Dependency bump: a change that only updates the version of a dependency.

01Definition

A version number, and nothing else.

A dependency bump is a change that updates the version of a package a project depends on, usually in a manifest and its lockfile. Tools such as Dependabot and Renovate open thousands of them, and coding agents open more.

Because they are routine, bumps are often merged with a glance. That habit is exactly what makes a mislabelled bump risky.

• Manifest and lockfile only
• Routine and frequent
• Often merged with a glance

02Why check the claim

“Just a bump” should be provable.

A pull request titled as a dependency bump that also edits source files is no longer a bump, whatever its description says. Sometimes that is a legitimate fix bundled in; sometimes it is a mistake; occasionally it is an attempt to hide a change behind a routine label. In every case a reviewer should know.

The check is mechanical: compare the files the change touches with the files a bump is allowed to touch.

• Descriptions are claims
• Extra edits deserve attention
• The check is mechanical

03In Verify

Built: the change-class check.

Verify checks whether a change that claims to be a dependency bump only touches dependency files. If the diff also edits code, the verdict is needs review and the comment names the files. A pure dependency-version bump whose tests pass can be accepted.

Built; Verify is not installable yet.