Define the smallest reviewable change

Ask the agent to state the package, old and new resolved version, reason for the update, changed manifest and lock files, and commands it expects to pass. Split unrelated cleanup, generated-file churn, and application changes out of the update. A reviewer cannot make a useful decision when a security fix is mixed with an unbounded refactor.

GitHub's dependency-review guidance explains that a dependency diff can show added, removed, and updated packages and advisory data. That evidence is useful, not complete: also inspect source changes that the dependency view does not represent.

Reproduce the lockfile contract

For npm projects, run the declared clean-install command before claiming the update is reproducible. npm ci uses the checked-in lockfile, fails when it conflicts with package.json, and does not rewrite either file. Record the command, package-manager version, and result in the review receipt.

Do not repair a mismatch by quietly regenerating the lockfile during review. Either explain and review the new resolution or return the proposal to the agent. A lockfile records a resolution; it does not demonstrate that the application still works with it.

Run declared checks and review failures

Run focused tests first, then the repository checks that would detect affected build, lint, integration, or security-policy failures. Preserve a failure instead of retrying until green without explanation. Review the dependency delta alongside release notes, breaking-change notices, and applicable advisories. A scan can identify a known issue; it cannot prove an update has no compatibility impact.

Bind the human decision to one commit

The final receipt should include the exact commit, manifest/lockfile pair, install result, test command and result, dependency-delta review, unresolved risk, and named maintainer decision. A new commit invalidates the decision until the reviewer confirms it still covers the change.

The local evidence artifact evidence/P78/dependency-gate.mjs rejects drift, missing or failed recorded install and test commands, an unreviewed delta, and a review attached to a different commit:

npm test --prefix sites/odexing.com/evidence/P78

It is a receipt validator, not a package manager, advisory scanner, or merge authority.

Merge checklist

  • The update has one stated purpose and a narrow diff.
  • The manifest and lockfile are intentional and reproduce together.
  • The clean install and affected checks have recorded results.
  • The dependency delta and relevant release or advisory information were reviewed.
  • A maintainer accepts remaining risk for the exact commit.
  • A rollback or revert path is known before merge.

Frequently asked questions

Does a passing lockfile install prove the dependency is safe?

No. It proves only that the lockfile and manifest can be installed under the recorded conditions. Compatibility, behavior, licensing, and security still need appropriate review.

Can the coding agent approve its own update?

No. It can prepare the receipt and explain the diff, but a human maintainer must own the risk decision and the merge.