Dependencies

Dependencies holds every open dependency update in the workspace, and every security alert a security tool raised on a pull request. Security items come first, then the other updates. A pull request a dependency bot opened is listed only here, so it does not crowd the other tabs. Chips narrow the list to Security or Bumps.

#What you see

Security

• Security fix: the update's own notes say it fixes a known advisory. The card names the advisory, for example "Fixes GHSA-… and 2 more".
• Likely security fix: Limn infers a fix but the update does not state it in full.
• Security alert: a security tool (for example Socket, Dependency Review or Endor Labs) flagged an advisory on a pull request. A person's pull request with an alert keeps its other cards; the alert is an extra job.

Bumps

Every other pull request a dependency bot opened, as a Dependency update card.

Each card says who opened it (the bot's name, such as Dependabot or Renovate) and its state: Ready to merge, Behind trunk, Blocked, conflicts, a red build, or needs an approving review.

#What you can do

• Land one. A dependency update's card has the same merge buttons as Ready to land, where you can push to the repository. A conflict carries Resolve conflicts.
• Land many. Merge or arm all dependency updates… merges the ones that can land now and arms Merge when ready on the rest. It asks before it does anything.
• Let Limn do it. Settings can merge, approve, resolve threads on, or AI-fix dependency updates by themselves, for the bots you trust. All of it is off until you switch it on. What it did is listed on this tab. See Dependency automation and Settings → Dependencies.