Triage Dependabot pull requests by tracing each update upstream

Hiroki Kondo builds karasu, an architecture modelling language, without writing its code by hand: everything goes through Claude Code. Dependabot PRs are not merged as they arrive. Running a skill from hane, Kondo's own Claude Code plugin, makes the agent collect every open Dependabot PR and trace each one upstream: release notes, the code diff between tags, changes of publisher or repository owner, install-time scripts, lockfile dependency edges, known advisories and how recently the version was published. It writes the findings into a design doc with a merge, hold or reject recommendation per PR, and once Kondo decides, it merges and closes them and turns the doc into an ADR. Repo-specific rules, such as a 7-day cooldown, live in a rules file in karasu.

Kondo ran three triage rounds in the week of 10 to 17 October; 16 of the 88 PRs merged that week were Dependabot updates. A limit of 8 open Dependabot PRs delivered 24 cleared updates in three waves, each needing its own triage, so the limit went up to 25. In one replacement PR, rebuilding the lockfile moved knip to 6.41.0 instead of the reviewed 6.40.0; Kondo pinned it back and recorded the lesson in an ADR.

The skill investigates patch releases too, since a tampered patch is an easy supply-chain route, and it never auto-merges. A rebuilt lockfile can quietly pull a version newer than the one reviewed, so check resolved versions after any rebuild.