A fix PR is a pull request that updates a vulnerable dependency. A grouped PR bundles several updates. A gate is a check that must pass before merge. A canary releases to a small share first. A rollback returns to the previous build. Fuller definitions follow, with the trade offs.
Core terms
| Term | Plain definition |
|---|---|
| Fix PR | A pull request, usually opened by a tool, that changes a dependency to a version that fixes a known vulnerability |
| Version update | A PR that moves to a newer version with no security reason |
| Grouped PR | One PR containing several dependency updates, selected by rules such as type or package name |
| Required check | A status check that must pass before a PR can merge |
| Gate | A rule that blocks, warns or asks for approval, based on checks, policy or severity |
| Auto-merge | A setting that merges a PR automatically after required reviews and checks pass |
| Merge queue | A mechanism that tests PRs against the latest base branch before merging, one after another |
| Canary | A release to a subset of users or instances, to detect problems before a full rollout |
| Rollback | Redeploying a previous known good build |
| Revert | A new commit or PR that undoes an earlier change in the repository |
| Roll forward | Fixing a problem with a new change instead of returning to the old build |
| Blast radius | How much a failed change can affect |
| Exception | A recorded, time limited decision not to apply a fix |
Terms people confuse
Revert versus rollback. A revert changes the code in the repository. A rollback changes what runs in production. You may need both, and one does not do the other's job. GitHub's documentation describes reverting a pull request as creating a new pull request that reverts the original merge commit.
Auto-merge versus automerge. GitHub's auto-merge is a platform feature. Renovate has its own automerge setting and, by default, uses the platform's native automerge where available. The words look alike, so read which one a document means.
Grouped versus batched. Grouping uses rules to combine updates in one PR. Batching in conversation often means "we merge them all on Friday", which is a schedule, not a grouping.
Canary versus staging. Staging is a separate environment. A canary is part of production. A staging pass does not replace a canary.
Why the terms matter
Teams argue past each other when words mean different things. A policy that says "automate fixes" without defining which category, which checks and which rollback is hard to review. Write definitions in your policy once, then use them consistently. See how to write a dependency update policy a small team can keep.
Terms for the safety side
- Evidence. What a PR shows to justify itself: the advisory, the version change, the test results. See evidence attached fix PRs reviewers trust.
- Human in the loop. A person approves before the change goes live.
- Off by default. A feature that must be switched on deliberately, so a new installation does nothing until someone decides.
- Manual category. A kind of change that always needs a person, such as major version jumps.
Using the glossary
Pick the terms your team will use and add them to your onboarding page. Linking a definition from every policy page reduces confusion. If your team uses different words, keep the same distinctions.
Safeguard can open fix pull requests through autonomous remediation. It is off by default and every category starts on Manual, so a person approves each change. You can also run a free scan to see which dependencies have known fixes before you decide what to automate.
Quick check
Is a fix PR different from a pull request that bumps a version?
A fix PR has a security reason, tied to an advisory. A version update PR does not need one. Many tools treat them separately.
Does a canary replace a rollback plan?
No. A canary limits the damage. You still need a way to return to the previous build.
Sources
- GitHub Docs: Reverting a pull request
- GitHub Docs: Automatically merging a pull request
- Renovate Docs: Automerge configuration and troubleshooting
Last reviewed: 19 October 2026.
