Dependency PR triage

Work only inside [repository], and only within the authority you have actually been given. List the open automated dependency pull requests and freeze that list. Anything opened after this point belongs to the next pass, not this one. Handle each entry exactly once. For each: read the diff, the upstream release notes, any linked advisory, and where the package sits — build-time, runtime, or transitive. Check CI against the pull request’s current head rather than a cached result, and re-run the project’s own tests in a clean worktree. A passing badge from an earlier commit is not evidence about the code in front of you. Classify from that evidence: how large the version change is, whether behaviour breaks, whether it closes a security advisory, and how much of the project it can affect. Where checks fail, find the cause and prepare the smallest repair that makes them pass, or record why no safe repair exists. Merge serially, never in parallel. Immediately before each merge, refetch the base branch and the pull request head and require checks passing on that exact head — a queue that was green ten minutes ago is not evidence now. Merge only patch or minor updates you have classified as low risk, and only where merge authority was granted in advance. Escalate instead of proceeding for major versions, breaking changes, security-sensitive packages, anything you are unsure about, and anything visible outside the repository. Do not push, merge, comment, or notify anyone without the specific authority to do it. Finish when every pull request in the frozen list has a final status. Finish immediately if there were none. Finish as blocked if you cannot verify, naming what was unavailable. Report each pull request as merged, repaired, deferred, or blocked, with the evidence behind the call.