Set up automated weekly dependency updates

[pomfrida]

Is your feature request related to a problem? Please describe.

We previously had an organization-level bot handling dependency updates, but it was phased out. We currently have no automated dependency update mechanism, which means dependencies go stale and security patches are missed.

Describe the solution you'd like

Automated weekly dependency updates across the entire monorepo, ideally consolidated into a single PR per week to keep the review burden low.

Tool comparison: Dependabot vs Renovate

We need to evaluate which tool best fits our monorepo workflow.

Dependabot

Aspect	Detail
Cost	Free (built into GitHub)
Setup	Simple .github/dependabot.yml
Grouping	Can group dependencies per directory entry, but cannot group across directories
Monorepo PR volume	~14 PRs/week worst case (one per package directory + GitHub Actions)
pnpm support	Yes
Auto-merge	Supported via GitHub settings

Limitation: Dependabot creates a separate PR per directory entry. In our monorepo with 14 package directories, this means up to 14 PRs per week even with grouping enabled. There is no way to consolidate all updates into a single PR.

Renovate

Aspect	Detail
Cost	Free (open source, free GitHub App for public and private repos)
Setup	renovate.json config file + install GitHub App
Grouping	Full control - can group all monorepo updates into a single PR via groupName
Monorepo PR volume	1 PR/week (all updates grouped)
pnpm support	Yes, with native pnpm workspace awareness
Auto-merge	Supported

Advantage: Renovate's groupName feature can consolidate updates from all 14 directories into one weekly PR, which matches our preferred workflow.

Recommendation

If our priority is one PR per week with all dependency updates grouped together, Renovate is the better fit. Dependabot is simpler to set up but cannot group across package directories in a monorepo.

If we're okay with ~14 grouped PRs per week (one per package), Dependabot works fine and requires no external app installation.

Monorepo considerations

• We have 14 package directories: root, 9 in packages/, 3 in apps/, 1 in scripts/
• Internal @equinor/* cross-dependencies use workspace:* and are not affected by either tool
• pnpm lockfile is updated automatically when any package dependency changes
• Our existing claude-code-review.yml will automatically review dependency update PRs regardless of which tool we choose

Next steps

• Decide: Dependabot (simple, multiple PRs) or Renovate (more config, single PR)
• Implement chosen solution
• Verify CI runs on dependency update PRs
• Confirm Claude automated review works on the PRs

[pomfrida]

We're trying out Dependabot since we managed to collect all minor and patch updates into a single grouped PR, thanks to Dependabot's support for directory: "/" with pnpm workspaces (dependabot-core#10758, resolved Dec 2024). This means Dependabot discovers all workspace packages from the root lockfile — no separate directory entries needed. Combined with the groups feature, we get one PR per week instead of ~14. (Major updates will be individual PRs though)

First PR: #4500 (54 packages, required a few manual fixes for downshift 9.3.0 and TypeScript compatibility).

If this works well we can close the Renovate alternative. If not, Renovate remains as a fallback.