Dependency updates

Vortex provides Renovate configuration for your project's automated dependency updates.

How updates are organized

All Renovate PRs use the branch prefix deps/ and are labeled Dependencies. Assignees can be configured in the assignees field.

Update rules

Group	Packages	Update types	Schedule
Drupal core	drupal/core-recommended, drupal/core-composer-scaffold, and other drupal/core-* packages	Minor, patch	Daily before 2 AM UTC
Drupal contrib and PHP packages (non-core)	All Drupal contrib modules and non-Drupal Packagist packages	Minor, patch	Weekly, Sunday before 2 AM UTC
JS packages	All npm packages (root package.json only)	Minor, patch	Weekly, Sunday before 2 AM UTC
Container images	All images in .docker/ and docker-compose.yml	Major, minor, patch	Daily before 3 AM UTC
CI tools	npm packages that CI runs at a pinned version through npx	Major, minor, patch	Daily before 3 AM UTC
GitHub Actions	All actions (pinned to digests)	Major, minor, patch	Daily before 3 AM UTC

Auto-merge

Every group auto-merges by default: GitHub merges the PR as soon as it meets the base branch's protection rules, such as passing required status checks and any required reviews. Each group in renovate.json lists an explicit automerge flag, so you can see and change the behavior per group. To merge a group's PRs yourself, set its flag to false:

{
    "groupName": "PHP - Drupal core - Minor and patch",
    "groupSlug": "php-drupal-core-minor-patch",
    ...
    "automerge": false
}

The installer asks which groups to auto-merge and sets the flag to true for the groups you select and to false for the rest. When you update Vortex, it preselects the groups whose flag is already true, so your choices carry over.

Auto-merge requires 2 repository settings:

1. "Allow auto-merge" enabled under Settings > General > Pull Requests.
2. "Require status checks to pass before merging" configured in the base branch's branch protection rules, with at least one required status check selected. Otherwise, GitHub may merge even if CI is red.

Every required status check must also report on deps/* branches. A check that never reports, such as a CircleCI job that a branch filter excludes from deps/* branches, keeps the PR blocked indefinitely. A GitHub Actions job skipped by its if condition reports as skipped, which satisfies the requirement.

Configuration

The configuration is stored in renovate.json. It's based on the Renovate configuration for automated Drupal dependency updates project.

PR throughput and presentation

• Concurrent PR limit: prConcurrentLimit: 10 - at most 10 open PRs across all groups at any time.
• Hourly PR limit: prHourlyLimit: 0 - no hourly cap; the per-group schedules listed earlier provide throttling.
• Commit body table: commitBodyTable: true - grouped update commits include a version-comparison table in the commit message body.
• Dashboard labels: the Renovate dependency dashboard issue is labeled Dependencies (dependencyDashboardLabels).

Disabled updates

These are intentionally skipped by Renovate - update them manually:

Group	What's skipped	Why
Drupal core major	drupal/core-recommended, drupal/core-composer-scaffold, and other drupal/core-* packages	Major version upgrades may introduce breaking changes
PHP and Drupal contrib major	All Drupal contrib modules and non-Drupal Packagist packages	Major version upgrades may introduce breaking changes
JS major	All npm packages	Major version upgrades may introduce breaking changes
PHP language version	php constraint in composer.json	Major version upgrades may introduce breaking changes
JS language versions	node, npm in package.json	Major version upgrades may introduce breaking changes
JS non-root packages	Any package.json not at the root	Theme dependencies are managed separately

Continuous integration

Renovate can run as a hosted GitHub app or as a standalone self-hosted service in CircleCI or GitHub Actions. A self-hosted service suits projects that restrict third-party access to their repositories.

note

If the job is configured but a required variable isn't provided, the job still runs and the Renovate update steps are skipped gracefully without failing the build. On GitHub Actions the required variables are RENOVATE_TOKEN and RENOVATE_GIT_AUTHOR; CircleCI additionally requires RENOVATE_REPOSITORIES, since it has no repository to default to.

Setting up the self-hosted service

GitHub Actions

Required variables, created in the GitHub repository settings:

• RENOVATE_TOKEN: GitHub access token with repository write permissions. Location: Settings > Secrets and variables > Actions > Repository secrets.
• RENOVATE_GIT_AUTHOR: Author for Renovate commits in the format Name <email@example.com> (for example, Renovate Bot <renovate@example.com>). Location: Settings > Secrets and variables > Actions > Repository variables.

Optional variables (defaults apply if not set):

• RENOVATE_REPOSITORIES: Repository to run Renovate on in the format yourorg/repo (default: the current repository).
• RENOVATE_DRY_RUN: Set to true to test runs without making changes (default: false).
• RENOVATE_DEPENDENCY_DASHBOARD: Set to true to enable the dependency dashboard (default: false).

Manual trigger: run the workflow from the Actions tab using the workflow dispatch feature.

Debug logging: set the LOG_LEVEL environment variable to debug in the workflow configuration.

CircleCI

Required variables, created in the CircleCI project settings:

• RENOVATE_TOKEN: GitHub access token with repository write permissions.
• RENOVATE_REPOSITORIES: Repository to run Renovate on in the format yourorg/repo.
• RENOVATE_GIT_AUTHOR: Author for Renovate commits in the format Name <email@example.com> (for example, Renovate Bot <renovate@example.com>).

Optional variables (defaults apply if not set):

• RENOVATE_DRY_RUN: Set to true to test runs without making changes (default: false).
• RENOVATE_DEPENDENCY_DASHBOARD: Set to true to enable the dependency dashboard (default: false).

Manual trigger: trigger the Renovate job from the CircleCI pipeline UI.

Scheduled trigger: add an update-dependencies scheduled trigger under Project Settings → Triggers with config source update-dependencies.yml and branch develop.

Debug logging: enabled by default with LOG_LEVEL: 'debug'.

Triggering GitHub Actions from the self-hosted service isn't supported.

Dependency dashboard

The Renovate Dependency Dashboard is a GitHub issue that provides visibility into:

• Available dependency updates that are scheduled for later execution
• Updates that have been filtered out due to configuration rules
• Failed update attempts and their reasons

The dashboard is created with the title "RenovateBot Dependency Dashboard (self-hosted)" when running in self-hosted mode. This dashboard is particularly useful for understanding why certain updates might not be applied immediately due to scheduling constraints or configuration rules.