---
title: "Update dependencies in small automatic · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/version-control-and-review/automated-dependency-updates
updated: 2026-10-20
licence: "All rights reserved"
---

# Update dependencies in small automatic steps

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review)
- Rule: Let a bot open a pull request for each dependency update, and merge it when the checks pass.
- How: Use a tool such as Renovate or Dependabot. Group small updates, and give major versions their own pull request. Wait at least 7 days before taking a new release, as the [release cooldown rule](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/release-cooldown) explains. Security holes in dependencies are covered in the [security testing playbook](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies).
- Check: No bot pull request stays open longer than 14 days. No dependency is more than one major version behind without a written reason.

Example:

```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule: { interval: weekly }
    cooldown: { default-days: 7 }
    groups:
      minor-and-patch:
        update-types: [minor, patch]
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers engineering playbook: https://agentwranglers.se/playbook/engineering/version-control-and-review/automated-dependency-updates`.

- Previous: [Fix a broken main branch first](https://agentwranglers.se/playbook/engineering/version-control-and-review/keep-main-green)
- [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review)