Only for a narrow class of updates, and only if your tests would actually catch a bad one. Patch updates with passing required checks are a reasonable candidate. Major versions and anything in a build or deploy path should still get a human review.
What auto-merge does
GitHub documents two routes. One is a workflow that reads the update type for a Dependabot pull request and merges it when it matches your rule, for example a patch release for a named dependency. The other is GitHub's native auto-merge, which merges a pull request once the branch protection rules, meaning required tests and approvals, are satisfied.
The guardrail that matters most
The documentation says to enable required status checks on the target branch so a pull request cannot merge unless every required check passes. Without that, auto-merge is just merge. Your tests are the real reviewer, so they must be good enough to trust.
A reasonable first rule
- Patch updates only, at first.
- Direct dependencies with decent test coverage.
- Required checks must pass, including your security scan.
- No auto-merge for major versions, build tools, or CI actions.
Why it is not risk free
A malicious or broken release can pass your tests, since tests rarely check for credential theft. Auto-merge shortens the time between a bad release and your production. A delay on new releases, sometimes called a cooldown, gives the community time to spot problems before you take them.
Permissions and tokens
The documented example workflow needs write access for contents and pull requests. Give it only that, keep it to Dependabot pull requests, and keep secrets out of reach. If you use a merge queue, the default workflow token cannot add pull requests to it, so you need another token with merge permission.
Measure it
After a month, count how many auto-merged updates were reverted. If the answer is none, widen the rule slowly. If it is more than a couple, tighten it or fix the tests.
Quick check
Is it safe to auto-merge major version updates?
Usually not. Major versions often change behaviour and deserve a review and a test run you understand.
Do I need branch protection for auto-merge?
Yes, at least required status checks, so a failing test blocks the merge.
Sources
Last reviewed: 19 October 2026.
