dependency-management

To separate security updates from routine dependency upgrades, configure Dependabot for security-only alerts and use Renovate for routine version bumps. This split keeps vulnerability handling easy to prioritize while centralizing non-security upgrades in renovate.json with predictable grouping and automerge rules.

The best way to manage major dependency updates is to configure them as approval-gated within your renovate.json policy. This approach requires explicit review before applying major version changes, preventing silent build failures while allowing non-major updates to automerge safely.

To upgrade workspace packages using pnpm commands, follow the documented pnpm commands for manual upgrades and backlogged queue recovery. This ensures dependency changes are applied consistently across workspace packages before committing the updated lockfile.

Yes, you can use Renovate and Dependabot together by keeping Dependabot focused on security updates in dependabot.yml and using Renovate for non-security dependency updates. This separation ensures vulnerability handling stays distinct from routine upgrade workflows.

A noisy dependency update queue happens when updates are ungrouped; control it by applying renovate.json grouping and automerge constraints. Centralizing non-major updates with predictable cadence reduces PR noise and simplifies review priorities.

Reviewing security versus routine dependency PRs requires applying specific review priorities for security scanning and following documented steps for routine upgrades. Treat security PRs from Dependabot as high priority while evaluating routine Renovate PRs against grouping and automerge constraints.