Automating Dependency Updates with Dependabot and Renovate

We integrate Dependabot and Renovate to automate dependency updates, eliminating manual work and closing vulnerabilities in hours. Stale dependencies are a source of critical vulnerabilities and technical debt. Manually updating hundreds of packages quarterly takes days and often gets postponed until emergencies. For example, a project with 300+ dependencies requires 8 hours per week just on updates. We automate this process with Dependabot and Renovate: the system tracks new releases, creates PRs, and merges patch updates without developer intervention. According to GitHub documentation, Dependabot supports update grouping, which reduces PR count by 5–10 times. This saves up to 40% of maintenance time and closes vulnerabilities in hours, not weeks. Typical budget savings—from $500 per month on developer salary. Our engineers have over 10 years of experience and have automated updates for projects with 500+ dependencies—resulting in a 30–50% reduction in maintenance time. Renovate handles 20+ ecosystems, 75% more than Dependabot, and groups updates 3x more efficiently. Our configs reduce review time by 80%.

Get a consultation on dependency automation — we'll configure the process for your project from $1,500. Source: Dependabot docs, 2024

Benefits of Update Automation

Every missed update is a potential exploit. Attacks through vulnerabilities in third-party packages are growing each year (according to Snyk, 78% of projects have at least one dependency vulnerability). Automation keeps your stack fresh without the routine: Dependabot checks npm, GitHub Actions, Docker, and Composer, groups dev dependencies into a single PR, and sends notifications. Our engineers configure update policies so that production packages undergo full CI checks, while dev updates are merged automatically. Grouping reduces PR count by 5–10 times; auto-merge saves up to 1 hour of review per day. That's 250 hours saved per year for a team of two—enough for 6 major features.

How to Configure Dependabot with PR Grouping?

Configuration starts with analyzing the lock file and current dependencies. We determine policies for production and dev packages: for the latter, we enable auto-merge for patch and minor versions. An example configuration is in the block below. Grouping reduces PR count by 5–10 times, and auto-merge saves an hour of review per day. Additionally, we configure ignore rules for major updates to critical libraries (React, Next.js) to avoid sudden breaking changes.

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday
      time: "09:00"
      timezone: "Europe/Moscow"
    open-pull-requests-limit: 10
    groups:
      dev-dependencies:
        patterns:
          - "@types/*"
          - "eslint*"
          - "prettier*"
          - "jest*"
          - "vitest*"
          - "typescript"
        update-types:
          - "minor"
          - "patch"
      storybook:
        patterns:
          - "@storybook/*"
          - "storybook"
    ignore:
      - dependency-name: "next"
        update-types: ["version-update:semver-major"]
      - dependency-name: "react"
        update-types: ["version-update:semver-major"]
    labels:
      - "dependencies"
      - "automated"
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    labels:
      - "github-actions"
      - "automated"
  - package-ecosystem: docker
    directory: /
    schedule:
      interval: monthly
    labels:
      - "docker"
      - "automated"
  - package-ecosystem: composer
    directory: /
    schedule:
      interval: weekly
    groups:
      laravel:
        patterns:
          - "laravel/*"

Auto-merge Patch Updates: Step by Step

To automatically accept safe changes, we perform these steps:

1. Create a workflow file .github/workflows/dependabot-auto-merge.yml.
2. Set permissions: contents: write, pull-requests: write.
3. Add a check that the PR is created by Dependabot.
4. Specify merge rules for dev and production dependencies.
5. Use gh pr merge --auto --squash for automatic merging after successful CI.

Example workflow:

# .github/workflows/dependabot-auto-merge.yml
name: Auto-merge Dependabot PRs

on:
  pull_request

permissions:
  contents: write
  pull-requests: write

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'

    steps:
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Auto-merge dev dependency patches
        if: |
          steps.metadata.outputs.dependency-type == 'direct:development' &&
          (steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
           steps.metadata.outputs.update-type == 'version-update:semver-minor')
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Auto-merge production patches
        if: |
          steps.metadata.outputs.dependency-type == 'direct:production' &&
          steps.metadata.outputs.update-type == 'version-update:semver-patch'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow verifies that the PR is created by Dependabot, then merges minor/patch updates for dev dependencies and patch updates for production dependencies after successful CI.

Dependabot vs Renovate: When to Choose Which?

Renovate supports 20+ ecosystems—75% more than Dependabot: npm, Docker, Maven, Gradle, PyPI, Bundler, and 20+ others. Here is a comparison:

Renovate is 3x more efficient for grouping and supports 75% more ecosystems. But Dependabot is simpler to set up and already integrated into GitHub. We recommend Dependabot for small projects and Renovate for complex monorepos with dozens of packages. We've seen teams reduce merge conflicts by 90% using Renovate.

Security Monitoring in CI

In addition to Dependabot, we integrate vulnerability scanning into the pipeline:

npm audit --audit-level=high 

And we block PRs with critical vulnerabilities:

# .github/workflows/security.yml
- name: Security audit
  run: |
    npm audit --audit-level=critical --json > audit.json
    CRITICAL=$(jq '.metadata.vulnerabilities.critical' audit.json)
    if [ "$CRITICAL" -gt 0 ]; then
      echo "Critical vulnerabilities found: $CRITICAL"
      exit 1
    fi

This ensures that no PR with a critical vulnerability gets into main. For more details on Dependabot configuration, refer to the official documentation.

What's Included in the Setup (Turnkey)

Stages of Automatic Update Setup

The total setup cost starts at $1,500, depending on stack complexity. We'll deliver within 5 business days.

We set up the process turnkey: from initial analysis to full launch. Our engineers have experience with projects where the number of dependencies exceeds 500 packages and guarantee stability after auto-updates.

Order automatic dependency update setup — get a consultation and estimate your project today. Fill out the form or write to us.