Renovate, auto-merge, and why a small team has no other option
Open npm outdated on any project older than six months. Run uv lock --check on the backend. Look at the base image tag in your Dockerfile.
You already know what you'll find. Things behind. Things with CVEs. Things end-of-life next month. The migration guide for Vite 5 → 6 nobody wants to read.
Nobody schedules this work. Nobody enjoys it. On a small team, nobody has time for it. So it doesn't happen — until the day a CVE forces it to, in a hurry, on a Friday afternoon.
That model doesn't scale to a real project. Especially not a real project with two people on it.
