Dependency updater

Keeps packages current without surprise breakage.

EngineeringWorks with Claude Code · Cursor+2Added Oct 10, 2026

Build your prompt See requirements

What it does

Opens update PRs
Reads changelogs for breaking changes
Runs the tests

Your approval boundaries

Creates drafts

These actions always wait for your yes:

Merging major version bumps

You decide what happens next.

More about this workflow

This setup is for developers and small engineering teams who want fewer chores. It takes a repeat chore off your plate and hands back something you can check quickly.

First, it opens update PRs. Next, it reads changelogs for breaking changes. Finally, it runs the tests. It works with your git host, package registry and CI, each on its own login with limited access.

You get the prep work done and waiting for you. The agent stops and asks for your yes before merging major version bumps, and says plainly if a step cannot be undone.

Before you startGit host · Package registry accessScoped permissionsClaude Code or Cursor

Explore required tools and model recommendations

Tools and access

GitHub
Handles the git host and ci part of this job. Grant a fine-grained token, read code and write comments.
API required: Yes. Needs a GitHub App or a fine-grained personal access token scoped to the repos it needs.
Sign up: Create a GitHub account
Package registry
Handles the package registry part of this job. Grant public read access.
API required: No. Public registries can be read without an account.
No sign-up needed

Official links only. Not sponsored, no affiliate links.

Model recommendations

Best pick

Claude Opus 5.5

Its maker points to it for long running coding work.

$4 per million input tokens, $20 per million output tokens.

Anthropic docs as of October 11, 2026

Cheaper backup

Claude Sonnet 5.5

Half the price per token and still strong for reviews and docs.

$2 per million input tokens, $10 per million output tokens.

Anthropic docs as of October 11, 2026

Our own picks. Not sponsored, no affiliate links.

Build your prompt

Add your details, then copy the prompt into your tool.

2Your prompt

3 of 3 still empty

Fill these in before you run it: [YOUR REPOS AND PACKAGE MANAGER] [UPDATE SCHEDULE: e.g. weekly] [PACKAGES TO NEVER AUTO UPDATE] You are the Dependency updater agent. Keeps packages current without surprise breakage. Use only the details filled in above. If any [BRACKETED] item is still blank or unclear, stop and ask for it first. Do not guess. What you do on your own: - Opens update PRs - Reads changelogs for breaking changes - Runs the tests What you must never do without a yes from a person: - Merging major version bumps Rules: - Before any step on the list above, stop and ask. Say in plain words what you want to do, who it affects, and whether it can be undone. - If something cannot be undone, say so first, in one short line. - Write drafts, not final actions. A person sends, pays, posts, or deletes. - Keep a short log of every action you took and every source you read. - If you are unsure, ask instead of guessing.

View run instructionsPaste into: Claude Code, Cursor, OpenAI Agents SDK, LangGraph

Your answers stay in this browser only.

Run your workflow

Connect your tools with only the access this setup needs, then follow these steps.

Do these in order. Test on old data before it touches live work.

1Connect GitHub with its own login, not yours. Grant a fine-grained token, read code and write comments.
2Set up Package registry. Keep it to public read access.
3Paste the prompt where your harness takes instructions. See the note under the Copy button.
4Do a dry run on old or test data first. Check every draft and every stop point by hand before you let it near live work.
5Read its log after the first real run. Only widen access once a week of runs looks clean.

Safeguards and trust score

The score describes this example setup’s access, approval boundaries, ability to undo changes, and scope.

Access24 / 30

Writes drafts and notes inside your tools, nothing leaves on its own.

Human approval27 / 30

Waits for a yes on: merging major version bumps.

Undo and logs14 / 20

Proposes changes to live records, so the setup needs a change log and a way back.

Scope16 / 20

Runs on its own login across 3 tools. Fewer connections means a smaller blast radius.

How to raise it

Human approval: Add a second named stop next to "merging major version bumps", so every step that leaves your hands waits for a yes, and have the confirm say plainly what cannot be undone +3
Undo and logs: Stop it from editing live records. Have it write the change as a proposal you apply, and keep a log of every change with a way to roll it back +3
Scope: Cut it down from 3 connected tools to the 2 it needs most, each with its own limited login instead of your full account +2

Do all of these to reach 89, up from 81.

Want help getting there? Get an AI Trust Audit from Pixeldesigns

Reviewed by Trustcase (example setup). How scoring works

Embed badge

Show this trust score on your site or README. It links back here.

Markdown

[![Trustcase trust score for Dependency updater](https://trustcase.dev/badge/dependency-updater.svg)](https://trustcase.dev/use-cases/dependency-updater)

HTML

<a href="https://trustcase.dev/use-cases/dependency-updater"><img src="https://trustcase.dev/badge/dependency-updater.svg" alt="Trustcase trust score for Dependency updater" height="20"></a>

Docs from code
Keeps internal docs in step with the code.
Client site request handler
Turns a client's text message about their website into a proposed code change ready for review. Made for a freelancer who maintains a small site for a client.
Trending repo scout
Finds the top trending open source repos each day and sums them up so you can spot tools worth using. Useful if most of your stack is built on open source.
Integration research sweep
Checks a long list of products for APIs, sign in methods, MCP support and how hard they are to connect. You still spot check the findings before trusting them.