fix-dependabot

package.json

bun install

bun.lock

Steps

1. Get PR info — Use

   gh pr view <number> --json headRefName,files,title,body

   to identify the branch name, which dependency was bumped, and the old/new versions.
2. Checkout the branch:

git fetch origin <branch>
git checkout <branch>

1. Update all monorepo instances — Dependabot only touches one package. Search for all other

   package.json

   files that reference the same dependency at the old version and update them too:

rg '"<dependency>": "[~^]?<old-version>"' --glob '**/package.json'

^

~

1. Run

   bun install

   from the repo root to regenerate

   bun.lock

   .
2. Verify — Run

   git status

   to confirm only

   bun.lock

   and the expected

   package.json

   files were modified. If other unexpected files changed, investigate before proceeding.
3. Commit and push:

git add -u
git commit -m "Update <dependency> to <version> across all monorepo packages"
git push

1. Switch back — Return to your previous branch (usually

   main

   ):

git checkout main

Notes

• Dependabot says "Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself" — but updating the lockfile and sibling packages is the expected workflow and won't cause issues.
• If the version bump is a major version (e.g. vite 5 → 6), consider whether the upgrade is appropriate or if it should be ignored. Check for breaking changes.
• If

  bun install

  fails, the dependency version may have conflicts with other packages. In that case, close the PR and comment explaining why.