Dependabot backlog

Use when a repo has accumulated many open Dependabot PRs and the user wants them consolidated.

1. Inventory and dedupe

1. gh pr list --author "app/dependabot" --state open --json number,title,createdAt. Titles encode "bump X from A to B [in /dir]".
2. Confirm suspected duplicates by touched files (gh api repos/OWNER/REPO/pulls/N/files --jq '.[].filename'), never by title alone. A true duplicate is the same package, the same file, and the same or an older target version. Watch for one grouped PR covering several directories that individual per-directory PRs also cover.
3. Close duplicates and superseded PRs with a comment naming the survivor (gh pr close N --comment "Duplicate of #M ..."). Dependabot won't recreate a closed PR for the same version.

2. Extract exact bumps

gh api repos/OWNER/REPO/pulls/N/files --jq '.[] | .filename, .patch' gives the exact before and after lines, including range prefixes (^) that titles omit. Apply them as literal string replacements per package.json.

3. Branch and apply

• Branch off the up-to-date base (git fetch origin <base> && git checkout -B user/deps-batch origin/<base>).
• Apply all bumps, then run ONE install for a coherent lockfile.
• Risk-triage: majors and formatter or linter bumps get individual attention. A formatter bump that reformats files can break more than formatting (for example an oxfmt reformat tripping TS2589). If it churns, consider dropping it from the batch into its own PR.