Scheduling update windows around release freezes Jump to heading#

Dependency bots do not know about your calendar. The week before a major release, during a code freeze, over a holiday when half the team is away — the bot keeps opening pull requests, CI keeps running them, and either someone merges an untested upgrade at the worst moment or the queue grows until nobody looks at it. The fix is to give updates a schedule that matches how the team works: routine updates in a known window, paused entirely during freezes, with security fixes still allowed through. Both Renovate and Dependabot support this; the difference is in how. This page sets up windows and freezes for each, and a clean catch-up afterwards, within automated dependency updates.

When to use this approach Jump to heading#

• Dependency pull requests arrive during release freezes or holidays and cause distraction or risk.
• The team reviews dependency updates best at a particular time of the week.
• Security fixes must still flow when routine updates are paused.
• Your release process uses freezes, such as in running a scheduled release train.

Step 1 — Choose a routine update window Jump to heading#

Pick when routine updates should arrive: usually early in the week, so they can be reviewed and merged before the end of it, and in the team’s working hours rather than overnight.

// renovate.json — routine updates only on Monday mornings, team time zone
{
  "timezone": "Europe/Copenhagen",
  "schedule": ["before 9am on monday"],
  "prConcurrentLimit": 6
}

# .github/dependabot.yml — weekly at a fixed local time
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule: { interval: weekly, day: monday, time: "06:00", timezone: Europe/Copenhagen }

Step 2 — Pause routine updates during a freeze in Renovate Jump to heading#

Renovate’s schedule accepts multiple expressions and package rules can override it. The cleanest freeze is a repository configuration change that sets an impossible schedule for routine updates while leaving vulnerability alerts on their own schedule.

{
  "schedule": ["before 9am on monday"],
  "packageRules": [
    {
      "description": "Release freeze 2026-11-16 to 2026-11-27: no routine updates",
      "matchUpdateTypes": ["major", "minor", "patch", "pin", "digest", "lockFileMaintenance"],
      "enabled": false
    }
  ],
  "vulnerabilityAlerts": { "enabled": true, "schedule": ["at any time"], "labels": ["security"] }
}

Disabling routine rules for the freeze and re-enabling them afterwards is a pull request each time, which records when freezes happened and who approved them.

Step 3 — Pause routine updates during a freeze in Dependabot Jump to heading#

Dependabot has no date-range syntax. The practical method is to set open-pull-requests-limit: 0 for version updates during the freeze — Dependabot then opens no new version-update pull requests — while security updates, which are configured separately, continue.

# During the freeze
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule: { interval: weekly }
    open-pull-requests-limit: 0     # freeze: version updates paused (security updates unaffected)

Automate the switch so nobody has to remember: a scheduled workflow that reads freeze dates from a file and opens a pull request flipping the setting at the start and end.

# freeze-dates.txt — one window per line: start end
# 2026-11-16 2026-11-27
today=$(date +%F)
while read -r start end; do
  [ "$today" = "$start" ] && echo "open PR: freeze updates"
  [ "$today" = "$end" ]   && echo "open PR: resume updates"
done < freeze-dates.txt

Step 4 — Let security fixes through, with a fast path Jump to heading#

A freeze that blocks security fixes is a liability. Make sure security pull requests are labelled distinctly, routed to the on-call owner, and allowed to merge during the freeze after the normal checks, through whatever exception process the freeze has.

# During a freeze: list open security update PRs needing attention
gh pr list --label security --state open --json number,title,createdAt \
  --jq '.[] | "#\(.number) \(.title) (opened \(.createdAt[:10]))"'

The general approach to freezes with exceptions is in freezing deploys with branch protection.

Step 5 — Catch up cleanly after the freeze Jump to heading#

When the freeze ends, weeks of updates arrive at once. Rather than many individual pull requests, let them land as one grouped batch per ecosystem, reviewed together, so the team returns to its normal rhythm within a day or two.

{
  "packageRules": [
    {
      "description": "Post-freeze catch-up: one PR per ecosystem for all non-major updates",
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "post-freeze catch-up"
    }
  ]
}

Validation checklist Jump to heading#

• Routine updates arrive in a defined weekly window in the team’s time zone
• Freezes pause routine updates through a reviewed configuration change
• Security updates continue during freezes, labelled and routed to an owner
• Freeze start and end are automated from a list of dates
• Post-freeze updates arrive grouped, then the catch-up rule is removed
• The number of open dependency pull requests returns to normal within days

Frequently Asked Questions Jump to heading#

Why not just close the bot’s pull requests during the freeze? Jump to heading#

Closed pull requests may be re-opened on the next run, or the bot may treat them as declined and stop proposing that version. Pausing at the source is cleaner and leaves no confusing history.

Should lockfile maintenance pause during freezes too? Jump to heading#

Yes. Lockfile refreshes change transitive dependencies, which is exactly the kind of change a freeze is meant to prevent.

What about base images and GitHub Actions? Jump to heading#

Treat them like any other ecosystem: pause routine updates in the freeze and let security fixes through. Base image digests in particular can change behaviour without any version number changing.

Related Jump to heading#

• Automated Dependency Updates — the parent topic.
• Configuring Dependabot Version and Security Updates — the configuration this page modifies.
• Grouping Dependency Updates to Reduce PR Noise — groups used for the catch-up.
• Scheduled Workflows and Cron Triggers — automating the freeze switch.