Dependabot Now Bumps APM Agent Manifests, Version Updates Only, While APM's Scanner Misses Plain-Text Prompt Injection

GitHub added the apm ecosystem to Dependabot version updates on November 3, 2026, so a repository can get pull requests that bump the git dependencies listed in its apm.yml agent manifest. Security updates are not included.

The changelog entry is short. The more useful reading is against Microsoft's APM documentation, because what a bot can safely bump depends on what the package manager checks.

What Dependabot will touch

APM, the Agent Package Manager, is a package manager for AI agent skills, prompts and instructions. A project lists them in apm.yml and runs apm install to deploy each one to the supported tools, which the docs list as GitHub Copilot, Claude Code, Cursor, OpenCode, Codex, Gemini, Windsurf, Kiro and Grok Build. The project is open source under the MIT licence in the microsoft GitHub organization.

To turn the support on, add an apm entry to .github/dependabot.yml, point it at the directory holding the manifest, and set a schedule. Dependabot opens pull requests for supported git dependencies declared in apm.yml, and regenerates apm.lock.yaml if it is present.

GitHub says the feature is generally available on github.com for all plans and will arrive in GitHub Enterprise Server 3.24. The entry states the limit in one sentence: "This support covers version updates, not security updates."

What APM checks before a bumped pin lands

A bump pull request changes which commit of someone else's prompt files gets deployed into an agent's working directory. The lockfile is the first guard. According to APM's security page, apm.lock.yaml stores a content_hash, a SHA-256 over a package's sorted file paths and contents, plus a full 40-character resolved_commit. A cached package that fails the hash is downloaded again, and if the fresh copy still fails, the install aborts.

The second guard is a scan. APM flags tag characters (U+E0001 to U+E007F), bidirectional overrides and variation selectors 17 to 256 as critical, and critical findings block deployment during apm install unless --force is used.

Check	Covered by APM	Source
Hidden Unicode in deployed files	Yes, critical findings block install	APM security page
SHA-256 content hash per package	Yes, in apm.lock.yaml	APM security page
Plain-text prompt injection	No	APM security page
Package signing	No	APM security page, NLJUG

The same page lists what the scanner does not detect: "Plain-text prompt injection (visible but malicious instructions)", homoglyph substitution, semantic manipulation and binary payload embedding. It adds that APM "does not do malware analysis on dependency code" and "does not sign packages". A guide to APM and AgentRC republished by NLJUG, written by Soham Dasgupta, makes the same point about signing and says integrity rests on content hashes, the lockfile and source allow-listing.

What that means for a weekly bump

This section is our reading, not a claim by GitHub or Microsoft. A Dependabot pull request on an apm entry changes a pin, and the hash and Unicode checks will catch tampering that breaks the hash or hides characters. A maintainer who pushes visible but malicious instructions to the dependency's next tag gets past both, by the docs' own account.

That puts the review on the person reading the diff of the upstream prompt files, not the lockfile. Teams that already read agent skill changes carefully, as the open issue in Cloudflare's security audit skill argues they should, lose nothing. Teams that auto-merge Dependabot bumps lose the one step that matters. The same habit applies to the review gaps described in Anthropic's agent memory study.

APM's own apm update resolves only annotated semver tags for full-SHA-pinned entries and rejects branches and lightweight tags on that path, per its security page. The changelog does not say whether Dependabot follows the same rule. Enterprise Server 3.24 has no announced date.