Dependency Update Strategy

Choose between Renovate, Dependabot, manual, or none — and configure the winner to match your risk appetite.

Why

The choice of update tool determines your upgrade cadence more than any policy doc, because the tool is what actually opens the PRs. Dependabot is built into GitHub and simple but limited (one ecosystem, no grouping, no auto-merge without an Action). Renovate is a separate app/bot but far more powerful: it groups related updates, auto-merges on green, supports 50+ ecosystems, and has a JSON config you can version. Picking the wrong tool means either drowning in 200 individual PRs (Dependabot default) or having no automation at all (manual). The strategy is to pick Renovate for any repo with >10 deps and configure it to group + auto-merge patch/minor.

When

When setting up a new repo or when the current tool's PR volume is unmanageable. Re-evaluate yearly.

How

1. Inventory your ecosystems: npm? pip? cargo? go? — pick a tool that covers all
2. Compare: Renovate (powerful, grouping, auto-merge, 50+ managers) vs Dependabot (simple, GitHub-native)
3. Choose Renovate for >10 deps or multi-ecosystem; Dependabot for tiny single-ecosystem repos
4. Configure grouping: all patch+minor into one weekly PR; majors as individual PRs
5. Configure auto-merge: patch+minor auto-merge on green CI; majors require human review
6. Add an "ignoreDeps" list for pinned-risk packages (e.g. a specific ORM version you've vetted)
7. Set a schedule: "before 6am Monday" so upgrades land in a predictable, low-traffic window
8. Monitor: alert if the bot has been blocked >3 days (a failing PR means debt is accruing)

Example

# renovate.json — the recommended config
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "schedule": ["before 6am on Monday"],
  "packageRules": [
    {
      "matchUpdateTypes": ["patch", "minor"],
      "groupName": "non-breaking",
      "automerge": true,
      "automergeType": "pr"
    },
    {
      "matchUpdateTypes": ["major"],
      "labels": ["needs-review"],
      "dependencyDashboardApproval": true
    },
    {
      "matchPackageNames": ["typeorm"],
      "enabled": false
    }
  ]
}
# Dependabot fallback (.github/dependabot.yml) — no grouping, no auto-merge:
#   schedule: weekly, open-pull-requests-limit: 10

Common Problems

⚠Using Dependabot defaults and getting 50 individual PRs per week — reviewers develop banner blindness and stop merging.
⚠Auto-merging majors as well as patch — a major that passes CI but breaks at runtime (behavior change) lands in prod unreviewed.
⚠No schedule — the bot opens PRs at random times, including during a release freeze or Friday afternoon.

Best Practices

✓Use Renovate with grouping: one weekly PR for all patch+minor, individual PRs for majors — this balances noise vs reviewability.
✓Never auto-merge majors; require a human changelog review and a staging deploy for every major bump.
✓Pin the bot to a schedule and set a dependency-dashboard so blocked PRs are visible and don't silently rot.