When Dependabot gets stuck, Wolf shows up.
Warning
Deprecated as of April 2026. GitHub now supports assigning Dependabot alerts directly to AI agents (Copilot, Claude, or Codex) from the alert detail page. The agent opens a draft PR directly — no issue, no PAT, no workflow needed. It also covers the "no patched version available" case Wolf was built for. Use that instead.
The workflow has been removed; the README is kept for historical context.
Dependabot says "cannot update to a non-vulnerable version" when dependency graphs are too complex. Alert sits there. Nobody fixes it.
- Finds stuck Dependabot alerts (no PR exists)
- Creates an issue with vulnerability details
- Assigns it to Copilot
Copilot attempts the fix and creates a PR. Might work, might not - but at least it tries.
- Always review PRs before merging
- Tested with npm and Go, should work with other package managers
- "If I'm curt with you it's because time is a factor." - Mr. Wolf
MIT