Automerge patch updates to development tooling when unit tests, visual checks and a dependency scan all pass. Keep runtime UI dependencies, host library bumps and every major version under human review. The line is drawn by what ships to users and how well your tests cover it.
Start from what your tests can prove
Automerge is a statement of trust in your pipeline. If a visual test suite covers your components and a scan runs on each pull request, a green result carries real weight. If coverage is thin, automerge just moves risk around.
Both major update tools let you set rules by update type and package group. Dependabot offers grouping and a cooldown option for version updates, and the documentation notes the cooldown does not apply to security updates. Renovate offers a minimum release age setting and package rules; its documentation shows the vulnerability alert preset with no release age delay. Read each tool's current pages before copying a configuration.
A policy table
| Update | Dev tooling only | Runtime UI dependency | Host library or design system |
|---|---|---|---|
| Patch | Automerge if checks pass | Automerge only with visual and unit coverage | Review |
| Minor | Automerge for low risk tools, else review | Review | Review |
| Major | Review | Review with a migration plan | Plan as a project |
| Security fix | Merge fast after checks | Fast lane, see below | Fast lane |
Conditions to require before any automerge
- Required status checks pass: build, unit tests, interaction tests.
- Visual regression passes with no baseline change. A baseline change always needs a person, as in when to accept a visual diff.
- The dependency scan shows no new vulnerable packages.
- The package has been published for a few days, using a cooldown or release age setting, so a bad release can be pulled first. See Dependabot cooldown: delay new releases.
- The change touches only manifests and the lockfile.
Security fixes are different
You usually want a security patch in quickly, so do not let a delay setting stall it. Keep the same checks, and let the fix skip waiting for a calendar slot. The reasoning is in should a security dependency fix wait for the next release train.
Guard against noise and fatigue
Cap the number of open update pull requests and group related packages, so reviewers see a handful of meaningful changes. See how to group dependency updates without hiding risk. Review the automerge list every quarter and remove packages that caused trouble.
Try it yourself
Click through it at your own pace, or open it full screen. Check which conditions must pass before a pull request can merge.
Safeguard policies can act as one of those gates, blocking a merge when an update introduces a vulnerable dependency. A free scan is available at gold.safeguard.sh/scan.
Quick check
Is automerging patch versions always safe?
No. Patch releases can still break behavior. Safety depends on your test coverage and release age rules.
Should a security update wait out the cooldown?
Dependabot's documentation says cooldown applies to version updates, not security updates. Decide the same for your own rules and say so in policy.
Sources
Last reviewed: 19 October 2026.
