Merging

Every dependency pull request either waits for a person to review and merge it, or is armed to merge itself once its required checks pass. Which one depends on the lane, the kind of update and your settings.

Security fixes: When fixes merge

Security › Fix › Dependency updates › Security fixes → When fixes merge (merge in the settings) has two values:

• Wait for review (review), the default. A person reviews and merges.
• Merge when checks pass (when_green). The pull request is armed to merge once its required checks pass.

With Merge when checks pass, fremforge arms a security fix pull request to merge once its required checks pass:

• Never for a fix that crosses a major version. That one always waits for review.
• Never during a release freeze.
• Outside your merge window only for a known-exploited fix.
• Never for a high-blast-radius package in an organisation that turned Merge when checks pass on itself.

High-blast-radius packages

About 30 auth, crypto, database, ORM and cloud KMS packages never merge a security fix by themselves in an organisation that turned Merge when checks pass on itself; those fixes wait for review. Organisations whose Renovate security pull requests merged themselves before 2026-10-14 were moved to Merge when checks pass with that behaviour kept: fixes for those packages merge too. The settings show this as high_blast_radius_exempt: true.

Wait for review

With Wait for review, nothing is armed. An auto-merge armed by fremforge or by the bot is cancelled; one a person armed on the pull request is left alone.

Hosted Renovate’s own security pull requests

The same setting decides hosted Renovate’s own security pull requests while they still serve the organisation (lane_owner: renovate): with Merge when checks pass they merge themselves on green CI, as the former Security updates auto-merge switch did. Every organisation that had that switch on, which was the default for every enrolled organisation, was moved to Merge when checks pass on 2026-10-14, so its Renovate security pull requests kept merging and nothing changed for it. New organisations start on Wait for review.

Organisations moved over on 2026-10-14

For an organisation moved to Merge when checks pass on 2026-10-14 (high_blast_radius_exempt: true), security fix pull requests opened from a finding, by a click or automatically, wait for review until its Security fixes take over from hosted Renovate’s own security pull requests. Until then the setting applies to those Renovate pull requests only, exactly as before. Taking over is a separate, audited switch (see Taking over from Renovate); from then on fix pull requests follow When fixes merge, under the rules above, as they replace Renovate’s.

An organisation that turns Merge when checks pass on itself gets it for fix pull requests at once, with the high-blast-radius packages left to review. Once the Security fixes lane takes over, Renovate opens version updates only.

Required approvals

A pull request armed by an organisation owner, or opened by a fremforge system bot such as <org>-fremforge-bot-deps, merges on green checks even on a repository that requires an approving review. So Merge when checks pass really does merge without a person on such repositories, as Renovate’s security pull requests have done until now. Choose Wait for review if every dependency change must be seen by a person.

Version updates

Routine updates follow hosted Renovate’s tiers:

• Patch, pin and digest updates auto-merge on green CI by default (automerge_patch).
• Minor updates auto-merge if you switch that on (automerge_minor).
• Major updates wait for your approval on the Dependency Dashboard (major_approval).
• About 30 high-blast-radius packages never auto-merge a routine update.

Rules in your renovate.json are applied after this policy. See Version updates.

Merge window

An owner can limit when dependency pull requests are armed to merge, as whole UTC hours on chosen weekdays (merge_window in Version updates settings). Outside the window nothing is armed, and arms the bot made are cancelled when the window closes; an arm a person made is left alone.

A security fix for a CVE that is exploited in the wild is armed outside the window, so it merges as soon as its checks pass. Only the window is skipped.

Release freeze

A repository with an open issue labelled release-freeze is frozen. Nothing is armed to merge in it, not even a known-exploited fix, and a lookup that fails counts as frozen. Pull requests are still opened, so the fix is ready when the freeze ends.