Dependency Management

Purpose

Automate dependency updates, vulnerability scanning, and policy enforcement with Dependabot and Renovate.

Agent Protocol

Trigger

Exact user phrases: "Dependabot", "Renovate", "dependencies", "lock file", "vulnerability scanning", "update strategy", "dependabot.yml", "dependency bump", "automated updates", "version pinning", "patch management", "supply chain security", "SBOM", "npm audit".

Input Context

• Package ecosystem (npm, pip, maven, go, cargo, nuget, docker, terraform).
• Package manager (npm, yarn, pnpm, pip, poetry, maven, gradle, go, cargo).
• Automation tool (Dependabot, Renovate, or both).
• Update cadence (daily, weekly, monthly).
• Vulnerability severity threshold (critical only, high+, all).

Output Artifact

Writes to .github/dependabot.yml, renovate.json, or .github/renovate.json.