Dependencies settings

The Dependencies tab decides what Limn does with the pull requests that Dependabot, Renovate and other dependency bots open in the current workspace. Every switch is off until you turn it on, and nothing changes until you select Save. This page lists the settings; how the automation behaves day to day is in Dependency automation.

#What Limn can do

• Merge them automatically: in repositories you can push to, once their required checks pass. Drafts and pull requests with conflicts are left alone.
• Approve them automatically: once CI passes, under your GitHub account. Trusted bots only. Limn approves each new commit once and never retries a failed approval.
• Resolve their conflicts: Limn first asks the bot to rebase (a comment for Dependabot, the rebase checkbox for Renovate). Where the AI features are on, and the branch still conflicts 30 minutes later or the bot cannot be asked, AI resolves the conflicts and pushes a merge commit. It pushes only when Limn’s check of the merge passes. Trusted bots only.
• Fix them with AI (only where the AI features are on): when CI fails on a trusted bot’s pull request, AI fixes the branch and pushes the change, for example a companion package or lockfile that was not updated. When a pull request both conflicts and fails CI, one AI run merges first, then fixes CI on top.

CI must pass again after any AI push before Limn approves or merges.

#Which updates

One policy covers all four actions:

Which updates

• Patch updates only, Patch and minor updates, or All updates, major ones too. Limn reads the size from the version numbers in the pull request. When it cannot read them, only All updates lets the pull request through.
• Security fixes only: limit the actions to updates that fix a security problem.

Ecosystems

Choose All ecosystems, or Only these and tick the package ecosystems you allow. A pull request gets through only when every ecosystem it changes is ticked.

#Trusted bots

Approving, resolving conflicts and fixing with AI happen only for bots you trust. The list shows every dependency bot that has opened a pull request in this workspace. A bot marked Can’t be asked to rebase cannot be asked, so only the AI step can resolve its conflicts.

1. Open Settings, then the Dependencies tab.
2. Turn on the actions you want.
3. Choose the update sizes and ecosystems.
4. Under Trusted bots, tick each bot you trust.
5. Select Save.

#Limits and teammates

• Limn checks dependency pull requests every two minutes while it is running.
• AI work stops while you are over your AI spend budget. See AI subscription usage and spend.
• When a teammate also runs Limn, each action first puts a limn/deps status on the commit, such as “alex handling · fixing CI”. Limn skips a commit a teammate is already working on.