Dependabot now updates APM agent skills in apm.yml: setup, pin types and limits

GitHub said on 3 November 2026 that Dependabot version updates now support Agent Package Manager (APM), the open-source tool that lets a repository declare the skills, prompts and instructions its AI coding agents use. Dependabot will open pull requests to bump those dependencies, so agent configuration can be reviewed and updated like any other code dependency instead of being copied once and forgotten.

Key points

• Dependabot version updates for APM are generally available on github.com for all GitHub plans, and are listed for GitHub Enterprise Server 3.24 (GitHub changelog, 3 November 2026).
• Dependabot updates git dependencies declared in apm.yml, under both dependencies.apm and devDependencies.apm, and regenerates apm.lock.yaml when that file exists.
• This covers version updates only. GitHub's ecosystem table lists security updates for APM as not supported.
• Dependabot never creates a lockfile: branch-pinned dependencies are only updated when an apm.lock.yaml is already present.
• Object-form entries, mcp: entries, local paths, entries without a ref, Azure DevOps hosts and abbreviated commit SHAs are skipped.

What to do

If your repository has an apm.yml, add an apm entry to .github/dependabot.yml, point it at the directory that holds the manifest, and choose a schedule, as the changelog describes:

version: 2
updates:
  - package-ecosystem: "apm"
    directory: "/"
    schedule:
      interval: "weekly"

Then check three things before you rely on it. First, commit an apm.lock.yaml if you want Dependabot to track branch-pinned packages, because it will not create one. Second, look at how each dependency is pinned (see the table below), since the pin type decides what a pull request changes. Third, review the pull requests as you would for code: an agent skill or instruction file can change what your coding agent does on a developer's machine, so a version bump is a change in behaviour, not only a change in text. Private git repositories can be reached by declaring a git registry in dependabot.yml; GitHub's docs say private registry support for APM uses git registries.

What happened

GitHub's changelog entry, "Dependabot version updates support Agent Package Manager", says Dependabot "opens pull requests to update supported git dependencies declared in apm.yml" and regenerates apm.lock.yaml when it is present. It states plainly that the support covers version updates, not security updates. The feature is generally available on github.com for every plan and is expected on GitHub Enterprise Server 3.24.

GitHub's reference page on supported ecosystems gives the detail. For APM the ecosystem value is apm, there is no "supported versions" column to check, version updates are supported, security updates are not, private repositories are supported, and private registries are supported for git only. Dependabot reads both the dependencies.apm and the devDependencies.apm sections of the manifest.

Background

APM is a project in Microsoft's GitHub organisation, microsoft/apm. Its README describes it as an open-source dependency manager for AI agent configuration, working like package.json or requirements.txt but for agent context: instructions, skills, prompts, agents, hooks, plugins and MCP servers. The README credits Daniel Meppiel as creator and lists him and Sergio Sisternes-EPAM as maintainers. The project is released under the MIT licence. When we looked on 4 November 2026 the repository page showed about 4.2 thousand stars and 414 forks.

The idea is the same as for any package manager. A project keeps an apm.yml manifest with a name, a version, the agent targets it supports (the README example uses copilot) and a list of dependencies, such as a package pinned with a tag, for example microsoft/apm-sample-package#v1.0.0. Running apm install pulls them in, and a lockfile, apm.lock.yaml, records the resolved dependency tree, with sources and content hashes for provenance, much as package-lock.json does for npm. Other commands listed on the README include apm compile, apm audit (with an --ci mode), apm pack, apm lock export to CycloneDX or SPDX formats, and apm marketplace add. The README lists GitHub Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf and Kiro as supported agents. A developer write-up from April 2026, published by azukiazusa, described the same install-and-lock workflow and the compile step that produces files such as AGENTS.md and CLAUDE.md.

Before this change, keeping those dependencies current was a manual job. A skill pinned to a tag stayed there until someone remembered to look. That is the problem Dependabot already solves for npm, pip, Cargo and the other ecosystems on the same page of GitHub's documentation.

How it works

GitHub's docs say how Dependabot updates an entry "depends on how the dependency is pinned". There are three supported pin types.

Pin type	Example	What Dependabot does
SemVer tag	octo-org/octo-skills#v1.0.0	Moves to the latest SemVer tag. Plain tags (v1.4.0) and package-scoped tags are both supported.
Commit SHA	octo-org/octo-skills#<40-character SHA>	Moves to the commit of the latest annotated, non-prerelease release tag, and adds the tag name as a comment such as # v1.4.0.
Branch	octo-org/octo-skills#main	Moves to the latest commit on the branch. Only apm.lock.yaml changes, because the manifest still names the branch. Needs an existing lockfile.

A package-scoped tag must start with the package name, which is the repository name or the last path component of a virtual package. GitHub's example is octo-org/octo-skills/skills/review#review-v1.4.0. That lets one repository hold several skills that each carry their own version tags.

When a repository has an apm.lock.yaml, Dependabot regenerates it by running apm lock. If there is none, it does not make one.

GitHub also lists what Dependabot leaves alone: object-form entries (maps using git:, registry:, id: or path:) and mcp: entries; entries with no ref, such as octo-org/octo-skills; local path entries like ./my-package; entries hosted on Azure DevOps; entries that use an http:// or git:// clone URL; entries written as YAML block scalars or quoted strings with escape sequences; abbreviated commit SHAs; and shorthand entries when the manifest sets registries.default. Entries that use an explicit clone URL are still updated in that last case.

What it means

For teams that use coding agents, the practical gain is routine. Agent skills and instruction files now sit in the same review flow as libraries: a pull request, a diff, CI, and a human approval. That matters because these files steer tools that can edit code and run commands. We looked at the risk side in our guide to auditing the plugins, hooks and MCP servers your AI coding agent loads, and at a case where an app installed agent plugins on its own. An update bot makes drift visible, but it also makes it easy to merge a change without reading it.

The limits are worth knowing. MCP server entries are not updated, so servers declared in mcp: stay where they are. Security updates are not supported, so Dependabot will not alert on a known-bad skill the way it does for a vulnerable npm package. The SHA-pin behaviour is the safer pattern for supply-chain-minded teams, since a commit pin cannot be silently moved, and Dependabot will only advance it to a release tag.

For the APM project, the support is a sign of GitHub treating agent configuration as a first-class dependency type, listed next to Docker, Terraform and GitHub Actions in the same table.

What we don't know yet

• GitHub does not say how many repositories already use apm.yml, so we cannot say how many will be affected.
• The changelog gives no date for GitHub Enterprise Server 3.24 beyond saying APM support "will be available" there.
• We have not tested Dependabot against a live APM repository, so the behaviour above is as documented by GitHub, not as measured by us.
• It is not stated whether security updates for APM are planned. The ecosystem table lists them as not supported today.
• The README page we read showed no tagged release of APM itself, so we cannot state its current version.

What to watch next

Whether GitHub adds security updates or advisories for agent packages, which would be the missing half of this feature. Whether Dependabot learns to handle mcp: and object-form entries. Whether other agent package formats get the same treatment. And whether teams begin to pin agent dependencies by commit SHA with Dependabot managing the tags, as they do with GitHub Actions.

Sources

• GitHub changelog: Dependabot version updates support Agent Package Manager (primary, 3 November 2026)
• GitHub Docs: supported ecosystems and repositories, APM section
• microsoft/apm on GitHub (README)
• azukiazusa: apm package manager (April 2026)