Dependency automation

Dependabot, Renovate and other dependency bots open a steady stream of small pull requests. Dependency automation lets Limn handle them for you, by rules you set per workspace: merge them when their checks pass, approve them, ask the bot to rebase when they conflict, and, with AI on, fix them when CI fails. Everything is off until you switch it on.

#Switch it on

1. Open Settings → Dependencies. The settings apply to the workspace you have selected.
2. Switch on the actions you want: Merge them automatically, Approve them automatically, Resolve their conflicts and, while AI is on, Fix them with AI.
3. Under Which updates, choose Patch updates only, Patch and minor updates or All updates, major ones too. Tick Security fixes only to narrow it further.
4. Under Ecosystems, keep All ecosystems or choose Only these and tick them.
5. Under Trusted bots, tick the bots Limn may approve, resolve and fix for. Merging does not need a trusted bot; the other three do nothing until you trust one.
6. Press Save.

#What each action does

• Merge: Limn arms the pull request with Merge when ready and merges it once GitHub’s required checks pass, in repositories you can push to. Drafts and conflicting pull requests are left alone. Armed this way, a pull request says Armed automatically (dependency setting).
• Approve: once all CI is green, Limn approves under your GitHub account. It approves each new commit once and never retries a failed approval.
• Resolve conflicts: Limn first asks the bot to rebase: a comment for Dependabot, the rebase checkbox for Renovate. With AI on, if the branch still conflicts 30 minutes later, or the bot cannot be asked, AI resolves the conflicts and pushes a merge commit. It pushes only when Limn’s check of the merge passes.
• Fix with AI: when CI fails on a trusted bot’s pull request, for example because a companion package or lock file was not updated, AI fixes the branch and pushes the change. It runs once per commit and at most twice a day per pull request.

After any push, CI must pass again before Limn approves or merges. AI actions stop while you are over your AI spend limit (see AI usage and spend), and need a sandbox runtime on your computer (see Sandbox runtimes).

How Limn reads an update’s size

From the version numbers in the pull request. When Limn cannot read them, only All updates, major ones too lets it through. An ecosystem list lets a pull request through only when every ecosystem it changes is ticked.

#See what it did

On Pending → Dependencies, open What automation did for the last two weeks of actions, grouped by pull request. To act on everything at once, press Merge or arm all: each pull request that can merge is merged, and each that cannot yet is armed.

#Why it helps

Dependency bumps are many, small and mostly safe. Handing the safe ones to a rule, within limits you choose, frees your reviews for code people wrote, while major updates and untrusted bots still wait for a person.