Use cases
Dependency upgrades that finish
Dependabot and Renovate open the pull requests. The part nobody has time for (waiting for CI, chasing the one failing job, merging the eleven that are fine) is the part we run.
The bottleneck is not opening the PR
Automated bump PRs are easy to create and expensive to finish. developerz.ai recognises Dependabot and Renovate as bots and deliberately does not reply to them, no bot-on-bot threads. What it does instead is review each PR, push fixes when checks go red, and merge it through the merge gate once CI, review and your branch protections agree. A major version bump waits for you only when your maintainer.yml writes major_dep_bump under escalate.ask_before_acting. A bump your code cannot be adapted to is closed, with the reason; one whose failing checks stop going down comes to you.
No bot-on-bot noise
Dependabot and Renovate PRs are detected and never answered with another bot comment: they are treated as work, not as conversation.
Gates stay machines
A bump merges when CI is green, review passes and your branch protections allow it, not because something decided it looked safe.
The stuck ones surface
A PR that will not go green stops being invisible: a comment on it says which check is red and what happens next, and if it cannot get green it is escalated to you, or closed with the reason when your code cannot adapt to the new version.
Where it stops and asks you
Your policy decides which bumps wait for you
With no committed maintainer.yml, the platform does not review, watch or merge a bump: it stays yours, and so it does while pr.auto_merge is off (on OSS Free or verified OSS, until your file sets it to true) or pr.auto_merge_scope is own. Under own_and_dependency_bots or not_project a bump is still taken; not_project also merges and babysits pull requests by people without write access to the repo, never a project member's (write, maintain or admin). Otherwise a bump merges once CI, review and your branch protections pass, unless your file holds it for your approval: a path or target branch under pr.human_merge, or an escalate.ask_before_acting category. A bot's pull request is held only by a category your file writes, such as major_dep_bump, never by the default list. When CI stays red, a bump your code cannot be adapted to is closed with the reason, and one whose failing checks stop going down is escalated to you.
Read the recommended policyGo deeper
Set the rules in one file
Which paths auto-merge, which always wait for a human, which are ignored entirely. It is all one committed policy file.
Read the maintainer.yml reference
Ship more. Maintain less.
We expect software to be written faster than any team can review it. Bring your repos, your boxes and your keys. We bring the org that keeps up.