fix-dependabot
starsforks
How to install fix-dependabot?
remotion-dev/remotion/fix-dependabot
$npx -y skills add remotion-dev/remotion --skill fix-dependabotFix a Dependabot PR by updating all monorepo instances of the dependency, running bun install, and pushing
SKILL.md
| 1 | Dependabot PRs only update one `package.json` and never run `bun install`, so the `bun.lock` file is out of date and other packages in the monorepo still reference the old version. This skill fixes both problems. |
| 2 | |
| 3 | ## Steps |
| 4 | |
| 5 | 1. **Get PR info** — Use `gh pr view <number> --json headRefName,files,title,body` to identify the branch name, which dependency was bumped, and the old/new versions. |
| 6 | |
| 7 | 2. **Checkout the branch**: |
| 8 | |
| 9 | ```bash |
| 10 | git fetch origin <branch> |
| 11 | git checkout <branch> |
| 12 | ``` |
| 13 | |
| 14 | 3. **Update all monorepo instances** — Dependabot only touches one package. Search for all other `package.json` files that reference the same dependency at the old version and update them too: |
| 15 | |
| 16 | ```bash |
| 17 | rg '"<dependency>": "[~^]?<old-version>"' --glob '**/package.json' |
| 18 | ``` |
| 19 | |
| 20 | Update every match to the new version. Preserve the prefix style (`^`, `~`, or exact) that each package already uses. |
| 21 | |
| 22 | 4. **Run `bun install`** from the repo root to regenerate `bun.lock`. |
| 23 | |
| 24 | 5. **Verify** — Run `git status` to confirm only `bun.lock` and the expected `package.json` files were modified. If other unexpected files changed, investigate before proceeding. |
| 25 | |
| 26 | 6. **Commit and push**: |
| 27 | |
| 28 | ```bash |
| 29 | git add -u |
| 30 | git commit -m "Update <dependency> to <version> across all monorepo packages" |
| 31 | git push |
| 32 | ``` |
| 33 | |
| 34 | 7. **Switch back** — Return to your previous branch (usually `main`): |
| 35 | |
| 36 | ```bash |
| 37 | git checkout main |
| 38 | ``` |
| 39 | |
| 40 | ## Notes |
| 41 | |
| 42 | - Dependabot says "Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself" — but updating the lockfile and sibling packages is the expected workflow and won't cause issues. |
| 43 | - If the version bump is a major version (e.g. vite 5 → 6), consider whether the upgrade is appropriate or if it should be ignored. Check for breaking changes. |
| 44 | - If `bun install` fails, the dependency version may have conflicts with other packages. In that case, close the PR and comment explaining why. |
People who liked this also viewed
6 picksType
- paperclip-create-agentCreate new agents in Paperclip with governance-aware hiring. Use when you need to inspect adapter configuration options, compare existing agent configs, draft a new agent prompt/config, and submit a hSkillsJul 2026
- subagent-driven-developmentUse when executing implementation plans with independent tasks in the current sessionSkillsJul 2026
- dispatching-parallel-agentsUse when facing 2+ independent tasks that can be worked on without shared state or sequential dependenciesSkillsJul 2026
- browser-act-skill-forgeForges reusable Skill packages (SKILL.md + scripts) from website exploration via browser-act — no re-exploration later. Use when: user wants a reusable Skill for any website, needs to understand a sitSkillsJul 2026
- wizardGenerate an interactive bash wizard that walks a human through a manual procedure — third-party setup, a one-off migration, an A→B state transition — opening URLs, capturing values, confirming each stSkillsJul 2026
- wonda-cliUsing the Wonda CLI to generate images, videos, music, and audio from the terminal — plus LinkedIn, Reddit, and X/Twitter research and automationSkillsJul 2026
