How I built an AI bot that fixes broken npm dependencies (and how it uses GitHub Actions)

Description and use

An AI bot that upgrades npm dependencies, patches ESM errors, and opens a PR only when tests pass.

Problem

Dependabot PRs can break builds when a library becomes ESM-only, requiring manual fixes.

Outcome

The bot updated node-fetch from v2 to v3, detected an ERR_REQUIRE_ESM error, rewrote the import to use .default, and completed the process in 3 minutes, resulting in passing tests and a clean PR.

Workflow

• Run tests before upgrade to establish baseline
• Bump the targeted dependency
• If tests fail, send error and source files to an LLM (Groq, Gemini, etc.)
• LLM patches the code
• Repeat the test‑run and patch cycle up to 3 times
• If tests pass, open a PR with the changes
• If tests still fail after 3 attempts, do not open a PR

Evidence

It runs your tests before the upgrade (baseline check).

Source

If tests fail, it sends the error and source files to an LLM (Groq, Gemini, etc).

Source

The LLM patches the code. The cycle repeats up to 3 times.

Source

It only opens a PR if the tests are green.

Source

I tested it on a repo with node-fetch@2. The bot updated it to v3, saw the ERR_REQUIRE_ESM error, and automatically rewrote the file to use .default import. It took 3 minutes.

Source