Dependency upgrade cadence: batching, grouping and what to merge at once

What it is

Dependency updates arrive as a stream: patch releases, minor versions, majors and security advisories. Update bots turn each into a pull request. The GitHub reference for dependabot.yml documents schedule.interval (daily, weekly, monthly, quarterly, semiannually, yearly or cron) and a groups option that combines several updates into one pull request; Renovate's noise-reduction guide describes package grouping, scheduling and automerging for the same purpose, and states that on default settings a PR is raised every time any dependency receives any update. Semantic versioning increments MAJOR for incompatible API changes, MINOR for backwards-compatible functionality and PATCH for backwards-compatible fixes, which is the basis for sorting updates into risk classes.

Why it matters

One pull request per patch release trains reviewers either to merge without reading or to ignore the bot; both paths end in a large, risky catch-up upgrade months later. A cadence with batches keeps review cost proportional to risk and keeps the lock file moving.

How to apply

• Three lanes. Security advisories are reviewed and merged as they arrive, outside the schedule. Patch and minor updates are grouped into one batch on a fixed day. Major updates get their own pull request and a ticket, because they usually need code changes.
• Choose the batch interval by test confidence: weekly if the suite would catch a regression, monthly if merging needs manual verification. A monthly batch is larger but still bounded.
• Group by family (all @types/*, all test tooling, one framework's packages), not by everything. Renovate's guide lists the trade-off: a grouped branch is more likely to break, it takes longer to find which package broke it, and a failing group holds up every other update in it.
• Automerge only the class whose failure the tests would detect, after CI passes; keep a human on the rest.
• Let the bot update the lock file; its diff then shows exactly which transitive packages moved.
• Read the changelog of anything crossing a major boundary before scheduling it; deprecations announced there are the next batch's work.

Pitfalls

Pull requests that land at any hour interrupt working days; Renovate's guide notes that many users restrict its schedule to outside normal working hours, for example weeknights and weekends. A grouped batch that fails CI should be split, not merged red. Ecosystems that do not follow semantic versioning (calendar versions, 0.x packages) need per-package judgement, and a patch release can still break a build.

A minimum release age before automerge

A green test run shows that an update is compatible, not that it is safe: the widely documented npm compromises of 2018, 2021 and 2025 shipped as ordinary patch or minor versions that passed their consumers' tests, and most were withdrawn from the registry within hours or days. Add a waiting period to the automerged lanes: Renovate's minimumReleaseAge, Dependabot's cooldown (with default-days and per-semver-level values), or pnpm's minimumReleaseAge at install time, set to a few days. The security lane stays exempt, since an advisory fix is the one release that should land immediately. Batches then contain only versions that have survived the period in public, and the review in the major lane is unchanged.