Dependabot version updates now support Agent Package Manager, opening pull requests for agent skills, prompts and instructions declared in apm.yml
Agent skills and instructions now get the same automated update PRs as code dependencies.
// Key points
- Dependabot opens pull requests to update supported git dependencies declared in apm.yml and regenerates apm.lock.yaml when it is present
- Covers version updates only, not security updates
- Set up by adding an apm entry to .github/dependabot.yml with the directory that contains apm.yml and an update schedule
- Generally available on github.com for all plans; coming to GitHub Enterprise Server 3.24
Builder's takeSkills and instructions now have a lockfile, so treat their updates like code: read the diff in each PR, because a changed instruction can change what an agent does with your repo's credentials. With no security updates in scope, I'd still restrict skill sources to publishers we trust, the same allowlist idea we already apply to editor extensions.
// Background · from #Coding agents
Full timeline →- Nov 4 GitHub Copilot comes to JetBrains Air over the Agent Client Protocol, with cloud tasks billed to the Copilot plan instead of JetBrains AI credits
- Nov 4 CWE-bench v2 opens 100 vulnerability-fixing tasks across 91 CWEs: Gemini 4 Argon leads at 67.8% pass@1, Claude Opus 5.5 at 67.3%, DeepSeek V4.1 Flash reaches 57.0% at $0.04 a rollout
- Nov 3 GitHub Actions will block pull_request_target by default in public repositories from December 2, with brownouts on November 9 and 16