Plumb

Renovate MR responsiveness

Checks how long the oldest open Renovate merge requests have been waiting, with a shorter allowance for security fixes.
category
security
weight
7
applies to
GitLab repositories only

How Plumb checks this

What is inspected, and how the result is decided.

An automated update tool only helps if its merge requests get reviewed and merged. Renovate merge requests left open for months mean fixes are known but not shipped, and the gap keeps growing as more releases pile up. Security fixes are the urgent case, because they address a published vulnerability.

Plumb lists the project's open merge requests and keeps the ones that come from Renovate: the source branch starts with renovate/, or the author's username contains renovate. These are mechanical markers, not a judgement about the account. Each merge request is then sorted into two groups. One whose description mentions a CVE or GHSA identifier is a security update. Everything else is a general update. For each group only the oldest open merge request matters.

Security updates pass when the oldest is 14 days old or less, earn 70 percent credit up to 30 days, 30 percent credit up to 90 days, and fail beyond 90 days. General updates pass up to 30 days, earn 70 percent credit up to 60 days, 30 percent credit up to 180 days, and fail beyond 180 days. The final result is whichever group scored worse. A project with no open Renovate merge requests passes. The check only runs for repositories hosted on GitLab.

Doing it well

Why this matters

Renovate only helps if its merge requests get merged. Each open merge request is a fix or an improvement that exists but has not shipped. Left alone they pile up, the dependency drifts further from current, and the eventual catch-up becomes a bigger, riskier change. Merge requests that reference a security advisory are the urgent ones: while they wait, every user of the package is exposed to a published vulnerability.

What good looks like

  • Security update merge requests are merged within two weeks.
  • Regular version bumps are merged within a month.
  • The list of open Renovate merge requests is short and recent.

How to do it

Make a routine

Pick a regular moment, weekly works for most projects, to go through open Renovate merge requests. Merge the ones with a passing pipeline. Look into the ones that fail.

Let the pipeline do the checking

A good test suite turns each merge request into a yes or no. If a dependency bump passes the pipeline, merging it is low risk. Investing in tests pays back every week in faster reviews.

Group related updates

Renovate can combine updates so you review one merge request instead of many:

{
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "matchDepTypes": ["require-dev"],
      "groupName": "dev dependencies (non-major)"
    }
  ]
}

The group:allNonMajor preset does the same for every non-major update.

Auto-merge the safe ones

Renovate can merge minor and patch updates itself once the pipeline passes:

{
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}

Use the dependency dashboard

Renovate can maintain a "Dependency Dashboard" issue that lists every pending update, including ones it has not opened a merge request for yet. It gives you one place to see what is waiting and to trigger or dismiss updates.

Close what you will not merge

If an update cannot be merged, close the merge request and add an ignoreDeps entry or a packageRules entry so Renovate stops re-proposing it. An open merge request that will never be merged is noise that hides the ones that matter.

Things to watch for

  • Security merge requests waiting behind ordinary ones. Renovate marks vulnerability fixes in the merge request description. Do those first.
  • A failing pipeline nobody investigates. A red pipeline means the update needs a code change on your side. That is worth knowing early.
  • Concurrency limits. prConcurrentLimit caps how many merge requests stay open. If old ones linger, new updates wait behind them.
  • Renaming the bot. Self-hosted Renovate can run under any account name. Keep renovate in the bot's username, or keep the default renovate/ branch prefix, so tooling can recognize its merge requests.

Further reading