Skip to content
Back to Maintenance & LTS

Minor & Patch Upgrade

Apply non-breaking minor/patch releases continuously to stay close to HEAD and reduce upgrade debt.

Why

Minor and patch releases are semver-safe — they should not break — but "should" is doing a lot of work. A minor can add a new default that changes performance, a patch can fix a bug you were accidentally relying on. The real value of staying current on minors is debt prevention: a codebase 20 minors behind needs a 20-step upgrade with 20 chances to break, while a continuous one-minor-at-a-time flow is each a no-op. Teams that batch minors into quarterly "upgrade sprints" spend more total engineer-hours and have more outages than teams that automate minor/patch bumps weekly.

When

Continuously — weekly or per-PR via Renovate/Dependabot. Apply immediately when a patch fixes a security CVE you're exposed to.

How

1. Enable an automated bot (Renovate or Dependabot) configured for minor+patch only
2. Set the bot to group minor+patch per-package-manager into one PR (reduces CI load)
3. CI must run typecheck + unit + e2e on every bot PR; auto-merge if all green
4. For non-trivial minors (framework, ORM), review the changelog manually before merge
5. Pin the bot to a schedule (e.g. "before 6am on Monday") so upgrades land in a predictable window
6. If a minor breaks CI, the bot PR fails — fix forward, never disable the bot globally

Example

# renovate.json (group minor+patch, auto-merge on green)
{
  "extends": ["config:base"],
  "packageRules": [
    {
      "updateTypes": ["patch", "minor"],
      "groupName": "non-breaking",
      "automerge": true,
      "automergeType": "pr",
      "schedule": ["before 6am on Monday"]
    },
    {
      "updateTypes": ["major"],
      "enabled": false
    }
  ]
}
# Dependabot equivalent in .github/dependabot.yml:
#   update-types: [version-update:semver-patch, version-update:semver-minor]

Common Problems

  • ⚠Disabling the bot after one bad PR instead of fixing the root cause — debt accumulates silently and the next manual upgrade is a multi-week project.
  • ⚠Auto-merging without e2e tests — a patch that fixes a bug can break code that relied on the buggy behavior, and unit tests won't catch it.
  • ⚠Letting the bot open 200 individual PRs instead of grouping — CI burns through its budget and reviewers stop looking.

Best Practices

  • ✓Group minor+patch into one weekly PR and auto-merge on full green CI — this keeps you within one minor of HEAD at all times.
  • ✓Treat a failed bot PR as a P2 bug: fix it within a day, because every day the bot is blocked is a day of debt.
  • ✓Exclude a small allowlist of high-risk packages (ORM, framework) from auto-merge; require a human changelog review for those.