Pause routine version updates during a release freeze, and keep a defined path for security fixes. Unplanned dependency changes in the last days before a release add risk with no benefit to the release, but a known exploitable flaw should still be fixable.
Why pause routine updates
A freeze exists to limit change. A new library version is a change, even when small. A bot that keeps opening and merging pull requests undermines the freeze and makes the final test results less meaningful, since the code under test keeps moving.
What to keep open
Security fixes need an exception path. Decide in advance how a fix gets approved during a freeze, who signs off, and what extra testing is required. Without a path, people either skip the fix or bypass the freeze informally. Both leave poor records.
How to pause with your bot
Common bots offer several levers. The documentation of one hosted bot says that setting its open pull request limit to zero temporarily disables version updates for that package manager. Others offer schedules or per-rule switches. Check which lever your tool uses, and note that a limit of zero in the documented case concerns version updates, while security updates have their own fixed limit.
Steps
- Announce freeze dates and the dependency policy for them.
- Switch off or limit version updates for the repositories involved.
- Disable auto-merge for the period, if you use it.
- Keep security alerts on. Triage them by exploitability and reachability.
- If a security fix must land, make it a single change, test it, and record who approved it.
- After the release, re-enable the bot. Expect a burst of pull requests and use grouping and limits to manage it.
Table
| Item | During freeze | After |
|---|---|---|
| Version updates | Paused | Resume, expect a burst |
| Security alerts | On | On |
| Auto-merge | Off | Back on if used |
| Lockfile changes | Only for approved fixes | Normal |
A caution
Do not leave the pause on. A freeze that quietly becomes a month long turns into update debt. Put the resume date in the same ticket as the pause, and check it.
Record the freeze and the exceptions. An auditor or a customer asking how you control change will find a clear record more convincing than a verbal account.
Try it yourself
Click through it at your own pace, or open it full screen. Note how findings are prioritized. During a freeze, the same prioritization decides which advisory earns an exception.
Quick check
Can we merge a security fix during a freeze?
Yes, if you have an agreed exception path with approval, testing and a record.
How long should an update pause last?
As short as the freeze itself. Put a resume date in the ticket and verify it happens.
Safeguard scans manifests and lockfiles into an SBOM, uses reachability analysis to show which flagged dependencies your code actually calls, and can open fix pull requests (off by default, every category on Manual). You can try a free scan on a public repository.
Sources
Last reviewed: 19 October 2026.
