Code Quality
AI QA Agent for GitLab
Runs structured test plans against your application and reports defects with evidence, connected natively to GitLab so it reads and updates projects,…
Code Quality
AI Dependency Update Agent
Checks your dependencies for updates and proposes tested upgrades as pull requests, running quietly in the background.
Outdated dependencies pile up quietly until a security alert or a breaking change forces a painful catch-up. AI Dependency Update Agent checks your project's dependencies, tests each proposed upgrade, and opens only the safe ones as reviewable pull requests. Failed upgrades are flagged to the person you choose, it runs in the background, and nothing ships without a human's approval.
- Upgrades tested before they reach you as pull requests
- Failed upgrades flagged to the person you choose
- Runs quietly in the background, with no production changes
$1,900
20–30 working days
Optional maintenance $249/mo
What it is
AI Dependency Update Agent checks your project's dependencies against their latest versions, tests each proposed upgrade, and opens the safe ones as reviewable pull requests, running in the background with no customer-facing channel at all. Failed upgrades are flagged to the person you choose.
Why businesses buy it
Skipping dependency updates feels free until it is not: a known vulnerability, a library that no longer supports your stack, or a week lost to a big-bang upgrade. Doing it by hand is tedious and easy to postpone. This agent keeps upgrades small, tested and steady, so your codebase stays current with little effort and security fixes land sooner. It is a low-cost, low-risk automation for any development team. The Scope Card fixes the connected systems, workflow steps and test runs before you order, so the scope is clear.
Problems this solves
Dependencies fall far behind because updating them is tedious
The agent checks your dependencies against their latest versions in the background. Upgrades that pass testing are opened as reviewable pull requests, so updating becomes a quick review.
A careless upgrade can break the build
Each proposed upgrade is tested before a pull request appears. Upgrades that fail are not pushed through. Instead, they are flagged to the person you choose, with enough detail to decide what to do next.
Old packages can leave security fixes unapplied
Staying close to current versions makes it easier to pick up fixes when maintainers release them. The check keeps running in the background, so nobody has to remember it.
A good fit if
Your dependencies drift out of date because updating them safely takes time nobody has spare, not because anyone forgot.
You want upgrades tested before they reach you, not a bare notification that a new version exists.
You are fine with this running quietly in the background, with results reaching you as pull requests, not a chat interface.
You have up to 3 systems involved, such as your Git host, package registry and CI, that this should connect to.
Not the right fit if
You want pull requests reviewed for bugs and standards generally, not dependency versions specifically. See AI Code Review Agent.
You want new tests written for existing code, not dependency upgrades. See AI Test Generation.
You want broader CI/CD and infrastructure monitoring, with dependency updates as one part of it. See AI DevOps Agent.
You need existing test plans run and defects reported, not dependency versions tracked. See AI QA Agent.
How it works
- You give us scoped access to up to 3 systems: your Git host, your package registry and your CI, plus a written description of how you currently check for updates.
- The agent checks your dependencies against their latest available versions on a regular cadence, flagging which ones are behind and by how much.
- Each proposed upgrade runs through your existing test suite in CI before anything is offered to you, so a broken upgrade never reaches your inbox as a suggestion.
- Safe, tested upgrades open as ordinary pull requests, one AI decision or drafting step in a workflow of up to 12 steps end to end.
- Upgrades that fail testing, or carry a breaking change, are flagged separately with the reason, rather than silently skipped or silently merged.
- We test the workflow on 20 sample runs against your real dependency list before launch, and alerts go to whoever you named to receive them.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- A list of the systems involved, with admin or API access for each, such as your Git host, package registry and CI.
- A written description, or a short screen recording, of how you currently check for and apply dependency updates.
- 5 to 10 real sample inputs, such as a snapshot of your current dependency list, for testing.
- The name of who should receive alerts and errors from the workflow.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- Your business information (company basics, hours and brand voice), shared during intake.
- One decision-maker who can approve the update workflow before launch.
- An API key for your own AI model account (for example OpenAI or Google Gemini), created for this build with a spending limit.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Intake confirmed, with connected systems, your current process and sample data agreed.
Weeks 1–2
The update-checking and testing workflow built and connected to your systems.
Week 3
Pull-request creation and alerting connected and tested end to end.
Weeks 3–4
Trialled on 20 runs against your sample data, with results reviewed together.
Week 4
Your review and two rounds of changes.
