Repository navigation

feat(deps): agent-driven Dependabot PR verifier (phase 1) - #849

Draft

nieblara wants to merge 58 commits into

mainfrom

cursor/dependency-pr-verifier-9b50

Draft

feat(deps): agent-driven Dependabot PR verifier (phase 1)#849
nieblara wants to merge 58 commits into
mainfrom
cursor/dependency-pr-verifier-9b50

Commits on Oct 5, 2026
- feat(deps): add dependency PR verifier scripts
  
  cursoragent
  and
  nieblara
  committed
  e8fae1a
- feat(deps): add verify-dependency-pr agent skill and playbooks
  
  cursoragent
  and
  nieblara
  committed
  f922fd3
- docs: point agents at the dependency PR verifier and fix pre-commit notes
  
  cursoragent
  and
  nieblara
  committed
  ae97560
- fix(deps): harden verifier checks after trial runs
  
  cursoragent
  and
  nieblara
  committed
  9ec5f74
- docs(deps): use the proven go-sqlite3 check as the generated-check example
  
  cursoragent
  and
  nieblara
  committed
  9fc1059
- fix(deps): exercise the npm wrapper postinstall with the locked go-npm and a scratch prefix
  
  cursoragent
  and
  nieblara
  committed
  a381f05
- chore: keep verifier skill and scripts out of the npm package
  
  cursoragent
  and
  nieblara
  committed
  f7ca77e
- docs(deps): finish the generated-check example and note npm lockfile semantics
  
  cursoragent
  and
  nieblara
  committed
  baf9e39
- docs(deps): describe verifier invocation neutrally
  
  cursoragent
  and
  nieblara
  committed
  28e23dd
- Merge remote-tracking branch 'origin/main' into cursor/dependency-pr-verifier-9b50
  
  cursoragent
  and
  nieblara
  committed
  6e66f5c
- feat(deps): hold the verifier to a diligent-reviewer standard
  
  cursoragent
  and
  nieblara
  committed
  959c2e8
- test(deps): add replay fixtures for verifier regressions
  
  cursoragent
  and
  nieblara
  committed
  efc2163
- docs(deps): reframe the skill and playbooks around the diligent reviewer standard
  
  cursoragent
  and
  nieblara
  committed
  3ff8765
- fix(deps): ask one question when a check and the impact review cover the same change
  
  cursoragent
  and
  nieblara
  committed
  070e326
- feat(deps): fall back to the public goreleaser-cross image for release-snapshot
  
  cursoragent
  and
  nieblara
  committed
  ed222eb
- test(deps): replay #829 with all release targets built
  
  cursoragent
  and
  nieblara
  committed
  cbeede9
Commits on Oct 6, 2026
- fix(deps): fix verdict and check bugs from the 2026-10-06 run
  
  cursoragent
  and
  nieblara
  committed
  4de627d
- fix(deps): compare every old action ref and only declared outputs
  
  cursoragent
  and
  nieblara
  committed
  4ca50b9
- feat(deps): flag undisclosed direct updates and find more upstream notes
  
  cursoragent
  and
  nieblara
  committed
  610ed83
- test(deps): replay the corrected verdicts from the 2026-10-06 run
  
  cursoragent
  and
  nieblara
  committed
  6c33e60
- docs(deps): describe the findings subset rule, pr-disclosure, and note sources
  
  cursoragent
  and
  nieblara
  committed
  1b995f7
- fix(deps): tidy the pr-disclosure evidence and the ERESOLVE summary
  
  cursoragent
  and
  nieblara
  committed
  2dc16b2
- fix(deps): find the upstream tag of npm packages without gitHead
  
  cursoragent
  and
  nieblara
  committed
  044c661
- fix(deps): count only Dependabot's text as disclosure, and accept forced updates
  
  cursoragent
  and
  nieblara
  committed
  e8c1a89
- fix(deps): compare npm audit advisory IDs, not package names
  
  cursoragent
  and
  nieblara
  committed
  2f55b4c
- fix(deps): report the real coverage of upstream notes
  
  cursoragent
  and
  nieblara
  committed
  af0d73d
- fix(deps): fix action defaults, license questions, impact proof, and old image tags
  
  cursoragent
  and
  nieblara
  committed
  8632da7
- feat(deps): list the advisories that a Go update fixes at each level
  
