Automatic dependency updates: Dependabot and Renovate

In short: Dependabot and Renovate regularly check whether libraries have new versions or security patches and automatically open pull requests with the update.

In more detail: Modern projects depend on hundreds of packages. If they go out of date, security vulnerabilities and costly leaps accumulate. Manual checking gets forgotten; bots take it over regularly and in small steps.

In Depth

How it works

The bot reads package.json/lockfiles, requirements.txt, pom.xml, Dockerfile, GitHub Actions files and compares with the latest versions. If there is an update, it creates a pull request with change list, link to release notes and runs through your CI tests. You review and merge. For security vulnerabilities (CVE) Dependabot security alerts report and create urgent PRs.

Dependabot and Renovate

• Dependabot (GitHub): simple, configuration .github/dependabot.yml; integrated into GitHub security features.

version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule: { interval: weekly }
    groups:
      dev-tools: { dependency-type: development }

• Renovate (open source, also GitLab, Gitea, self-hostable): highly configurable (grouping, automerge for patches, rules per package, time windows), supports many formats. Both work best with a good test suite.

Good practice

• Group (for example all dev tools in one PR) to avoid a flood of PRs.
• Automatically merge patch and minor updates with green tests, check major updates manually.
• Version lockfiles so builds are reproducible.
• Read release notes, especially for major versions and breaking changes.
• Pin critical dependencies (choose version ranges, ~/^, deliberately).
• Schedule (weekly) instead of daily unrest.
• Mind the supply chain: updates can also be malicious (compromised packages); introduce new versions with a short cooldown (for example 3 days).

Benefit

Less security risk, smaller updates (easier to debug than a leap over 2 years), current tools and less “update debt”. For small projects a monthly check with npm outdated/npm audit/pip list --outdated suffices if the effort for a bot seems too high.

See also: Dependencies and vulnerabilities (CVE), npm audit, Software supply chain