Go-live
Live, with a recorded handoff session, and 30 days of support starts.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $1,900 |
| Express | 15–25 working days | $2,300 |
| Rush | 10–20 working days | $2,650 |
What you receive at handover
- A background dependency update workflow of up to 12 steps, including one AI step
- Connections to up to three systems, such as your Git host, CI and chat
- Prompt and guardrail configuration, including who receives failed-upgrade alerts
- Test report from 20 test runs on your sample data
- Admin guide and recorded 45-minute handoff session
- 30 days of post-launch support
Expected benefits and how to measure them
- Can keep dependencies current without a dedicated clean-up sprint.
- Helps your team spot risky upgrades before they reach the main branch.
- Outdated dependencies
- Run your package manager's outdated report before launch and again at the end of each month.
- Upgrade pull requests merged
- Count upgrade pull requests the agent opened versus those your team merged each month.
- Build breaks from upgrades
- Count failed builds caused by dependency changes in the months before and after launch.
Before you start: Save the current outdated-dependencies report for the project. Note when dependencies were last updated in bulk.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
You pay for the build once. Running the agent costs roughly $20 to $100 a month in your own accounts, covering the automation platform and AI model usage, and it moves with how many dependencies and how often checks run.
AI usage during the build and testing is billed to your own accounts too, so your automation platform and AI model relationships stay in your name.
Ask about running costsCustom requirements
If you need more than 3 connected systems, more than 12 workflow steps, or a second workflow, add a note at checkout for a written Change Quote. Your order still runs on its normal timeline. Larger or bespoke projects go through the Custom AI request form.
Request a custom versionKeep it running
Monthly maintenance covers monitoring, fixes, updates, a health report and change hours for things such as an added system or an adjusted cadence. It starts after the 30 days of support and can be cancelled any month.
$249/mo (the minimum fee, includes 2 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | A dependency-bot SaaS tool charges per repository every month | A contractor doing manual upgrade sweeps bills by the hour | Ours is one fixed price, shown before you buy |
| Testing before you see it | A dependency-bot tool often opens a pull request untested and lets CI catch failures | An agency's testing depends on what was scoped | Ours tests each upgrade first and only proposes the ones that pass |
| Breaking changes | A dependency-bot tool may bundle a breaking change in with the routine ones | An agency's flagging depends on who is doing the sweep | Ours flags a breaking or failing upgrade separately, with the reason |
| Delivery | A dependency-bot tool is instant to sign up but generic out of the box | An agency engagement usually takes several weeks to ramp up | Ours has a fixed delivery time shown before you buy, with faster options |
Questions about this product
How is AI Dependency Update Agent different from AI DevOps Agent?
AI DevOps Agent covers broader CI/CD and infrastructure operations, including diagnosing pipeline failures. Dependency Update Agent is narrower and runs quietly in the background, checking and proposing tested dependency upgrades as pull requests only. Start here if dependency drift is your specific problem, not pipeline or infrastructure issues generally.
Does AI Dependency Update Agent open pull requests for every available update?
No. Each proposed upgrade is tested against your existing test suite first, and only the ones that pass are opened as pull requests. Upgrades that fail testing or carry a breaking change are flagged separately with the reason, so your inbox is not a flood of untested suggestions.
Is there a chat interface or dashboard for AI Dependency Update Agent?
No, by design. This runs in the background with no customer-facing channel: results arrive as pull requests in your repository, and alerts go to whoever you name during intake. If you want a conversational interface instead, look at products in our Knowledge & RAG or Developer Tooling range.
How much does AI Dependency Update Agent cost to run each month?
Roughly $20 to $100 a month in your own accounts, covering the automation platform and AI model usage, and it moves with how many dependencies and how often checks run. The build itself is paid once and covers the checking, testing and pull-request workflow.
How often does AI Dependency Update Agent check for new versions?
On a regular cadence agreed during intake, checked against your dependency list and tested before anything reaches you. If you want the cadence changed later, such as from weekly to daily, that fits inside the monthly change hours that come with maintenance, or a small Change Quote.
How long until AI Dependency Update Agent is running?
Delivery runs on a fixed schedule from a complete intake, and the delivery panel shows that date plus express and rush options before you buy. Most of the time goes into connecting your systems, building the testing step into the workflow, and trialing it on 20 runs before launch.
Dependency upgrades that arrive already tested.
Order AI Dependency Update Agent and it goes live on a fixed delivery date, proposing tested upgrades as pull requests for your team to approve.
Works well with
Code Quality
AI QA Agent for GitHub
Runs structured test plans against your application and reports defects with evidence, connected natively to GitHub so it reads and updates repositories,…
Code Quality
AI Code Review Agent for GitLab
Reviews pull requests for bugs, security issues and standards and comments inline, connected natively to GitLab so it reads and updates projects,…