Dependabot can now update your AI agent's skills and prompts

Dependabot now supports Agent Package Manager (APM), GitHub said on 3 November. It opens pull requests to update git dependencies declared in a project’s apm.yml file and regenerates apm.lock.yaml when one is present.

APM is Microsoft’s open-source dependency manager for AI agents: an apm.yml manifest declares the skills, instructions, plugins and MCP servers a project needs, the same way package.json declares npm dependencies, so running apm install reproduces the same agent setup on any machine. To turn on the new support, add an apm entry to .github/dependabot.yml and pick an update schedule:

version: 2
updates:
  - package-ecosystem: "apm"
    directory: "/"
    schedule:
      interval: "weekly"

The feature covers version updates only, not security updates, and is generally available on github.com for every plan. It’s also coming to GitHub Enterprise Server 3.24.

Why it matters: agent configuration has been drifting the same way dependencies used to before Dependabot existed, except by hand, across whatever mix of Copilot, Claude Code or Cursor a team runs. If your project has adopted apm.yml, this gives skill and prompt dependencies the same automated PR workflow you already rely on for npm or pip.

The caveat: no security updates yet, so a vulnerable skill or MCP server pinned in apm.lock.yaml still needs someone to notice and bump it manually.