dependabot-reviewlisted

# Dependabot Dependency Upgrade Review Review Dependabot PRs and give the developer a concise, scannable verdict: what changed upstream, what could break (and how to fix it), what each package touches in the codebase, and whether to merge. This works across ecosystems: npm, RubyGems, PyPI, Go modules, Cargo, and so on. ## Choosing a mode - **Single-PR mode**: the user gave a specific Dependabot PR URL or number. Run the single-PR workflow below. - **Audit mode**: no PR was given, or the user asked about all open Dependabot PRs. Run the audit workflow. Do **not** ask the user to paste URLs; discover them with `gh`. ## Audit workflow (multiple PRs) ### Step A1: Discover open Dependabot PRs Determine the repo from the current working directory (`gh repo view --json nameWithOwner -q .nameWithOwner`). Then list open Dependabot PRs: ```bash gh pr list --author "app/dependabot" --state open \ --json number,title,url,createdAt,headRefName,labels \ --limit 50 ``` The `app/` prefix in the author filter is required: Dependabot authors as the bot account `app/dependabot`. If `gh` returns an empty list, tell the user "No open Dependabot PRs in <repo>." and stop. Before analysis, state the scope in one line: "Found N open Dependabot PRs. Analyzing each now." ### Step A2: Analyze each PR For every PR returned, dispatch one subagent that runs the **single-PR workflow** (Steps 1-4 below) and returns the condensed per-PR section (15-25 lines). Dispatch all of them in one message