The Dependency Dashboard is a single issue Renovate keeps in your repository, listing the state of dependency updates. It also supports an approval workflow, so updates wait for a person to tick a box before Renovate opens a pull request. It is one of the best tools for taming update noise.
What it is
The Renovate documentation describes it as an overview of a repository's dependency update status. When enabled, Renovate creates an issue that serves as the dashboard. The host platform must support issues with dynamic Markdown checkboxes.
How to turn it on
Add the preset to your config.
{
"extends": ["schedule:automergeDaily", ":dependencyDashboard"]
}
Or set "dependencyDashboard": true in the configuration file.
What it gives you
Deprecated dependency warnings. The docs say deprecated packages are flagged near the top of the dashboard, including abandonment detection through the abandonments recommended preset.
Visibility of rejected and deferred updates. Updates you closed or ignored are listed, and you can ask Renovate to re-create one with a checkbox. Without the dashboard, a closed pull request just disappears.
An approval workflow. You can require approval for all updates, for major updates only, or for specific packages.
Using approval well
A reasonable pattern for a busy repository:
- Let patch and minor updates flow, perhaps grouped, and automerge only those you would merge anyway.
- Require approval for major updates, so a person decides when a migration is worth doing.
- Require approval for packages with a history of breakage, or for core runtime libraries.
Approval trades speed for control. If nobody reads the dashboard, approval-gated updates simply never happen, and that is how repositories quietly fall behind. Assign an owner and a weekly time to look.
A weekly dashboard review
- Read the deprecation warnings first. A deprecated or abandoned package is a plan, not a pull request.
- Scan the pending approvals and pick a few.
- Check the deferred list for security related updates that were ignored.
- Note anything that has waited a long time, and decide to do it or to document why not.
What it will not do
The dashboard shows update status. It does not tell you whether a given vulnerability is reachable in your code or whether an update is safe. Treat it as a queue, then apply judgment and tests.
Click through it at your own pace, or open it full screen.
Safeguard's dependency scanning adds the security view of the same queue, showing which pending updates fix known vulnerabilities. A free scan is at gold.safeguard.sh/scan. For another take on bot noise, see Dependabot noise reduction techniques.
Quick check
Does the dashboard need special permissions?
It needs a host platform that supports issues with dynamic Markdown checkboxes. Check your platform's support.
Can it require approval only for major updates?
Yes. The documentation lists approval for all updates, for major updates only, or for specific packages.
Sources
Last reviewed: 19 October 2026.
