dependabotlisted

# Handle open Dependabot PRs Dependabot opens weekly PRs for npm deps and GitHub Actions (see `.github/dependabot.yml`, limit 5 npm at a time). Each already runs the CI + Lint workflows. Your job: get every safe one merged, and for the rest, leave a paper trail so a human knows exactly what's blocking it. **Merging is outward-facing and hard to reverse.** Only merge PRs that pass review. Report every action taken (merged / commented / skipped) at the end. **This skill owns the `blocked` label.** A PR held open *on purpose* (a major bump with breaking changes we use, one that would violate a settled architecture call in `CLAUDE.md` — a frontend framework, a third persistence backend, weakened tenant isolation, etc.) gets the `blocked` label plus an explanatory comment. That label is how `pick-issue` knows to leave the PR out of its candidate pool — so a held PR stays open and visible without being repeatedly re-triaged as "pickable work". **This sweep is the only place a `blocked` PR is re-evaluated**, so it must look at already-`blocked` PRs too, not just fresh ones: re-check each, and clear the label + merge once its blocker is gone. ## 1. Find the open Dependabot PRs ```bash gh pr list --author "app/dependabot" --state open \ --json number,title,labels,mergeable,mergeStateStatus,url ``` If none, say so and stop. Otherwise process each PR independently, oldest first (older PRs may be superseded by newer ones for the same package — note that). ## 2. Review each PR R