Document "how to determine scope of onboarding PR's changes", when using a large repo (with a truncated PR)? #39448

jamietanna · 2025-11-21T10:23:37Z

jamietanna
Nov 21, 2025
Maintainer

Tell us more.

For instance, if you're onboarding Renovate into a large monorepo with many pending updates, the onboarding process can look a little "scary".

Worse, due to platform limits, you may not see all the updates pending, as the onboarding PR is truncated.

(I'll separately raise a feature request for "split onboarding PR into multiple comments")

When looking at this personally, I'll (feel comfortable to) dig into the debug logs and investigate further.

I'll start with:

DEBUG: packageFiles with updates
{
  // ...
          {
            "depType": "devDependencies",
            "depName": "socket.io",
            "currentValue": "^4.1.3",
            "datasource": "npm",
            "prettyDepType": "devDependency",
            "lockedVersion": "4.4.0",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "4.6.2",
                "newValue": "^4.1.3",
                "releaseTimestamp": "2023-05-31T09:16:34.165Z",
                "newVersionAgeInDays": 897,
                "newMajor": 4,
                "newMinor": 6,
                "newPatch": 2,
                "updateType": "minor",
                "isBreaking": false,
                "isRange": true,
                "isLockfileUpdate": true,
                "libYears": 1.531060898465246,
                "branchName": "renovate/npm-socket.io-vulnerability"
              }
            ],
            "packageName": "socket.io",
            "versioning": "npm",
            "warnings": [],
            "sourceUrl": "https://github.com/socketio/socket.io",
            "registryUrl": "https://registry.npmjs.org",
            "homepage": "https://github.com/socketio/socket.io/tree/main/packages/socket.io#readme",
            "mostRecentTimestamp": "2024-10-25T06:15:42.364Z",
            "currentVersion": "4.4.0",
            "currentVersionTimestamp": "2021-11-18T13:10:57.671Z",
            "currentVersionAgeInDays": 1455,
            "vulnerabilityFixVersion": "4.6.2",
            "vulnerabilityFixStrategy": "lowest",
            "isSingleVersion": true,
            "fixedVersion": "4.4.0"
          },
  // ...
          {
            "depType": "dependencies",
            "depName": "remark-math",
            "currentValue": "^5.1.1",
            "datasource": "npm",
            "prettyDepType": "dependency",
            "lockedVersion": "5.1.1",
            "updates": [
              {
                "bucket": "major",
                "newVersion": "6.0.0",
                "newValue": "^6.0.0",
                "releaseTimestamp": "2023-09-19T11:38:59.221Z",
                "newVersionAgeInDays": 785,
                "newMajor": 6,
                "newMinor": 0,
                "newPatch": 0,
                "updateType": "major",
                "isBreaking": true,
                "isRange": true,
                "libYears": 1.8544956508751902,
                "branchName": "renovate/major-remark"
              }
            ],
            "packageName": "remark-math",
            "versioning": "npm",
            "warnings": [],
            "sourceUrl": "https://github.com/remarkjs/remark-math",
            "registryUrl": "https://registry.npmjs.org",
            "homepage": "https://github.com/remarkjs/remark-math/tree/main#readme",
            "mostRecentTimestamp": "2023-09-19T11:38:59.221Z",
            "currentVersion": "5.1.1",
            "currentVersionTimestamp": "2021-11-11T14:16:04.375Z",
            "currentVersionAgeInDays": 1462,
            "isSingleVersion": false,
            "fixedVersion": "5.1.1"
          },
}

Within here, you can see, for each package, how many updates they have, and what updates.buckets these land into and/or calculate the number of branches through updates.branchName

You may notice that if there are security updates, some of these updates have a -vulnerability branch suffix, and that the dependency itself has a vulnerabilityFixVersion and vulnerabilityFixStrategy field.

A similar view of the branches that Renovate will create (separate to the data we can get out of packageFiles with updates) is using the Branch summary or branches info extended.

For instance, we can see all branch names that Renovate would create over time:

DEBUG: Branch summary
{
  "baseBranches": [
    {
      "branchName": "...",
      "sha": "..."
    }
  ]
  "branches": []
  "defaultBranch": "main"
  "inactiveBranches": [
    "renovate/npm-socket.io-vulnerability",
    "...",
    "renovate/major-remark"
  ]
}

We can see below a number of inactiveBranches, which are not yet created.

Additionally, we can see a bit more information about the updates that each branch will contain:

DEBUG: branches info extended
{
  "branchesInformation": [
    {
      "branchName": "renovate/npm-socket.io-vulnerability",
      "prNo": null,
      "prTitle": "Update dependency socket.io to v4.6.2 [SECURITY]",
      "upgrades": [
        {
          "datasource": "npm",
          "depName": "socket.io",
          "displayPending": "",
          "fixedVersion": "4.4.0",
          "currentVersion": "4.4.0",
          "currentValue": "^4.1.3",
          "newValue": "^4.1.3",
          "newVersion": "4.6.2",
          "packageFile": "package.json",
          "updateType": "minor",
          "packageName": "socket.io"
        }
      ]
    },
// ...
    {
      "branchName": "renovate/major-remark",
      "prNo": null,
      "prTitle": "Update remark (major)",
      "upgrades": [
        {
          "datasource": "npm",
          "depName": "rehype-katex",
          "displayPending": "",
          "fixedVersion": "6.0.2",
          "currentVersion": "6.0.2",
          "currentValue": "^6.0.2",
          "newValue": "^7.0.0",
          "newVersion": "7.0.1",
          "packageFile": "package.json",
          "updateType": "major",
          "packageName": "rehype-katex"
        },
        {
          "datasource": "npm",
          "depName": "remark-footnotes",
          "displayPending": "",
          "fixedVersion": "4.0.1",
          "currentVersion": "4.0.1",
          "currentValue": "^4.0.1",
          "newValue": "^5.0.0",
          "newVersion": "5.0.0",
          "packageFile": "package.json",
          "updateType": "major",
          "packageName": "remark-footnotes"
        },
        {
          "datasource": "npm",
          "depName": "remark-gfm",
          "displayPending": "",
          "fixedVersion": "3.0.1",
          "currentVersion": "3.0.1",
          "currentValue": "^3.0.1",
          "newValue": "^4.0.0",
          "newVersion": "4.0.1",
          "packageFile": "package.json",
          "updateType": "major",
          "packageName": "remark-gfm"
        },
        {
          "datasource": "npm",
          "depName": "remark-math",
          "displayPending": "",
          "fixedVersion": "5.1.1",
          "currentVersion": "5.1.1",
          "currentValue": "^5.1.1",
          "newValue": "^6.0.0",
          "newVersion": "6.0.0",
          "packageFile": "package.json",
          "updateType": "major",
          "packageName": "remark-math"
        }
      ]
    }
  ]
}

In the case that your Onboarding PR's comment was truncated, you'd be able to see i.e.:

I've got the following security updates, which will be raised immediately (Onboarding PRs with security updates should clarify `prHourlyLimit` won't impact them #39446)
I'll get the following branches created (over time) for the other updates

Looking at branches info extended, I'd (personally) feel comfortable about how to gauge the number of pending updates.

But I wonder if we have a more user-friendly way of showing this in our logs?

I wonder where the best place to document this is?

(Related: #39446)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Document "how to determine scope of onboarding PR's changes", when using a large repo (with a truncated PR)? #39448

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Document "how to determine scope of onboarding PR's changes", when using a large repo (with a truncated PR)? #39448

Uh oh!

jamietanna Nov 21, 2025 Maintainer

Tell us more.

Replies: 0 comments

jamietanna
Nov 21, 2025
Maintainer