Dependency update PR urgency
Triage automated dependency update pull requests (Dependabot, Renovate and similar) into security fix now, breaking major upgrade, routine safe update, dev-tooling only, or unclear, so teams merge the urgent ones first and batch the rest.
F@fLimits to keep in mind
This only prioritizes the PR. It does not merge, test or deploy anything.
Severity scores in advisories may not match your actual exposure; a human should confirm impact for security fixes.
Problem
Bots open a steady stream of dependency update PRs. Most are harmless patch bumps, but a few close real security holes and a few contain breaking major upgrades. Teams either ignore them all until the backlog is huge, or merge them all and break production.
Goal
Label each dependency PR so security fixes are merged quickly, breaking upgrades get an owner and a migration task, routine and dev-only bumps are batched, and PRs with missing information are sent back for details.
Input / state
The dependency update PR title, the version change, the scope of the dependency, and any changelog, advisory or CI notes.
- pr_title
- The pull request title, usually naming the package and versions.
- dependency_scope
- Where the package is used: production runtime, dev/test only, build tooling, or unknown.
- notes
- Release notes, changelog excerpt, security advisory text, and CI status from the PR.
Decision question
dependency_pr_urgencyHow urgent is this dependency update PR? Use security_fix_now when it fixes a CVE or security advisory in a production dependency. Use breaking_major for major bumps or documented breaking changes that need code or migration work. Use routine_safe for patch or minor bumps with no breaking changes, no advisory and passing CI. Use dev_tooling_only when the package is only for development, tests, lint or builds and nothing is breaking or security-relevant. Use unclear when release notes or CI results are missing or the impact cannot be judged.
Options
security_fix_nowThe update fixes a known vulnerability (CVE or advisory) in a dependency that ships to production or handles untrusted input.breaking_majorA major version bump or documented breaking change that needs code changes, migration steps, or careful testing.routine_safeA patch or minor update with no breaking changes and no security advisory, with passing CI.dev_tooling_onlyThe dependency is only used for development, tests, linting, or builds and does not ship to users.unclearThe PR lacks changelog or release notes, CI has not run, or the version jump and impact cannot be judged.needs_reviewConfidence is below your threshold: probability is spread across options.
Allowed outcomes
Decided in your code from the answer and its confidence. Thresholds are yours to set and test.
- Engineer reviews itConfidence is below your threshold: probability is spread across options.
- Merge security fix todayChoice is security_fix_now and confidence meets your threshold.
- Plan the migrationChoice is breaking_major and confidence meets your threshold.
- Batch and mergeChoice is routine_safe and confidence meets your threshold.
- Merge with tooling batchChoice is dev_tooling_only and confidence meets your threshold.
- Ask for release notesChoice is unclear and confidence meets your threshold.
Example scenarios
Predefined demonstrations. No model is called; the outcome shown is an illustrative judgment.
Example state
{
"notes": "Security: fixes open redirect vulnerability (CVE advisory GHSA high severity). CI passed.",
"pr_title": "Bump express from 4.19.1 to 4.19.2",
"dependency_scope": "production runtime"
}Outcome
IllustrativeChoice is security_fix_now and confidence meets your threshold.
Why
Patch fixes a security advisory in a production dependency.
Using it well
- A security advisory outranks the version size: a patch release that fixes a CVE in a production dependency is security_fix_now.
- Treat a 0.x minor bump (for example 0.8.0 to 0.9) as potentially breaking: prefer breaking_major if the notes mention removed or renamed APIs.
- A security advisory in a dev-only dependency that never runs in production is dev_tooling_only unless it affects the build or CI secrets.
- Failing CI on a routine bump means unclear, not routine_safe.
- Do not assume a CVE exists unless the PR or notes mention an advisory.
Request definition
POST https://api.typesafe.ai/v1/systemone{
"model": "jev-latest",
"state": {
"pr_title": "<pr_title>",
"dependency_scope": "<dependency_scope>",
"notes": "<notes>"
},
"questions": {
"dependency_pr_urgency": {
"type": "choice",
"instructions": "How urgent is this dependency update PR? Use security_fix_now when it fixes a CVE or security advisory in a production dependency. Use breaking_major for major bumps or documented breaking changes that need code or migration work. Use routine_safe for patch or minor bumps with no breaking changes, no advisory and passing CI. Use dev_tooling_only when the package is only for development, tests, lint or builds and nothing is breaking or security-relevant. Use unclear when release notes or CI results are missing or the impact cannot be judged.",
"criteria": {
"security_fix_now": "The update fixes a known vulnerability (CVE or advisory) in a dependency that ships to production or handles untrusted input.",
"breaking_major": "A major version bump or documented breaking change that needs code changes, migration steps, or careful testing.",
"routine_safe": "A patch or minor update with no breaking changes and no security advisory, with passing CI.",
"dev_tooling_only": "The dependency is only used for development, tests, linting, or builds and does not ship to users.",
"unclear": "The PR lacks changelog or release notes, CI has not run, or the version jump and impact cannot be judged.",
"needs_review": "Confidence is below your threshold: probability is spread across options."
}
}
}
}Request shape from the System One API reference; a Kev server accepts the same body. Replace the placeholder state with your data. Requests need your own API key or server.
Version History
Classifier updated
Initial version