The ecosystem for managing AI agent dependencies just got a significant, albeit rough, upgrade. On November 3, 2026, Dependabot officially added support for APM (Agent Package Manager), Microsoft's tool for treating skills, prompts, and MCP servers as versioned packages. While the announcement frames this as generally available, early adopters like developer trknhr discovered that the integration still requires the enable-beta-ecosystems: true flag in the dependabot.yml configuration to function correctly.

The Drift Between Declaration and Installation

The core friction point in this new workflow is the disconnect between the dependency manifest and the actual installed files. When Dependabot triggers a pull request for an APM update, it correctly modifies apm.yml and apm.lock.yaml to reflect the new version tags and resolved commit hashes. However, it does not automatically run apm install. This leaves the consuming repository with an updated dependency declaration but stale skill files in the .claude/skills/ directory, creating a dangerous drift that can confuse developers and break agent behavior if not caught immediately.

Automating the Reinstall Loop

To solve this, trknhr implemented a two-step automation workflow that effectively turns Dependabot into a full lifecycle manager for AI skills. The initial Dependabot PR (commit 320a87b) handles the manifest updates, while a subsequent GitHub Actions workflow (commit 7c28153) detects the change, runs apm install, and commits the updated SKILL.md files back to the branch. This ensures that the PR review process includes both the metadata change and the actual code changes, allowing reviewers to audit the precise instructions being added to the agent's context.

Configuration Gotchas and Version Quirks

The setup process revealed several quirks that highlight the tool's immaturity. Without the beta ecosystem flag, the Dependabot job fails with a clear error message, but the documentation's claim of general availability is misleading. Additionally, the lockfile generation can introduce unexpected changes; in one test, the apm_version field in the lockfile actually decreased from 0.35.0 to 0.34.0 because Dependabot used a different CLI version than the local environment. This mismatch underscores the importance of pinning tool versions in CI pipelines when dealing with AI agent dependencies.

Key Takeaways

  • Dependabot supports APM, but you must manually enable it with enable-beta-ecosystems: true in your configuration.
  • Dependabot updates manifests (apm.yml, apm.lock.yaml) but does not reinstall skills, requiring a separate CI step.
  • Lockfile hashes and resolved commits are updated automatically, providing a clear audit trail for skill changes.
  • Current support is limited to version updates, not security patches, aligning with standard package manager behaviors.

The Bottom Line

This is a solid step toward treating AI skills like real software dependencies, but the 'beta' label is doing heavy lifting. Until Dependabot natively triggers the install step, teams need to build their own glue code to keep their agents' brains in sync with their manifests.