  cursoragent
  and
  nieblara
  committed
  1dee8a7
- test(deps): lock in the fixes from the second 2026-10-06 run
  
  cursoragent
  and
  nieblara
  committed
  be0708b
- docs(deps): describe note coverage, forced updates, advisory IDs, and govulncheck levels
  
  cursoragent
  and
  nieblara
  committed
  02d5791
Commits on Oct 13, 2026
- fix(deps): make ci-status compare expected workflows with runs on the head
  
  cursoragent
  and
  nieblara
  committed
  2c6e22d
- fix(deps): run generated checks with a private HOME and scrub tokens
  
  cursoragent
  and
  nieblara
  committed
  0e3b3d0
- fix(deps): resolve floating action refs in actions-coverage
  
  cursoragent
  and
  nieblara
  committed
  9ba6b44
- fix(deps): ask about the effect of a changed setup-python default
  
  cursoragent
  and
  nieblara
  committed
  fcc3be0
- test(deps): make the runner token test fail when no check ran
  
  cursoragent
  and
  nieblara
  committed
  2b24b7a
Commits on Oct 20, 2026
- fix(deps): inspect the steps of composite actions in actions-coverage
  
  cursoragent
  and
  nieblara
  committed
  6dcdb3d
- fix(deps): report a UI tool crash as incomplete, not as a failure
  
  cursoragent
  and
  nieblara
  committed
  10243da
- fix(deps): rank incomplete above needs-human
  
  cursoragent
  and
  nieblara
  committed
  d8d6812
- fix(deps): ask for a rerun when CI fails in code that the PR does not change
  
  cursoragent
  and
  nieblara
  committed
  c9a0cc2
- fix(deps): give each incomplete item its own fix
  
  cursoragent
  and
  nieblara
  committed
  8f4e6e3
- feat(deps): add the mocks-regenerate baseline check for go.uber.org/mock
  
  cursoragent
  and
  nieblara
  committed
  c0d56ce
- fix(deps): ask separate questions for separate choices in actions-coverage
  
  cursoragent
  and
  nieblara
  committed
  277bfd3
- fix(deps): note the node24 effect and new inputs that default to on
  
  cursoragent
  and
  nieblara
  committed
  019322a
- fix(deps): resolve floating action refs and report note gaps in upstream-changes
  
  cursoragent
  and
  nieblara
  committed
  893a1b4
- fix(deps): give release tooling the high tier in the risk map
  
  cursoragent
  and
  nieblara
  committed
  78d7130
- fix(deps): add the generated check results to the evidence of each decision
  
  cursoragent
  and
  nieblara
  committed
  a66d036
- test(deps): match the generated check table row, not the decision evidence
  
  cursoragent
  and
  nieblara
  committed
  6582374
- fix(deps): keep the tier reasons of the impact review
  
  cursoragent
  and
  nieblara
  committed
  75f2c79
- fix(deps): show both sides of a generated check in the comment details
  
  cursoragent
  and
  nieblara
  committed
  18b29e7
- fix(deps): compare npm licenses at the same lockfile path
  
  cursoragent
  and
  nieblara
  committed
  c78630f
- fix(deps): mark a Go module outside the binary as test-only
  
  cursoragent
  and
  nieblara
  committed
  c2aa7f0
- fix(deps): label a 0.x minor update the same way in each section
  
  cursoragent
  and
  nieblara
  committed
  7233a94
- fix(deps): put the file output of release-snapshot in code
  
  cursoragent
  and
  nieblara
  committed
  2900740
- fix(deps): stop rendered comments from mentioning accounts or linking ldcli PRs
  
  cursoragent
  and
  nieblara
  committed
  7bdca51
- docs(deps): say that govulncheck runs in both profiles
  
  cursoragent
  and
  nieblara
  committed
  179e396
- fix(deps): do not read a missing base license as a license change
  
  cursoragent
  and
  nieblara
  committed
  7cbd788
- test(deps): replay #863, where a composite action hid a nested major update
  
  cursoragent
  and
  nieblara
  committed
  f1338ec
- test(deps): expect incomplete for #831 without an impact review
  
  cursoragent
  and
  nieblara
  committed
  27fd7d5

Commits

Commits on Oct 5, 2026

Commits on Oct 6, 2026

Commits on Oct 13, 2026

Commits on Oct 20, 2026