Dependency Auditing and Automated Updates

Dependencies rot: a lockfile that was clean at release accrues known vulnerabilities and drifts behind upstream within weeks. This guide covers auditing the installed graph and automating safe updates with Renovate or Dependabot, and it extends the Core JavaScript Package Workflows section with the maintenance loop that keeps a shipped package secure.

Concept overview and where it fits

Two disciplines keep dependencies healthy. Auditing answers 'what is wrong right now' — which installed versions carry known advisories — and automated updates answer 'how do we stay current' by opening reviewable pull requests as new versions ship. They meet at the lockfile: audits read it to find vulnerable resolutions, and update bots rewrite it. Auditing thresholds in CI are covered in Enforcing npm audit Thresholds in CI; this guide focuses on the update side and how the two combine.

Auditing and automated updates meet at the lockfile in a continuous loop.

Initialization: baseline audit and policy

Establish a baseline audit and a policy for what blocks. npm audit reads the lockfile, resolves each package against the advisory database, and reports severities.

Initialization: baseline audit and policy — the core idea of this section at a glance.

# Machine-readable audit for CI gating
npm audit --audit-level=high --json > audit.json
# Fail the job only on high/critical, not on every low advisory
npm audit --audit-level=high

Gate on high and above so the signal stays actionable, and route lower-severity findings to the update bot rather than blocking every build.

Architecture: how an update bot works

An update bot models your manifest and lockfile as the source of truth, checks upstream for newer versions that satisfy (or safely widen) your ranges, and opens a branch that regenerates the lockfile. Because a regenerated lockfile is unreviewable by eye, the bot's job is to make each update a small, testable pull request that CI validates — the same 'route lockfile changes through dedicated PRs' discipline from Lockfile Management Strategies.

Architecture: how an update bot works — the core idea of this section at a glance.

Execution strategy: grouping and scheduling

Configure the bot to group related updates so reviewers see intent, not noise. Grouping all non-major updates into one weekly PR, and isolating majors for individual review, is the pattern most teams converge on.

Batch the safe updates; isolate the risky ones.

// renovate.json
{
  "extends": ["config:recommended"],
  "schedule": ["before 6am on monday"],
  "packageRules": [
    { "matchUpdateTypes": ["minor", "patch"], "groupName": "non-major" },
    { "matchUpdateTypes": ["major"], "dependencyDashboardApproval": true }
  ],
  "vulnerabilityAlerts": { "labels": ["security"] }
}

Security and isolation

Automated updates are themselves a supply-chain surface: a bot that merges without review can pull in a compromised release. Require CI to pass and a human to approve, pin the bot's own action to a digest, and keep security updates on a fast lane while feature bumps wait for the weekly batch. Combine with the defenses in Supply-Chain Security Hardening so an auto-update cannot bypass audit thresholds or lockfile-lint.

An auto-update must clear CI and a human before it can ship.

CI/CD integration

Wire the audit into CI as a gate and let the bot handle remediation PRs:

CI/CD integration — the core idea of this section at a glance.

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - run: pnpm audit --audit-level=high
      - run: pnpm exec lockfile-lint --path pnpm-lock.yaml --allowed-hosts npm

Common Pitfalls and Remediation

Mistake	Impact	Remediation
`npm audit fix --force` in CI	Silent major bumps and broken builds	Never `--force`; review majors in isolated PRs.
Ungrouped update PRs	Reviewer fatigue, PRs ignored	Group non-major updates; isolate majors.
Auto-merging without CI	A bad release ships unreviewed	Require passing CI plus human approval to merge.
Auditing without a threshold	Every low advisory blocks builds	Gate on `high`; route lower severities to the bot.

Common Pitfalls and Remediation — the core idea of this section at a glance.

Frequently Asked Questions

Renovate or Dependabot — which should I use?

Dependabot is built into GitHub with zero setup and good defaults; Renovate is far more configurable (grouping, schedules, monorepo-aware presets). Small repos do well on Dependabot; large monorepos usually prefer Renovate.

Should update PRs auto-merge?

Only patch/minor updates, and only after CI passes — never majors, and never without the tests that would catch a regression. Security updates can auto-merge on a fast lane if your test suite is trustworthy.

How do I stop npm audit from blocking on unfixable advisories?

Set an --audit-level threshold so only high/critical block, and use overrides to pin a patched transitive version when the direct dependency has not yet released a fix.

Why group dependency updates?

Ungrouped bots open dozens of PRs a week that reviewers ignore. Grouping non-major updates into one batch keeps the signal reviewable while still isolating risky majors.

Enforcing npm audit Thresholds in CI — the CI gate that turns audit results into a pass/fail.
Supply-Chain Security Hardening — the broader defenses automated updates must not bypass.
Lockfile Management Strategies — routing every lockfile change through a reviewable PR.
Dependency Resolution Explained — how ranges and overrides decide which versions an update can pick.

← Core JavaScript Package Workflows