Merge urgent security fixes as soon as they are reviewed and green, and merge routine updates in a fixed weekly window. The window gives reviewers a predictable slot and gives operators a known time to watch the deploy. Do not let the window delay a fix that is under active attack.
The two failure modes
Merging every bot PR the moment it appears fills the week with small interruptions and releases at random times. Merging nothing until "someone has time" lets PRs age and conflict. A window sits between them.
How the tools let you set a window
Dependabot's schedule setting takes an interval of daily, weekly, monthly, quarterly, semiannually, yearly or cron. GitHub's guide notes that Dependabot by default balances its workload by assigning a random time to check and raise PRs, and that you can set the day, time and timezone, for example weekly on Tuesday at a chosen hour, so PRs are raised before your triage session. The default timezone is UTC.
Renovate has its own schedule option and a timezone option, and its automerge guide notes that automerges take time because the PR must be current with the base branch. If you schedule merges, leave room for that delay.
The schedule controls when PRs are raised or merged, not whether a security update exists. Check how your tool treats security updates against the schedule, since urgency should override it.
A simple pattern
| Kind of change | When it merges |
|---|---|
| Emergency security fix | As soon as reviewed and checks pass, any day |
| Normal security fix | Next review slot, within the target for its lane |
| Routine version updates | Weekly window, early in the week |
| Major version updates | Planned work, with its own ticket |
Why early in the week
If something breaks, you want working hours ahead of you, not a weekend. Many teams avoid merging routine updates on Friday afternoon for that reason. The exact day is your call: pick one that leaves a full day or two of normal staffing after the deploy. See pause dependency updates before a release freeze and fix PR freeze windows, release freezes and holidays for calendars that should override the window.
Make the window real
- Put it on the calendar. A recurring thirty minute slot for the people who review bot PRs.
- Set the bot to raise PRs before the slot. Use the schedule so the list is fresh.
- Cap the volume. Dependabot defaults to five open version update PRs, and Renovate has concurrent and hourly limits, so a window does not turn into a flood. See how many open dependency update PRs should you allow.
- Watch after each merge. See what to watch after merging a dependency fix.
When to break the window
Break it for an advisory with known exploitation in code you run, or for a fix that unblocks a customer commitment. When you break it, record why, and do not make the exception the norm. See emergency patch vs routine patch criteria.
Review the pattern
After a month, ask whether PRs are waiting too long, whether the window is too crowded, and whether any merge in the window caused trouble. Adjust the day, the cap or the grouping. A schedule is a tool, and it should fit the team that uses it.
Try it yourself
Open the demo and look at findings that already have a fixed version. These are the items that would be waiting for your next merge window.
Click through it at your own pace, or open it full screen.
Safeguard can open fix pull requests through autonomous remediation. It is off by default and every category starts on Manual, so a person approves each change. You can also run a free scan to see which dependencies have known fixes before you decide what to automate.
Quick check
Does a weekly window slow security fixes?
Only if you let it. Security fixes follow their own lane, with approval targets by urgency.
What timezone does Dependabot use?
GitHub's documentation says the default is UTC, and you can set a timezone from the tz database in the schedule.
Sources
- GitHub Docs: Optimizing the creation of pull requests for Dependabot version updates
- GitHub Docs: Dependabot options reference
- Renovate Docs: Automerge configuration and troubleshooting
- Renovate Docs: Configuration options
Last reviewed: 19 October 2026.
