Dependency updates

Vortex provides Renovate configuration for your project's automated dependency updates.

How updates are organized

All Renovate PRs use the branch prefix deps/ and are labeled Dependencies. Assignees can be configured in the assignees field.

Update rules

Group	Packages	Update types	Schedule
Drupal core	drupal/core-recommended, drupal/core-composer-scaffold and other drupal/core-* packages	Minor, patch	Daily before 2 AM UTC
Drupal contrib and PHP packages (non-core)	All Drupal contrib modules and non-Drupal Packagist packages	Minor, patch	Weekly, Sunday before 2 AM UTC
JS packages	All npm packages (root package.json only)	Minor, patch	Weekly, Sunday before 2 AM UTC
Container images	All images in .docker/ and docker-compose.yml	Major, minor, patch	Daily before 3 AM UTC
GitHub Actions	All actions (pinned to digests)	Major, minor, patch	Daily before 3 AM UTC

Updates in the GitHub Actions group are auto-merged after CI passes. This requires two repository settings:

1. "Allow auto-merge" enabled under Settings > General > Pull Requests.
2. "Require status checks to pass before merging" configured in the base branch's branch protection rules, with at least one required status check selected - otherwise GitHub may merge even if CI is red.

All other groups open PRs for manual review.

Configuration

The configuration is stored in renovate.json. It is based on Renovate configuration for automated Drupal dependency updates project.

PR throughput and presentation

• Concurrent PR limit: prConcurrentLimit: 10 - at most 10 open PRs across all groups at any time.
• Hourly PR limit: prHourlyLimit: 0 - no hourly cap; the per-group schedules above provide throttling.
• Commit body table: commitBodyTable: true - grouped update commits include a version-comparison table in the commit message body.
• Dashboard labels: the Renovate dependency dashboard issue is labeled Dependencies (dependencyDashboardLabels).

Disabled updates

These are intentionally skipped by Renovate - update them manually:

Group	What is skipped	Why
Drupal core major	drupal/core-recommended, drupal/core-composer-scaffold and other drupal/core-* packages	Major version upgrades may introduce breaking changes
PHP and Drupal contrib major	All Drupal contrib modules and non-Drupal Packagist packages	Major version upgrades may introduce breaking changes
JS major	All npm packages	Major version upgrades may introduce breaking changes
PHP language version	php constraint in composer.json	Major version upgrades may introduce breaking changes
JS language versions	node, npm in package.json	Major version upgrades may introduce breaking changes
JS non-root packages	Any package.json not at the root	Theme dependencies are managed separately

Continuous integration

Renovate can run as a hosted GitHub app or as a standalone self-hosted service in CircleCI or GitHub Actions. A self-hosted service suits projects that restrict third-party access to their repositories.

note

If the job is configured but a required variable is not provided, the job still runs and the Renovate update steps are skipped gracefully without failing the build. On GitHub Actions the required variables are RENOVATE_TOKEN and RENOVATE_GIT_AUTHOR; CircleCI additionally requires RENOVATE_REPOSITORIES, since it has no repository to default to.

Setting up the self-hosted service

GitHub Actions

Required variables, created in the GitHub repository settings:

• RENOVATE_TOKEN: GitHub access token with repository write permissions. Location: Settings > Secrets and variables > Actions > Repository secrets.
• RENOVATE_GIT_AUTHOR: Author for Renovate commits in the format Name <email@example.com> (e.g., Renovate Bot <renovate@example.com>). Location: Settings > Secrets and variables > Actions > Repository variables.

Optional variables (defaults apply if not set):

• RENOVATE_REPOSITORIES: Repository to run Renovate on in the format yourorg/repo (default: the current repository).
• RENOVATE_DRY_RUN: Set to true to test runs without making changes (default: false).
• RENOVATE_DEPENDENCY_DASHBOARD: Set to true to enable the dependency dashboard (default: false).

Manual trigger: run the workflow from the Actions tab using the workflow dispatch feature.

Debug logging: set the LOG_LEVEL environment variable to debug in the workflow configuration.

CircleCI

Required variables, created in the CircleCI project settings:

• RENOVATE_TOKEN: GitHub access token with repository write permissions.
• RENOVATE_REPOSITORIES: Repository to run Renovate on in the format yourorg/repo.
• RENOVATE_GIT_AUTHOR: Author for Renovate commits in the format Name <email@example.com> (e.g., Renovate Bot <renovate@example.com>).

Optional variables (defaults apply if not set):

• RENOVATE_DRY_RUN: Set to true to test runs without making changes (default: false).
• RENOVATE_DEPENDENCY_DASHBOARD: Set to true to enable the dependency dashboard (default: false).

Manual trigger: trigger the Renovate job from the CircleCI pipeline UI.

Scheduled trigger: add an update-dependencies scheduled trigger under Project Settings → Triggers with config source update-dependencies.yml and branch develop.

Debug logging: enabled by default with LOG_LEVEL: 'debug'.

Triggering GitHub Actions from the self-hosted service is not supported.

Dependency dashboard

The Renovate Dependency Dashboard is a GitHub issue that provides visibility into:

• Available dependency updates that are scheduled for later execution
• Updates that have been filtered out due to configuration rules
• Failed update attempts and their reasons

The dashboard is created with the title "RenovateBot Dependency Dashboard (self-hosted)" when running in self-hosted mode. This dashboard is particularly useful for understanding why certain updates might not be applied immediately due to scheduling constraints or configuration rules.