Fix Dependabot

If you run a monorepo with Bun, you know Dependabot only updates one package.json and leaves your lockfile stale. This skill automates the tedious fix: it checks out the Dependabot branch, uses ripgrep to find every instance of the old dependency version across your monorepo, updates them all while preserving your version prefix style, regenerates bun.lock, and pushes everything back. It's basically the manual checklist you'd follow anyway, but scripted. The notes warn you about major version bumps and what to do if bun install fails, which is refreshingly practical.

skills.sh installs: 1.1K
GitHub stars: 72.1K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add remotion-dev/remotion --skill fix-dependabot --agent claude-code

Installs into .claude/skills of the current project.

Files

Dependabot PRs only update one package.json and never run bun install, so the bun.lock file is out of date and other packages in the monorepo still reference the old version. This skill fixes both problems.

Steps

Get PR info — Use gh pr view <number> --json headRefName,files,title,body to identify the branch name, which dependency was bumped, and the old/new versions.
Checkout the branch:

git fetch origin <branch>
git checkout <branch>

Update all monorepo instances — Dependabot only touches one package. Search for all other package.json files that reference the same dependency at the old version and update them too:

rg '"<dependency>": "[~^]?<old-version>"' --glob '**/package.json'

Update every match to the new version. Preserve the prefix style (^, ~, or exact) that each package already uses.

Run bun install from the repo root to regenerate bun.lock.
Verify — Run git status to confirm only bun.lock and the expected package.json files were modified. If other unexpected files changed, investigate before proceeding.
Commit and push: