Plumb

Dependabot or Renovate configured

Checks whether an automated dependency update tool is set up and covers every package ecosystem the repository actually uses.
category
security
weight
5

How Plumb checks this

What is inspected, and how the result is decided.

Most vulnerabilities reach a project through its dependencies rather than its own code. Automated update tools such as Dependabot and Renovate open pull requests as new versions appear, so fixes arrive without anyone having to remember to look. A tool that is installed but skips an ecosystem in use leaves that part of the project unpatched.

Plumb looks for a Renovate configuration (renovate.json, renovate.json5, the .github/ or .gitlab/ variants, or a renovate key in package.json) or a Dependabot configuration at .github/dependabot.yml. It then works out which ecosystems the repository maintains: Composer when a composer.lock is committed, GitHub Actions when workflow files exist, and JavaScript when an npm, yarn, pnpm, or bun lockfile is committed. For Dependabot, coverage comes from the package-ecosystem entries. For Renovate, coverage follows enabledManagers; when that setting is absent Renovate covers everything by default.

The check passes when a tool is configured and covers every ecosystem in use. It is not applicable when the repository has no committed lockfiles and no workflows, because there is nothing for an updater to maintain. It fails when no tool is configured, or when the tool covers none of the ecosystems in use. It warns when some ecosystems are missed: a missing Composer manager is the most serious gap and leaves the least credit, while a missing GitHub Actions or JavaScript manager leaves most of the credit.

Doing it well

Why this matters

Most of the code in a modern PHP project is not written by its maintainers. It comes from dependencies, and those dependencies get security fixes on their own schedule. Someone has to notice each new release and bring it in. Doing that by hand means it happens rarely, and vulnerabilities sit in the project for months.

An update bot such as Dependabot or Renovate watches your dependencies and opens a pull request for each new version. Reviewing and merging a pull request is a small, regular task. Catching up on two years of missed updates is not.

What good looks like

  • An update bot is configured in the repository.
  • The bot covers every ecosystem the repository actually uses: Composer, GitHub Actions if you have workflows, and npm, yarn, pnpm, or bun if you have a JavaScript lockfile.
  • Its pull requests are reviewed and merged in a reasonable time.

How to do it

Dependabot (GitHub)

Create .github/dependabot.yml with one entry per ecosystem:

version: 2
updates:
  - package-ecosystem: composer
    directory: /
    schedule:
      interval: weekly

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly

  # Only if you have a package-lock.json, yarn.lock, or pnpm-lock.yaml.
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly

Dependabot is built into GitHub. Committing this file is all it takes.

Renovate (GitHub, GitLab, and others)

Install the Renovate app on GitHub, or set up the Renovate runner on GitLab, then add a renovate.json to the repository root:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"]
}

Renovate enables every manager it knows about by default, including Composer, GitHub Actions, and npm. If you restrict it with enabledManagers, make sure the list includes every ecosystem you use:

{
  "extends": ["config:recommended"],
  "enabledManagers": ["composer", "github-actions", "npm"]
}

Which one?

Both work well. Dependabot needs no installation on GitHub and has a small configuration surface. Renovate runs on more platforms, can group related updates into one pull request, and offers finer control. Pick one; running both creates duplicate pull requests.

Things to watch for

  • Configuring only Composer. If the repository has workflow files, GitHub Actions is an ecosystem too, and action releases carry security fixes. The same goes for JavaScript lockfiles.
  • A library with no lockfile. Libraries often do not commit composer.lock, which is fine. In that case there is nothing for the bot to update for Composer, and only the other ecosystems need coverage.
  • Renovate's enabledManagers missing an ecosystem. This setting is an allow list. Anything not listed is silently ignored.
  • Turning the bot on and ignoring it. Open pull requests that nobody merges do not fix anything. Set a routine for reviewing them.

Further reading