dep-sweeplisted

# Dep Sweep Turn a wall of bot PRs into one decision pass. Auto-merges the safe class into the resolved base branch (`main` by default; a repo that's explicitly opted into the release-train exception uses its configured `release_branch` instead — see Resolve target below) and surfaces only the genuinely risky updates for human review. Reduces the daily/weekly drag of "20 dependabot PRs are open and I keep ignoring them". ## Auto-invocation triggers - User says "deal with dependabot", "clean up renovate", "update deps", "merge the bot PRs" - ≥10 open PRs authored by `dependabot[bot]`, `renovate[bot]`, or `pre-commit-ci[bot]` - Weekly cadence if the repo has automated dep updates configured ## Risk classification (always first) For each open bot PR, classify into one of: Evaluate HOLD conditions first, then REVIEW, then AUTO-MERGE — a patch bump with passing CI that's *also* a security advisory is HOLD, not AUTO-MERGE. Security advisories never qualify for AUTO-MERGE regardless of bump size or CI status; the "safe" heuristics below only apply once HOLD is ruled out. | Bucket | Heuristic | Default action | |---|---|---| | **HOLD (risky)** | Security advisories, OR major bumps, OR bumps that fail CI, OR dependencies listed in `always_hold` in `.claude/dep-sweep-config.json` | Comment on PR with reason; leave open | | **REVIEW (medium)** | Minor bumps of runtime deps, OR any bump that touches a known-sensitive package list (see project config) | Surface to user with diff