Dependency updates
Dependency updates keeps your dependencies current and fixes the vulnerable ones. Version updates arrive on your schedule. Security fixes arrive when a finding needs one, one pull request per package, and you decide whether they wait for your review or merge themselves when their checks pass.
In the console it is one page: Security › Fix › Dependency updates. Build & deploy › Dependency updates opens the same page.
Two lanes
| Lane | Driven by | What it opens |
|---|---|---|
| Security fixes | Your open dependency and container image findings | One pull request per vulnerable package, or per base image, at the lowest version that fixes every open advisory. Ordered known exploited first, then reachable, then by severity |
| Version updates | Your renovate.json and schedule | Hosted Renovate’s routine updates: grouping, automerge for patch and minor, approval for majors, private registries |
How each lane’s pull requests are merged, including the merge window and the release freeze, is on Merging. When a pull request does not appear, see Troubleshooting.
One bot
Both lanes open their pull requests as your organisation’s dependency bot, <org>-fremforge-bot-deps. fremforge creates it when you enable Version updates or make your first security fix request, keeps its token, rotates it, and removes it when neither lane needs it. It writes only to your organisation’s repositories.
AI fix for SAST findings is a separate feature with its own bot, <org>-fremforge-bot-autofix, and is not part of Dependency updates.
The page
The page has four parts:
- Security fixes: what the lane does now, and its settings: when fix pull requests are opened, whether they wait for review, how many may be open, the release age and which repositories it covers.
- Version updates: hosted Renovate’s policy, schedule, merge window, PR limits, the major updates waiting for your approval, the open dependency pull requests and private registries.
- Repositories: which repositories take part, and the per-repository opt-out.
- Activity: recent Renovate runs and recent security fix requests with their pull requests.
Security fixes without Version updates
Security fixes do not need Version updates. The first fix request, or saving an automatic mode, provisions the dependency bot with Version updates left off. Turning Version updates off keeps the bot while Security fixes are automatic, and removes it otherwise.
Who opens security pull requests
Hosted Renovate’s own vulnerability-alert pull requests still serve an organisation until the Security fixes lane takes over there. After the switch, Renovate opens version updates only and each fix is proposed once. For customers the switch is made on request for now. See Taking over from Renovate.
API
Everything on the page is in the API, under /_app/api/v1/orgs/{org}/dependency-updates, with the scopes dependency-updates:read and dependency-updates:write:
| What | Endpoint |
|---|---|
| Both lanes, enrolment and opt-outs | GET /orgs/{org}/dependency-updates |
| Security fixes settings | GET and PUT /orgs/{org}/dependency-updates/security-fixes/settings |
| Who opens security pull requests | GET and PUT /orgs/{org}/dependency-updates/security-fixes/lane |
| Security fix requests | GET and POST /orgs/{org}/dependency-updates/security-fixes/requests |
| Version updates settings | GET and PUT /orgs/{org}/dependency-updates/version-updates/settings |
| Runs, run now, enrol, disable, opt-outs, approve a major | /orgs/{org}/dependency-updates/runs, /run-now, /enrol, /disable, /repo-optout, /repo-optin, /approve-major |
The older names keep working until 2027-10-15: the scopes renovate:read and renovate:write are aliases of the new ones, and the deprecated paths are listed with their successors under Deprecated API.