Apply security fixes for exploited or reachable vulnerabilities as soon as you can test them, and batch routine version updates weekly or monthly. A steady cadence beats occasional large upgrades, because small jumps break less and are easier to review. Set the schedule once in your update tool.
Two kinds of updates
Security updates respond to a known vulnerability. Version updates keep you current. They deserve different clocks. Treat a security update on code you actually call as urgent, and treat a version bump as routine maintenance.
A cadence that works
| Type | Cadence | Notes |
|---|---|---|
| Exploited or reachable vulnerability | Within days | Test, then ship |
| Other security updates | Within a few weeks | Group with routine work |
| Version updates, active projects | Weekly or monthly batch | Pick one and keep it |
| Version updates, quiet projects | Monthly or quarterly | Less to gain |
| Base images and runtimes | Monthly | Easy to forget |
What the update tools let you set
GitHub's Dependabot reference lists the schedule interval options as daily, weekly, monthly, quarterly, semiannually, yearly or a cron expression. Monthly or weekly suits most small teams. It also documents a cooldown option, which delays version updates for a number of days after a release. The documentation says cooldown applies to version updates, not security updates, so security fixes still arrive immediately.
A cooldown is a deliberate delay. A newly published version could be a bad release or a compromised one, and waiting a few days gives the community time to notice. Choose a short delay and keep security updates outside it.
The same documentation says that by default, if five version update pull requests are open, no further ones are raised until some are merged or closed, and security update pull requests have a separate limit of ten. Use the limit to keep the review queue small. See reducing dependabot noise for grouping tactics.
Make updates reviewable
- Group related updates into one pull request when your tool allows it.
- Require your tests to pass before merge.
- Read the changelog for major versions.
- Merge on a fixed weekday so it becomes routine.
When to pause
Freeze updates during a release crunch, but keep the exploited path open. If you pause for more than a month, add a calendar reminder to catch up, because the debt compounds. Large jumps across many major versions are where updates really hurt.
Pin, then move deliberately
Your lockfile pins exact versions, so updates only happen when you choose. That is a feature. The npm documentation for npm ci explains that it installs from the lockfile and errors if it disagrees with package.json, which keeps CI from drifting to unreviewed versions. Updating is then a visible pull request, not a silent change.
Measure it
Track the age of your oldest outdated dependency and the share of updates merged within your target window. Both are simple and show whether the cadence holds.
Safeguard fix pull requests are off by default and every category starts on Manual, so you choose when automation helps. A free scan is at https://gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Should we auto merge update pull requests?
Only for low risk updates with strong test coverage. Keep manual review for major versions and for anything on a sensitive path.
Does a cooldown slow down security fixes?
Not in the documentation for Dependabot. It says cooldown applies to version updates, not security updates.
Sources
Last reviewed: 19 October 2026.
