Your dependencies ship a new release every few days, and any one of them can break your code, fix a bug you work around, or add an API that lets you delete code. Your project ships a Renovate configuration, .github/renovate.json5, that turns each release into a pull request with the release notes in its body. You judge the change next to the notes that explain it.

The configuration does nothing until you install the Renovate app on your repository. That's the main step on this page.

flowchart LR
    R["A dependency<br/>releases"] --> A{"A day old?"}
    A -- "not yet" --> W["Waits"]
    A -- "yes" --> S["Monday"]
    S --> P["Opens a pull request<br/>with the release notes"]
    P --> Y["You review<br/>and merge"]

What it does

• One pull request per package. Packages released together from one repository, such as nuxt and @nuxt/kit, share a pull request, because they share one changelog.
• Nothing merges itself. Every update, however small, waits for you to read it and merge it.
• Once a week. New pull requests open on Monday, UTC. A fix for a known security advisory skips the wait and opens straight away.
• Never on release day. pnpm refuses to install a release younger than the minimumReleaseAge in pnpm-workspace.yaml, so Renovate waits at least as long.
• No vitest pull requests. vite-plus pins the vitest your tests run on, and any other version installed beside it stops every test file from loading. When a vite-plus pull request moves that pin, set vitest in the pnpm-workspace.yaml catalog to match.

Turn it on

gh api --method PUT repos/<owner>/<repo>/vulnerability-alerts

Review a pull request

Renovate opens every pull request as a draft, and CI skips drafts, so an update spends no Actions minutes until you look at it. Select Ready for review to run CI on it. If you've added pull request previews, it also gets a preview you can click through.

Read the release notes in its body for three things:

• A breaking change that your code has to adopt
• A fix for a bug that your code works around, so the workaround can go
• A new API that does what your code does by hand

Your AI coding agent can do this pass for you: point it at the pull request and ask the same three questions of your code.

Merge it when you're satisfied. Close a major update you aren't ready for, and Renovate won't propose that major again, only the next one. Some are held on purpose: comments in the catalog of pnpm-workspace.yaml say which versions are held back and what they're waiting for.

A pull request that changes .github/renovate.json5 itself is Renovate renaming one of its own options. Merge it like any other.

Merge one without CI

Some updates need no preview, because their release notes promise nothing you'd see in one. The pr:skip-ci label merges such a pull request with no CI run. The push to the target branch still runs CI on the merged result.

1. Create the label, once per repository:

   gh label create pr:skip-ci --description "Merge with no CI run or preview"
   

2. While the pull request is still a draft, label it, mark it ready, and merge it:

   gh pr edit <n> --add-label pr:skip-ci && gh pr ready <n> && gh pr merge <n> --squash
   

3. Watch the run on the target branch. If it fails, revert the merge.

Add the label before you mark the pull request ready. Each run reads the labels the pull request had when the run started.

Change what it does

• Wait longer after a release: raise minimumReleaseAge in .github/renovate.json5 first, then in pnpm-workspace.yaml. While Renovate's value is the lower of the two, it proposes releases pnpm refuses to install.
• Anything else: Renovate's configuration options.

When it does not work

Next steps

• Getting updates — pull NuxtStart's own later changes into your project, which Renovate doesn't do
• Deploy pipeline — what CI runs on every pull request, Renovate's included