---
title: "Automatic dependency updates"
description: "Get a pull request for each dependency release, with the version bump and its release notes, ready for you to review."
canonical_url: "https://nuxtstart.com/docs/configuration/dependency-updates"
---

Your dependencies ship a new release every few days, and any one of them can break your code, fix a
bug you work around, or add an API that lets you delete code. Your project ships a
[Renovate](https://docs.renovatebot.com) configuration, `.github/renovate.json5`, that turns each
release into a pull request with the release notes in its body. You judge the change next to the
notes that explain it.

The configuration does nothing until you install the Renovate app on your repository. That's the
main step on this page.

```mermaid
flowchart LR
    R["A dependency<br/>releases"] --> A{"A day old?"}
    A -- "not yet" --> W["Waits"]
    A -- "yes" --> S["Monday"]
    S --> P["Opens a pull request<br/>with the release notes"]
    P --> Y["You review<br/>and merge"]
```

## What it does

- **One pull request per package.** Packages released together from one repository, such as `nuxt`
and `@nuxt/kit`, share a pull request, because they share one changelog.
- **Nothing merges itself.** Every update, however small, waits for you to read it and merge it.
- **Once a week.** New pull requests open on Monday, UTC. A fix for a known security
advisory skips the wait and opens straight away.
- **Never on release day.** pnpm refuses to install a release younger than the `minimumReleaseAge`
in `pnpm-workspace.yaml`, so Renovate waits at least as long.
- **No vitest pull requests.** vite-plus pins the `vitest` your tests run on, and any other
version installed beside it stops every test file from loading. When a vite-plus pull request
moves that pin, set `vitest` in the `pnpm-workspace.yaml` catalog to match.

## Turn it on

<steps level="3">

### Install the Renovate app

Open [the Renovate app](https://github.com/apps/renovate) on GitHub and select **Install**, or
**Configure** if your account already has it. Pick the account that owns your repository, choose
**Only select repositories**, select your repository, then **Install**.

Choose **Only select repositories** because Renovate opens an onboarding pull request in every
repository it can reach that has dependencies and no Renovate configuration. Yours has one, so
Renovate skips onboarding and starts working. [Installing Renovate](https://docs.renovatebot.com/getting-started/installing-onboarding/)
is the fallback if a screen has moved.

GitHub then hands you to Mend's **Onboard Organization** wizard, since Mend hosts the app:

<table>
<thead>
  <tr>
    <th>
      Screen
    </th>
    
    <th>
      Choose
    </th>
    
    <th>
      Why
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Select Product
      </strong>
    </td>
    
    <td>
      <strong>
        Renovate Only
      </strong>
    </td>
    
    <td>
      <strong>
        Mend Application Security
      </strong>
      
       needs a paid Mend license
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Select Mode
      </strong>
    </td>
    
    <td>
      <strong>
        Scan and Alert
      </strong>
    </td>
    
    <td>
      The default, <strong>
        Scan Only
      </strong>
      
      , runs Renovate silently: no pull requests and no dashboard issue
    </td>
  </tr>
</tbody>
</table>

`mode: 'full'` in `.github/renovate.json5` overrides **Scan Only** for your repository, so a wrong
pick here still gets you pull requests. "Alert" means Renovate's pull requests, issues, and checks,
not security alerts. Those come from the next step.

### Turn on security alerts

Renovate raises a security fix only for an advisory GitHub has already flagged in your repository.
Turn on Dependabot alerts, which also turns on the dependency graph they need:

```shell
gh api --method PUT repos/<owner>/<repo>/vulnerability-alerts
```

Then open [the Renovate app](https://github.com/apps/renovate), select **Configure**, and confirm
the **Permissions** section includes read access to **Dependabot alerts**.

Skip this step and a security fix waits for Monday like any other update. Leave
Dependabot's own security updates off: Renovate raises the fix, and Dependabot would open a second
pull request for the same advisory.

### Find the Dependency Dashboard

Renovate's first run opens an issue in your repository titled **Dependency Dashboard**. It lists
every update Renovate has found, including the ones it hasn't opened yet, and marks any package
with no release in over a year as abandoned.

The first run finds everything your project has fallen behind on at once. Renovate caps how many
pull requests are open at the same time, and the rest wait in the dashboard. Select an update's
checkbox there to open its pull request now, rather than on Monday.

