bumpwarden: a dependency-triage agent that never merges
Every neglected repository has the same pile: seven Dependabot pull requests, each one a question nobody has time to answer. Which of these breaks the build? That question is the actual work. The pull requests are just its packaging. I built bumpwarden as my entry to Google's All Things Agentic hackathon, and this writeup is part of that entry. It is a background agent that does the triage…
Bumpwarden is a dependency-triage agent that never merges, developed as part of a Google All Things Agentic hackathon entry. Its purpose is to automate the process of triaging pull requests from neglected repositories, specifically handling the seven Dependabot pull requests that typically pile up alongside each neglected repository.
The agent operates on a twice-daily schedule, utilizing Cloud Scheduler and Cloud Run services to read the manifest and lockfile from GitHub, resolve candidate versions from the npm registry and deps.dev, and score every pending bump from 0 to 100 based on a fixed rubric comprising nine factors and their published weights.
The scoring system considers various checkable facts, such as semver distance, release age, advisories, deprecations, breaking markers in release notes, engine and peer ranges, and whether the repository's own code calls symbols that have changed. Gemini, a model (gemini-3.5-flash through an ADK agent), generates a brief report, detailing what has changed upstream, what breaks in the codebase down to file and line, how to migrate, and the confidence level in its assessment.
Every claim made by the model is traced against the provided material, and claims that cannot be verified are discarded. The model itself does not possess write tools, ensuring that it only acts based on the arithmetic decisions derived from the scored factors.
The design of bumpwarden was influenced by a single rule: there shall be no merge action anywhere in its policy. A clear bump results in a pull request that edits package.json and nothing else, while a caution bump generates an issue. A risky bump creates a hold issue with a migration plan. Subsequent runs update the same items in place instead of opening additional pull requests.
The agent does not perform any merge actions, leaving the decision to merge solely up to a human operator. The scoring, brief, and audit log are publicly accessible on the Bumpwarden dashboard (https://bumpwarden-729965149669.europe-west1.run.app), while the source code is hosted on GitHub (https://github.com/voyagi/bumpwarden).
A four-minute demonstration video showcases the agent's operation, with the actual run occurring as a continuous, uninterrupted process.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
