Announcing dep-steward: automate dependabot PR reviews with Claude
It's saved me almost 8 hours (and counting) while keeping Runsense fully up-to-date
It’s what you’re supposed to do: use Dependabot. Keep dependencies current, catch security patches early, standard hygiene. Unfortunately, it also created a stream of PRs for me to review, and as a solopreneur, time is my most limited resource.
Moreover, I wouldn’t always know when a new dependabot PR had been posted. Some would sit for days or weeks before I noticed or got around to them. This whole thing, which was supposed to be an easy way to maintain good housekeeping, was turning into an annoying chore. And if there’s anything I hate, it’s an annoying chore.
So I built dep-steward: a Claude agent reviews every Dependabot PR, and a separate, dumb, deterministic script does the actual merging. This separation of concerns is important. The review step reads the diff, pulls the changelog, checks my code for real usage, and can flag a PR for me to look at, but it can never merge anything itself. The merge step doesn’t take the model’s word for any of that. It re-checks on its own: is this really from Dependabot, is CI green, does the change only touch a dependency manifest, is the PR still open. Routine patch and minor bumps, grouped into one PR, clear that bar and merge with no model involved at all. A real major-version bump gets an actual review, and only merges if the model affirmatively says it’s safe and finds nothing in my code that touches the changed surface. Anything uncertain gets escalated to me. It never quietly merges anything risky.
It’s been running on the Runsense repo for 71 days. In that time it’s handled 32 Dependabot PRs on its own, 21 routine group updates and 11 real major or singleton bumps, with zero left sitting in my queue and zero security fixes missed. Using deliberately modest assumptions, about 5 minutes for a routine merge and 30 for a real major-version review, that’s roughly 7.3 hours saved. Plus, the peace of mind of knowing that Runsense is always up-to-date without my having to give it a second thought.
If you’re looking for an easy way to manage, review, and merge Dependabot PRs, give it a try: https://github.com/raphaelcm/dep-steward/. And let me know what you think!