Skip to content
NewsProduct launch

GitHub's Dependabot adds version updates for Microsoft's Agent Package Manager

· by

The short version

Dependabot now opens pull requests to update the skills, prompts, and instructions AI agents depend on, treating agent context as a dependency for the first time.

GitHub's Dependabot adds version updates for Microsoft's Agent Package Manager

A team that copies a skill file or a review prompt from another repository has, until now, had no way to know when the source changes. As of November 3, 2026, GitHub's Dependabot treats that file the same way it treats an outdated npm package: it opens a pull request to bump it, per GitHub's changelog.

What happened

GitHub's November 4 changelog entry confirms Dependabot now supports version updates for Agent Package Manager (APM), Microsoft's dependency manager for AI agent primitives. APM lets a project declare the skills, prompts, instructions, plugins, and MCP servers it needs in a single apm.yml file, then run apm install to deploy each one to whichever AI coding tool a developer is using, per Microsoft's APM documentation. Dependabot now opens pull requests to update the git dependencies listed under apm.yml, and regenerates the apm.lock.yaml lockfile when one is present. GitHub's support covers version updates only, not security updates. Setup takes one new entry, apm, added to a repository's existing .github/dependabot.yml file, pointing at the directory that holds apm.yml and naming an update schedule. The feature is generally available today on github.com for every GitHub plan and is coming to GitHub Enterprise Server 3.24.

How an update behaves depends on how the dependency was pinned in the first place, per GitHub's documentation on supported ecosystems. A dependency pinned to a SemVer tag, such as octo-org/octo-skills#v1.0.0, gets bumped to the latest tag. One pinned to a commit SHA gets updated to the commit behind the newest non-prerelease tag, with the tag name added as a comment. One pinned to a branch name only updates the lockfile, since the manifest itself still points at the branch, and that path requires an apm.lock.yaml to already exist. Dependabot will not touch entries written as git: or registry: maps, entries with no ref at all, local path references, anything hosted on Azure DevOps, or mcp: server entries, which stay outside version-update scope for now.

What a prompt drifting out of date actually costs a team

Code dependencies have had automated update tooling for years because an outdated library is a known, named risk: a missed security patch, a breaking API change, a deprecated function. Agent skills, prompts, and instructions had none of that tooling until this week, despite increasingly functioning the same way: a SKILL.md file copied into a dozen repos, each one silently falling behind the original as the author iterates on it elsewhere. APM's own documentation describes itself as "a dependency manager for AI agents, like npm for agent context," per Microsoft, and its install step already pins exact versions and content hashes so a fresh clone resolves identically everywhere. Dependabot's new integration is the piece that closes the loop: instead of a developer manually re-running apm install and hoping they remember to check for upstream changes, a pull request shows up on a schedule, the same way it already does for a stale npm package.

That matters most for teams using APM's cross-harness design. The targets matrix Microsoft publishes lists GitHub Copilot, Claude Code, Cursor, OpenCode, Codex, Gemini, Windsurf, and Kiro as supported harnesses, meaning one apm.yml can deploy the same skill or instruction set across every one of those tools. A team standardizing a security-review prompt or a company style guide across that many surfaces now has a reason to actually keep it current instead of letting six different forked copies drift apart, because Dependabot will flag the drift automatically rather than requiring someone to notice.

Context

APM sits on top of a layer of agent-context standards that matured fast this year. Anthropic published Agent Skills, the SKILL.md format APM can install, as an open standard in December 2025, and on October 22, 2026 donated it to the Agentic AI Foundation under the Linux Foundation, the same nonprofit that already holds the Model Context Protocol. By that point more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot, and VS Code, had integrated the standard, and developers had published 1 million skills with nearly 280 million installs, per Anthropic's announcement. APM is built directly on that foundation alongside AGENTS.md and MCP, per Microsoft, rather than inventing its own packaging format, which is part of why a GitHub-native tool like Dependabot could add support for it without GitHub needing to build anything skill-format-specific of its own.

What to watch next

The near-term question is whether security updates follow version updates onto the same apm.yml/apm.lock.yaml plumbing, since Dependabot's alert and security-update machinery for code dependencies is a separate system from version updates and GitHub's changelog entry does not mention a timeline for extending it to APM. Also worth tracking: whether other agent-skill ecosystems built on the same AGENTS.md and Agent Skills standards adopt apm.yml as a shared manifest, or whether dependency tooling for agent context stays split by vendor the way build tooling once was before npm consolidated the JavaScript ecosystem.

Sources