GitHub announced on 3 November 2026 that Dependabot version updates now support Agent Package Manager (APM). GitHub describes the feature as a way to keep AI agent skills, prompts and instructions current.

What the changelog says

• Dependabot opens pull requests to update supported git dependencies declared in an apm.yml file, and regenerates apm.lock.yaml when it is present.
• You switch it on by adding an apm entry to .github/dependabot.yml, naming the directory and an update schedule.
• It covers version updates, not security updates.
• It is generally available on github.com for all plans, and is coming to GitHub Enterprise Server 3.24.

The interpretation

Until recently, the instructions and skills you gave an AI coding agent were files someone wrote once and forgot. Treating them as versioned dependencies is a quiet but important shift: they now have owners, versions and update pull requests, just like libraries do.

That matters because those files steer what the AI builds in your product. A stale or silently changed skill file can change code quality without anyone touching the application. The flip side is that automatic update pull requests are only as safe as the person who reviews them. The changelog is explicit that no security-update coverage comes with this.

So what

If your supplier uses AI agents on your codebase, ask where their agent instructions live, whether they are versioned, and who approves changes to them. It is a cheap question and it separates disciplined AI-assisted development from improvisation. BuildApps keeps AI workflows documented and reviewed. See AI-assisted development, custom software development, or start a project.

← All research