Automating Dependency Updates Without Drowning

Automated dependency updates fail in a predictable way. You enable the bot, it opens forty pull requests on the first day, you review three, and the rest sit open until someone closes them all in frustration.

The tool is not the problem. The default configuration is.

Configure it before you enable it

{
  "extends": ["config:recommended"],
  "schedule": ["after 9pm on sunday"],
  "prConcurrentLimit": 3,
  "packageRules": [
    {
      "matchUpdateTypes": ["patch", "pin", "digest"],
      "automerge": true,
      "groupName": "patch updates"
    },
    {
      "matchUpdateTypes": ["major"],
      "dependencyDashboardApproval": true
    }
  ],
  "vulnerabilityAlerts": { "labels": ["security"], "schedule": [] }
}

Four decisions doing all the work:

A schedule so updates arrive in one predictable batch, not continuously through your working week.

A concurrency limit so you never face more than three open at once. This is the single most important setting.

Auto-merge for patches, gated on your test suite passing. Patch updates are the bulk of the volume and the least of the risk. If your tests are not good enough to trust with a patch bump, that is worth knowing separately.

Major updates behind explicit approval, because those need a human reading a changelog.

Note that security updates ignore the schedule. Those should arrive immediately.

The prerequisite nobody says out loud

Auto-merge requires a test suite you actually trust. If you do not have one, automated updates just move the risk from "outdated dependencies" to "untested changes merged automatically."

For projects without meaningful tests, keep auto-merge off and treat the bot as a well-organised reminder. That is still better than manual checking, which in practice means never.

The compounding benefit

Small, frequent updates are dramatically easier than an annual catch-up. A patch bump is a five-minute merge; three years of accumulated drift is a fortnight of work and a rewrite nobody budgeted.

I have inherited both kinds of project. The difference in maintainability is larger than almost any architectural decision.

Resources

• Repo: renovatebot/renovate
• Docs: docs.renovatebot.com
• Video walkthroughs: YouTube: Renovate configuration