</steps>

## Review a pull request

Renovate opens every pull request as a draft, and CI skips drafts, so an update spends no Actions
minutes until you look at it. Select **Ready for review** to run CI on it. If you've
[added pull request previews](/docs/getting-started/adding-pull-request-previews), it also gets a
preview you can click through.

Read the release notes in its body for three things:

- A breaking change that your code has to adopt
- A fix for a bug that your code works around, so the workaround can go
- A new API that does what your code does by hand

Your AI coding agent can do this pass for you: point it at the pull request and ask the same three
questions of your code.

Merge it when you're satisfied. Close a major update you aren't ready for, and Renovate won't
propose that major again, only the next one. Some are held on purpose: comments in the `catalog` of
`pnpm-workspace.yaml` say which versions are held back and what they're waiting for.

A pull request that changes `.github/renovate.json5` itself is Renovate renaming one of its own
options. Merge it like any other.

## Merge one without CI

Some updates need no preview, because their release notes promise nothing you'd see in one. The
`pr:skip-ci` label merges such a pull request with no CI run. The push to the target branch still
runs CI on the merged result.

1. Create the label, once per repository:```shell
gh label create pr:skip-ci --description "Merge with no CI run or preview"
```
2. While the pull request is still a draft, label it, mark it ready, and merge it:```shell
gh pr edit <n> --add-label pr:skip-ci && gh pr ready <n> && gh pr merge <n> --squash
```
3. Watch the run on the target branch. If it fails, revert the merge.

Add the label before you mark the pull request ready. Each run reads the labels the pull request
had when the run started.

<warning>

Label only a pull request that never left draft. The label also skips the cleanup that deletes a
preview when the pull request closes, so a preview from an earlier run stays public.

</warning>

## Change what it does

- **Wait longer after a release:** raise `minimumReleaseAge` in `.github/renovate.json5` first, then
in `pnpm-workspace.yaml`. While Renovate's value is the lower of the two, it proposes releases pnpm
refuses to install.
- **Anything else:** Renovate's [configuration options](https://docs.renovatebot.com/configuration-options/).

## When it does not work

<table>
<thead>
  <tr>
    <th>
      What you see
    </th>
    
    <th>
      What to fix
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      No pull requests and no Dependency Dashboard
    </td>
    
    <td>
      The app isn't installed on this repository, Mend runs it in <strong>
        Scan Only
      </strong>
      
       mode (switch the repository to <strong>
        Scan and Alert
      </strong>
      
       in the Mend Developer Platform), or the repository has <strong>
        Issues
      </strong>
      
       turned off, and the dashboard is an issue
    </td>
  </tr>
  
  <tr>
    <td>
      Renovate comments <strong>
        Artifact update problem
      </strong>
      
       on a pull request
    </td>
    
    <td>
      Renovate proposed a release pnpm refuses as too new, so its <code>
        minimumReleaseAge
      </code>
      
       is below pnpm's. See <a href="#change-what-it-does">
        Change what it does
      </a>
    </td>
  </tr>
  
  <tr>
    <td>
      An update to a package <code>
        patches/
      </code>
      
       patches fails at install
    </td>
    
    <td>
      The patch targets the old version. Check out the branch, run <code>
        pnpm patches:build
      </code>
      
      , or <code>
        pnpm patches:remove <number>
      </code>
      
       when the release already carries that pull request, and commit what it writes
    </td>
  </tr>
  
  <tr>
    <td>
      A <code>
        polar
      </code>
      
       update fails the <code>
        polar models
      </code>
      
       test
    </td>
    
    <td>
      The schemas that check Polar data come from the previous SDK. Check out the branch, run <code>
        pnpm --filter @app/layer-payments polar:models
      </code>
      
      , and commit what it writes
    </td>
  </tr>
  
  <tr>
    <td>
      No security fix pull requests
    </td>
    
    <td>
      Dependabot alerts are off, or the app can't read them. See <a href="#turn-on-security-alerts">
        Turn on security alerts
      </a>
    </td>
  </tr>
</tbody>
</table>

## Next steps

- [Getting updates](/docs/getting-started/getting-updates) — pull NuxtStart's own later changes into
your project, which Renovate doesn't do
- [Deploy pipeline](/docs/deployment/pipeline) — what CI runs on every pull request, Renovate's
included

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.