Suggestion: optional comment-only second opinion on Dependabot PRs #900

Why I'm writing

This repo regularly gets Dependabot npm upgrade PRs. Maintainers still have to triage changelog / supply-chain risk by hand for each one.

Optional tool (opt-in)

dep-second-opinion is a comment-only GitHub Action: it posts a structured second opinion on dependency upgrade PRs and never edits package.json / lockfiles.

Pin (Path A):

- uses: lory69060/dep-second-opinion@v0.2.0

Install notes: https://github.com/lory69060/dep-second-opinion/blob/main/docs/install.md

Happy to close this if it's not a fit — no hard sell, just a suggestion.