Four Patterns That Broke Production With Renovate Automerge

We adopted Renovate last June. Six months in, 60% of our PRs were auto-generated. Of those, 95% merged cleanly. 5% broke production or nearly did. This post is those four patterns.

Pattern 1 — breaking change labeled as minor

semver isn't consistently honored. Too many libraries publish behavior changes as minor instead of major.

Our case — a logging library at 2.4.7 → 2.5.0. Minor bump. Release notes said "performance improvement". Reality: timestamp position changed in log format. Our log aggregator's parser broke. Detection: 6 hours.

Defense: Renovate's automerge should run on patch only. Minor → human review. Major → separate work.

Pattern 2 — transitive dependency changed quietly

Renovate updates direct dependencies only. Transitives (deps of deps) follow via lockfile. That's the source of quiet changes.

Our case — direct dep A had a minor update; A's dependency B got a major bump. Lockfile shows B: 3.0.0 → 4.0.0. PR diff looks minor but is actually a major transitive.

Defense: auto-analyze the lockfile diff for every change and tag the semver level. Alert on major transitive.

Pattern 3 — tests pass but production behaves differently

Test environments often mock dependencies, while production calls them for real. Tests pass while production behavior diverges.

Our case — an HTTP client library's connection pool default increased from 5 to 100. Tests used single-connection mocks — unaffected. Production exceeded the rate limit on an external API; the external API rejected half our traffic. Detection: 9 minutes.

Defense: dependency-update PRs require 24-hour soak in staging. Tests alone aren't enough.

Pattern 4 — deprecation warning accumulation

Libraries that follow deprecate-now, remove-later (often a year) let deprecation warnings quietly accumulate. A year later, the removal release breaks suddenly.

Our case — a deprecation warning we missed a year earlier. A minor bump a year later removed the function. One endpoint started returning errors on all requests. Detection: 4 minutes.

Defense: promote deprecation warnings to log-level error. Quiet accumulation is the most expensive pattern.

What the 5% actually cost

Auto PRs over six months:       3,847
                                — Manual PR equivalent: 3,847 × 30 min = ~1,920 hrs
                                — Automation saving:     ~$192,000

5% incident / fix cost:
  Mean impact duration:          12 min (avg of four patterns)
  Incident count:                11 in six months
  Ops time per incident:         avg 4 hrs (investigation + rollback + postmortem)
  Annualized cost:               ~$13,200
─────────────────────────────────
Net saving:                      ~$178,800 / six months

Cost is 7% of saving. Meaningful — and 2–3× higher if we hadn't known these four patterns going in.

What the four share

All four had clean-looking PRs. Without deliberate inspection, they passed. Catching them up-front rather than after the incident requires the four defenses to be part of the infrastructure.

For teams adopting Renovate or any similar automated dependency-update tool, running without two or more of the four defenses above makes one to two incidents per quarter a predictable outcome.