Automating Dependency Updates with Dependabot and Renovate

We integrate Dependabot and Renovate to automate dependency updates, eliminating manual work and closing vulnerabilities in hours. Stale dependencies are a source of critical vulnerabilities and technical debt. Manually updating hundreds of packages quarterly takes days and often gets postponed until emergencies. For example, a project with 300+ dependencies requires 8 hours per week just on updates. We automate this process with Dependabot and Renovate: the system tracks new releases, creates PRs, and merges patch updates without developer intervention. According to GitHub documentation, Dependabot supports update grouping, which reduces PR count by 5–10 times. This saves up to 40% of maintenance time and closes vulnerabilities in hours, not weeks. Typical budget savings—from $500 per month on developer salary. Our engineers have over 10 years of experience and have automated updates for projects with 500+ dependencies—resulting in a 30–50% reduction in maintenance time. Renovate handles 20+ ecosystems, 75% more than Dependabot, and groups updates 3x more efficiently. Our configs reduce review time by 80%.

Get a consultation on dependency automation — we'll configure the process for your project from $1,500. Source: Dependabot docs, 2024

Benefits of Update Automation

Every missed update is a potential exploit. Attacks through vulnerabilities in third-party packages are growing each year (according to Snyk, 78% of projects have at least one dependency vulnerability). Automation keeps your stack fresh without the routine: Dependabot checks npm, GitHub Actions, Docker, and Composer, groups dev dependencies into a single PR, and sends notifications. Our engineers configure update policies so that production packages undergo full CI checks, while dev updates are merged automatically. Grouping reduces PR count by 5–10 times; auto-merge saves up to 1 hour of review per day. That's 250 hours saved per year for a team of two—enough for 6 major features.

How to Configure Dependabot with PR Grouping?

Configuration starts with analyzing the lock file and current dependencies. We determine policies for production and dev packages: for the latter, we enable auto-merge for patch and minor versions. An example configuration is in the block below. Grouping reduces PR count by 5–10 times, and auto-merge saves an hour of review per day. Additionally, we configure ignore rules for major updates to critical libraries (React, Next.js) to avoid sudden breaking changes.

# .github/dependabot.yml version: 2 updates: - package-ecosystem: npm directory: / schedule: interval: weekly day: monday time: "09:00" timezone: "Europe/Moscow" open-pull-requests-limit: 10 groups: dev-dependencies: patterns: - "@types/*" - "eslint*" - "prettier*" - "jest*" - "vitest*" - "typescript" update-types: - "minor" - "patch" storybook: patterns: - "@storybook/*" - "storybook" ignore: - dependency-name: "next" update-types: ["version-update:semver-major"] - dependency-name: "react" update-types: ["version-update:semver-major"] labels: - "dependencies" - "automated" - package-ecosystem: github-actions directory: / schedule: interval: weekly labels: - "github-actions" - "automated" - package-ecosystem: docker directory: / schedule: interval: monthly labels: - "docker" - "automated" - package-ecosystem: composer directory: / schedule: interval: weekly groups: laravel: patterns: - "laravel/*" 

Auto-merge Patch Updates: Step by Step

To automatically accept safe changes, we perform these steps:

1. Create a workflow file .github/workflows/dependabot-auto-merge.yml.
2. Set permissions: contents: write, pull-requests: write.
3. Add a check that the PR is created by Dependabot.
4. Specify merge rules for dev and production dependencies.
5. Use gh pr merge --auto --squash for automatic merging after successful CI.

Example workflow:

# .github/workflows/dependabot-auto-merge.yml name: Auto-merge Dependabot PRs on: pull_request permissions: contents: write pull-requests: write jobs: auto-merge: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' steps: - name: Fetch Dependabot metadata id: metadata uses: dependabot/fetch-metadata@v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} - name: Auto-merge dev dependency patches if: | steps.metadata.outputs.dependency-type == 'direct:development' && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Auto-merge production patches if: | steps.metadata.outputs.dependency-type == 'direct:production' && steps.metadata.outputs.update-type == 'version-update:semver-patch' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} 

The workflow verifies that the PR is created by Dependabot, then merges minor/patch updates for dev dependencies and patch updates for production dependencies after successful CI.

Dependabot vs Renovate: When to Choose Which?

Renovate supports 20+ ecosystems—75% more than Dependabot: npm, Docker, Maven, Gradle, PyPI, Bundler, and 20+ others. Here is a comparison:

Renovate is 3x more efficient for grouping and supports 75% more ecosystems. But Dependabot is simpler to set up and already integrated into GitHub. We recommend Dependabot for small projects and Renovate for complex monorepos with dozens of packages. We've seen teams reduce merge conflicts by 90% using Renovate.

Security Monitoring in CI

In addition to Dependabot, we integrate vulnerability scanning into the pipeline:

npm audit --audit-level=high 

And we block PRs with critical vulnerabilities:

# .github/workflows/security.yml - name: Security audit run: | npm audit --audit-level=critical --json > audit.json CRITICAL=$(jq '.metadata.vulnerabilities.critical' audit.json) if [ "$CRITICAL" -gt 0 ]; then echo "Critical vulnerabilities found: $CRITICAL" exit 1 fi 

This ensures that no PR with a critical vulnerability gets into main. For more details on Dependabot configuration, refer to the official documentation.

What's Included in the Setup (Turnkey)

Stages of Automatic Update Setup

The total setup cost starts at $1,500, depending on stack complexity. We'll deliver within 5 business days.

We set up the process turnkey: from initial analysis to full launch. Our engineers have experience with projects where the number of dependencies exceeds 500 packages and guarantee stability after auto-updates.

Order automatic dependency update setup — get a free consultation and estimate your project today. Fill out the form or write to us.