Dependabot Now Updates Your AI Agent's Skills Too — Here's How GitHub's APM Support Works (and Why You Still Have to Read the Diff)

This post was originally published on ConvertElementor.

I have a Dependabot habit I suspect most developers share: glance at the PR title, check the tests are green, merge. On November 3, 2026, GitHub gave me a reason to break that habit.

What actually shipped

Dependabot version updates now support Agent Package Manager (APM), and the support is generally available on github.com for all plans. APM is an open-source project from Microsoft, and it is the closest thing AI agents have to a package manager. Think of it as npm for agent context: you declare the skills, prompts, instructions, and plugins your agents need in an apm.yml file, and apm install deploys them to your harness — Copilot, Claude Code, Cursor — instead of copy-pasting the same instructions between tools. An apm.lock.yaml file then records the version, commit, and hash of every dependency, so you can see at a glance what your agents are actually using.

Setting it up is deliberately boring: you add an apm entry to .github/dependabot.yml, specify the directory and a schedule (weekly is sensible), and Dependabot opens a pull request whenever a newer version of a declared dependency appears. The PR edits apm.yml and regenerates apm.lock.yaml via apm lock when one is present — note that Dependabot will not create a lockfile; you generate it first.

What it covers, and what it does not

Version updates only, not security updates. Dependabot will keep your agent skills current; it will not yet flag them for vulnerabilities.

Coverage details worth knowing:

• dependencies.apm and devDependencies.apm entries in apm.yml are supported. Object-form entries and mcp: entries are not.
• Private git dependencies need git-registry access configured, or Dependabot will fail to fetch them.

Why this matters more than it looks

A skill change can change what your agent does with your code and your credentials, without changing your application code at all. That is the sentence I keep coming back to. The diff in the Dependabot PR is small — a version bump in apm.yml — but the behaviour change can be enormous, and it is invisible unless you read the upstream change yourself. You are not just reviewing a version number. You are reviewing a change to the instructions that shape everything your agent does.

The release is also a sign of the direction GitHub is heading. The same changelog window brought the Copilot BYOK usage API split — new used_local_byok and totals_by_local_byok fields that separate bring-your-own-key usage from Copilot-hosted usage. The two changes belong together: if agents are going to be part of your workflow, their skills need the same maintenance discipline as your dependencies, and their usage needs the same visibility as your spend.

What to do this week

1. If you use an AI agent, run apm lock once and commit the lockfile. That is the baseline that makes everything else work.
2. Add the apm ecosystem to Dependabot, with a weekly schedule.
3. Pin your skills to SemVer tags, not floating branches — otherwise you are updating every time the maintainer pushes.
4. Keep apm.yml small. When your agent setup is a dependency file, it should stay simple.
5. And the part I keep repeating: read the diff. A green test suite tells you the change compiles, not that it is safe.

The bottom line

Dependabot supporting APM is not a headline feature. It is the kind of infrastructure change that matters more the second time you think about it: the moment your agent's skills and prompts became dependencies, they needed a maintenance story. Now they have one — version updates, at least. The security updates can wait. The reading of the diff cannot.

---

Read the full article on ConvertElementor: Dependabot Now Updates Your AI Agent's Skills Too — Here's How GitHub's APM Support Works (and Why You Still Have to Read the Diff)