoizIbnYousaf/marketing-cli --skill "skills/remotion-best-practices/references/upstream-internal/skills/fix-dependabot"

Safe inspection promptEditorial

Inspect the Agent Skill "fix-dependabot" from https://github.com/MoizIbnYousaf/marketing-cli/blob/f12fbcbe4929584697b309b9096c9427b0cfce8e/skills/remotion-best-practices/references/upstream-internal/skills/fix-dependabot/SKILL.md at commit f12fbcbe4929584697b309b9096c9427b0cfce8e. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

Workflow

What the source asks the agent to do

01
Steps
1. Get PR info — Use gh pr view --json headRefName,files,title,body to identify the branch name, which dependency was bumped, and the old/new versions.
Get PR info — Use gh pr view --json headRefName,files,title,body to identify the branch name, which dependency was bumped, and the old/new versions.Checkout the branch:Update all monorepo instances — Dependabot only touches one package. Search for all other package.json files that reference the same dependency at the old version and update them too:
02
Notes
Dependabot says "Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself" — but updating the lockfile and sibling packages is the expected workflow and won't cause issues.
Dependabot says "Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself" — but updating the lockfile and sibling packages is the expected workflow and won't cause issues.If the version bump is a major version (e.g. vite 5 → 6), consider whether the upgrade is appropriate or if it should be ignored. Check for breaking changes.If bun install fails, the dependency version may have conflicts with other packages. In that case, close the PR and comment explaining why.

Permission review

Static risk signals and limitations

Runs scripts

medium · line 10

The documentation asks the agent to run terminal commands or scripts.

git fetch origin <branch>

Runs scripts

medium · line 11

The documentation asks the agent to run terminal commands or scripts.

git checkout <branch>

Evidence record

Why each signal appears

EvidenceSourceComputedTestedEditorial

Signal	Value	Evidence type	Meaning
Quality score	67/100	Computed	Documentation, specificity, maintenance, and trust rules
Repository stars	27	Source	Repository attention, not individual Skill quality
Compatibility	0 platforms	Source	Declared in the catalog source record
Usage guide	automated source guide	Editorial	Generated or reviewed according to the visible evidence level

Pinned source

Provenance and original SKILL.md

Repository: MoizIbnYousaf/marketing-cli
Skill path: skills/remotion-best-practices/references/upstream-internal/skills/fix-dependabot/SKILL.md
Commit: f12fbcbe4929584697b309b9096c9427b0cfce8e
License: MIT
Collected: 2026-07-28
Default branch: main

View the original SKILL.md

Dependabot PRs only update one package.json and never run bun install, so the bun.lock file is out of date and other packages in the monorepo still reference the old version. This skill fixes both problems.

Steps

Get PR info — Use gh pr view <number> --json headRefName,files,title,body to identify the branch name, which dependency was bumped, and the old/new versions.
Checkout the branch:

git fetch origin <branch>
git checkout <branch>

Update all monorepo instances — Dependabot only touches one package. Search for all other package.json files that reference the same dependency at the old version and update them too:

rg '"<dependency>": "[~^]?<old-version>"' --glob '**/package.json'

Update every match to the new version. Preserve the prefix style (^, ~, or exact) that each package already uses.

Run bun install from the repo root to regenerate bun.lock.
Verify — Run git status to confirm only bun.lock and the expected package.json files were modified. If other unexpected files changed, investigate before proceeding.
Commit and push:

git add -u
git commit -m "Update <dependency> to <version> across all monorepo packages"
git push

Switch back — Return to your previous branch (usually main):

git checkout main

Notes

Dependabot says "Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself" — but updating the lockfile and sibling packages is the expected workflow and won't cause issues.
If the version bump is a major version (e.g. vite 5 → 6), consider whether the upgrade is appropriate or if it should be ignored. Check for breaking changes.
If bun install fails, the dependency version may have conflicts with other packages. In that case, close the PR and comment explaining why.