Dependency Update Automation Policy

Set rules for automated dependency pull requests.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

Create a policy for automated dependency updates. Ecosystems used: [ECOSYSTEMS]. Test coverage level: [COVERAGE]. Release frequency: [RELEASE_FREQUENCY]. Tolerance for risk: [RISK_TOLERANCE].

Define: update grouping rules (patch, minor, major), schedule and limits on open pull requests, automerge criteria that must all be true, security-update fast path with a time target by severity, pinning rules for production, and handling of abandoned packages. Present the policy as a one-page table and then supply configuration concepts for a typical update bot in generic syntax. Add a weekly 20-minute review routine and metrics: mean age of dependencies, open update PRs, time to patch critical. List three failure scenarios and the mitigation for each.

Add a decision tree for a failing update pull request: is it a test failure, a breaking change, or a flaky test, and what the owner should do within 24 hours for each. Provide the text of a short pull request template that records risk, test evidence and rollback, and a quarterly report format with three numbers for managers to read in under a minute.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Grouping: patch updates weekly, minor monthly, major reviewed individually.
Limit: 5 open update PRs.
Automerge when all are true: tests pass, patch version, no changelog warning, coverage unchanged.
Security fast path: critical within 24 hours, high within 7 days.
Pin production versions; use ranges only in libraries.
Abandoned packages: flag if no release in 24 months; plan a replacement.
Weekly 20-minute review: merge, skip, investigate.
Failure scenario: an automerged patch breaks a build; mitigation: staged rollout and a revert rule.

• CI