We run Renovate and Dependabot at the same time, and Renovate's automerge is configured in a way that can never fire. Both have been noted on #2391 since it was opened and neither has been actioned; splitting them out so they outlive that issue.
The two bots overlap
There is no .github/dependabot.yml in this repo, so Dependabot is enabled through repository settings rather than config — which is why it is easy to forget it is running at all. It opens security PRs labelled dependencies, and those duplicate what Renovate already raises.
The duplication is not theoretical. #2368 (lodash) and #2373 (postcss) both duplicated Renovate security PRs at older versions, which is precisely why they conflicted. #2419 is a current open example.
Renovate can handle security updates itself via vulnerabilityAlerts, and .renovaterc.json does not configure it today. Roughly:
- Turn Dependabot off in repository settings and configure Renovate's
vulnerabilityAlerts to cover security updates. One bot, one backlog.
- Or keep Dependabot for security only and scope Renovate away from those, which means keeping two systems deliberately rather than accidentally.
Either is fine; running both unconfigured is what produces conflicting PRs at different versions.
Renovate's automerge cannot fire
.renovaterc.json extends :automergeMinor:
"extends": ["config:recommended", ":automergeMinor", ":pinVersions"]
Branch protection on main requires an approving review, and Renovate cannot approve its own PRs. So every minor update waits for a human anyway and the setting does nothing but suggest otherwise.
Options:
- Drop
:automergeMinor, so the config describes what actually happens.
- Or keep it and make it work —
platformAutomerge, or allowing the Renovate app to satisfy the review requirement. Worth being deliberate: automerging minors into a published design system means unreviewed changes can reach dist.
Why this is not part of #2391 item 6
Item 6 removes Gulp. This is repository configuration, not code, and #2391 closes when item 6 lands — at which point this would disappear along with it, having survived the entire modernization sequence unaddressed.
One practical note: #2421 added seven test packages and #2422 five more upgrades, so expect fresh churn from both bots regardless of which way this goes.
Related: #2391.
We run Renovate and Dependabot at the same time, and Renovate's automerge is configured in a way that can never fire. Both have been noted on #2391 since it was opened and neither has been actioned; splitting them out so they outlive that issue.
The two bots overlap
There is no
.github/dependabot.ymlin this repo, so Dependabot is enabled through repository settings rather than config — which is why it is easy to forget it is running at all. It opens security PRs labelleddependencies, and those duplicate what Renovate already raises.The duplication is not theoretical. #2368 (lodash) and #2373 (postcss) both duplicated Renovate security PRs at older versions, which is precisely why they conflicted. #2419 is a current open example.
Renovate can handle security updates itself via
vulnerabilityAlerts, and.renovaterc.jsondoes not configure it today. Roughly:vulnerabilityAlertsto cover security updates. One bot, one backlog.Either is fine; running both unconfigured is what produces conflicting PRs at different versions.
Renovate's automerge cannot fire
.renovaterc.jsonextends:automergeMinor:Branch protection on
mainrequires an approving review, and Renovate cannot approve its own PRs. So every minor update waits for a human anyway and the setting does nothing but suggest otherwise.Options:
:automergeMinor, so the config describes what actually happens.platformAutomerge, or allowing the Renovate app to satisfy the review requirement. Worth being deliberate: automerging minors into a published design system means unreviewed changes can reachdist.Why this is not part of #2391 item 6
Item 6 removes Gulp. This is repository configuration, not code, and #2391 closes when item 6 lands — at which point this would disappear along with it, having survived the entire modernization sequence unaddressed.
One practical note: #2421 added seven test packages and #2422 five more upgrades, so expect fresh churn from both bots regardless of which way this goes.
Related: #2391.