Authenticate with your API key

devin auth login —token YOUR_API_KEY

Link your monorepo

• deprecated-package
• internal-utils # Skip internal packages

• name: unit-tests command: pytest {package_dir}/tests/ -x —timeout=300 required: true retry: 1

• name: type-check command: mypy {package_dir}/src/ —ignore-missing-imports required: true retry: 0

• name: integration-tests command: pytest {package_dir}/tests/integration/ -x —timeout=600 required: false # Advisory only; won’t block the PR retry: 2

• name: security-audit command: pip-audit —requirement {package_dir}/requirements.txt required: true retry: 0

**Package:** {package_name}
**Upgrade:** {old_version} → {new_version}

### What Changed
{release_summary}

### Breaking Changes
{breaking_changes}

### Security Notes
{security_notes}

---
*Generated by Devin | Gate status: {gate_status}*</code></pre>

Step 5: Create the Automation Session

Now tie everything together by creating a recurring Devin session that scans for outdated dependencies and opens PRs. # Create the automated session devin session create \ --name "dependency-upgrades" \ --repo your-org/python-monorepo \ --trigger schedule \ --cron "0 9 * * 1" \ --instruction "Scan all packages in this monorepo for outdated Python dependencies. \ Follow the pinning rules in .devin/dependency-policy.yaml. \ Run all test gates in .devin/test-gates.yaml before opening PRs. \ Generate changelog summaries per .devin/changelog-config.yaml. \ Open one PR per package directory. Mark PRs as draft if any required gate fails."

Verify the session is active

devin session list —repo your-org/python-monorepo

You can also trigger a one-off run to test your configuration: # Manual trigger for immediate testing devin session trigger —name “dependency-upgrades” —dry-run

devin session trigger —name “dependency-upgrades” —scope packages/auth-service

Step 6: Review and Merge Workflow

Once configured, Devin will open PRs that look like this in your repository:

Can Devin handle private PyPI registries and internal packages?

Yes. Configure your private registry credentials in the Devin workspace secrets under Settings → Secrets. Add a .devin/pip.conf or set PIP_INDEX_URL as an environment variable in your session configuration. Devin will use these credentials when resolving and downloading packages. Internal packages listed under the ignore key in your policy file will be skipped entirely.

How does Devin handle conflicting dependency requirements across packages in the monorepo?

Devin resolves dependencies per package directory independently. If upgrading a shared dependency would cause a version conflict between packages, Devin detects this during the test gate phase and flags it in the PR body under “Compatibility Notes.” You can also set group_by: dependency_name to force a single coordinated PR across all affected packages, which lets you resolve conflicts in one review.

What happens if a dependency upgrade introduces a breaking change that Devin cannot automatically fix?

When a required test gate fails, Devin opens the PR as a draft and includes the full error log, the changelog summary highlighting breaking changes, and a suggested remediation plan in the PR description. It will not attempt arbitrary code modifications to fix breaking changes unless you include explicit instructions in the session prompt. Your team reviews the draft, applies manual fixes, and marks it ready for merge.