Support https://github.com/microsoft/apm - agent package manager

Is there an existing issue for this?

I have searched the existing issues

Feature description

I would love if dependabot might support https://github.com/microsoft/apm. apm is a package manager for AI/agent prompts, skills, agents etc. I could imagine using it to define org-wide standards and starting-points for those materials, and keeping up as that central org-wide standards repository got enhanced and extended.

At the moment it seems like apm does not support a lockfile; something I hope it starts to at some point to enable the traceability of prompts etc input to the agents. I don't know if it's something dependabot could therefore support yet, but perhaps? Maybe dependabot PRs might consist of patches to the delivered dependencies' files based on changes since the last PR; not sure. Also not ideal of course, as it makes reproducibility across the org hard as different repositories will merge changes on different schedules.

Anyhow - I wanted to see whether support for this (or some other equivalent tool!) might be on the radar?

@petemounce

@petemounce Do we know when APM will support the lockfile? Is there any timeline ?

Sorry, not a clue.

APM already does support lockfiles, you'll see it generate a apm.lock.yaml after you run apm install:

And if you want to install exactly as in your lockfile there's:

apm install --frozen

From the --help:

  --frozen                        Refuse to install when apm.lock.yaml is
                                  missing or out of sync with apm.yml,
                                  including MCP config state (CI-safe;
                                  mutually exclusive with --update, --mcp, and
                                  positional packages). Use 'apm audit' for
                                  on-disk integrity.

Not sure what's missing from the lockfile implementation from APM?

We're picking this up next quarter! 🥳

@danielmeppiel

would love to have this! @danielmeppiel

Add apm (Agent Package Manager) ecosystem support

Add apm (Agent Package Manager) ecosystem support (#16382)

APM support in Dependabot is now available in beta 🎉

Please give it a try it on your repositories and tell us how it goes.

Enabling it:

Add an apm entry to .github/dependabot.yml. Beta ecosystems need enable-beta-ecosystems: true:

version: 2
enable-beta-ecosystems: true

updates:
  - package-ecosystem: "apm"
    directory: "/"          # location of apm.yml
    schedule:
      interval: "weekly"

What's supported:

Dependabot reads apm.yml and opens pull requests for these dependencies:

• Tag pins (e.g. owner/repo#v1.2.0), including virtual packages (owner/repo/path/to/skill#v1.2.0) and package-scoped tags (review--v1.2.0). They're bumped to the latest release tag.
• Commit SHA pins (full 40-character SHAs). They move to the commit of the latest annotated release tag, with a # vX.Y.Z comment, matching apm update .
• Branch pins (e.g. owner/repo#main). The commit locked in apm.lock.yaml moves to the latest commit on the branch.
• apm.lock.yaml. When it's present, it's regenerated with apm lock alongside each update.
• Both dependencies and devDependencies, plus the standard options such as ignore, groups and cooldown.

Unpinned entries, abbreviated SHAs, local paths and MCP servers are left unchanged.

Please let us know if you face any issues/bugs. Looking forward for you feedback on this! Thanks!

@v-abhishekbhaskar

Great work on APM @v-abhishekbhaskar!

https://github.blog/changelog/2026-11-03-dependabot-version-updates-support-agent-package-manager/

👋 Hey everyone! Now that APM is GA, the enable-beta-ecosystems: true setting is no longer required in the dependabot.yml file. I'll be closing this issue with this. Please feel free to open new issues if you face any bugs in this. Thank you!

Navigation Menu

Repository navigation

Support https://github.com/microsoft/apm - agent package manager #14350

Is there an existing issue for this?

Feature description

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support https://github.com/microsoft/apm - agent package manager #14350

Description

Is there an existing issue for this?

Feature description

Activity

honeyankit commented on Aug 19, 2026

petemounce commented on Aug 19, 2026

Addono commented on Sep 3, 2026

carlincherry commented on Sep 4, 2026

OrenMe commented on Sep 8, 2026

v-abhishekbhaskar commented on Oct 22, 2026

honeyankit commented on Oct 23, 2026

Gary-H9 commented on Nov 3, 2026

v-abhishekbhaskar commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions