### Overview We'll provide customers a way to enable and configure the feature as needed. There are established tools in this space that have evolved to fit use cases that we may want to support. These solutions offer pieces of configuration that allow users to customize the labels used for the MRs, the reviewers assigned, the commit message, the branch name, and more. For GA we should establish support for configuration that is required for the feature to operate on common projects.. ### Proposed configuration | # | Capability | Dependabot | Renovate | Snyk | Customer Zero | |---|---|---|---|---|---| | 1 | Ignored dependencies | :white_check_mark: [ignore](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#ignore) | :white_check_mark: [ignoreDeps](https://docs.renovatebot.com/configuration-options/#ignoredeps) | :white_check_mark: [auto-upgrade PRs](https://docs.snyk.io/scan-fix-and-prevent/fix/snyk-pull-or-merge-requests/enable-automatic-upgrade-prs-for-new-dependency-upgrades) | :warning: indirect — Customer Zero asked whether specific deps can be targeted vs. all firing at once | | 2 | Runner tags (DinD) | N/A | N/A | N/A | N/A — GitLab-specific | | 3 | Private registry credentials | :white_check_mark: [registries](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#registries) | :white_check_mark: [hostRules](https://docs.renovatebot.com/configuration-options/#hostrules) | :white_check_mark: [integrations](https://docs.snyk.io/developer-tools/integrations) | :x: no Customer Zero feedback | | 4 | Branch prefixes | :white_check_mark: [branch-name.prefix](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#pull-request-branch-nameprefix) | :white_check_mark: [branchPrefix](https://docs.renovatebot.com/configuration-options/#branchprefix) | :x: not surfaced in auto-fix PR docs | :x: no Customer Zero feedback; failure observed internally during rollout | | 5 | Allowed tools & commands | :white_check_mark: [insecure-external-code-execution](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#insecure-external-code-execution) | :white_check_mark: [postUpgradeTasks](https://docs.renovatebot.com/configuration-options/#postupgradetasks) | :x: no equivalent (Snyk manages execution) | :x: no Customer Zero feedback | | 6 | Labels on MRs | :white_check_mark: [labels](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#labels) | :white_check_mark: [labels](https://docs.renovatebot.com/configuration-options/#labels) | :x: not surfaced in auto-fix PR docs | :x: no Customer Zero feedback; teams internally set labels when using a Renovate fork | | 7 | Feature on/off toggle (per project) | :white_check_mark: [open-pull-requests-limit](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit) | :white_check_mark: [enabled](https://docs.renovatebot.com/configuration-options/#enabled) | :white_check_mark: [auto-upgrade PRs](https://docs.snyk.io/scan-fix-and-prevent/fix/snyk-pull-or-merge-requests/enable-automatic-upgrade-prs-for-new-dependency-upgrades) | :white_check_mark: Customer Zero ("Can the feature be enabled on a per-project basis?"); also raised in [work item #97](https://gitlab.com/gitlab-com/gl-security/product-security/product-security-engagements/product-security-requests/-/work_items/97) | | 8 | Severity targeting | :x: no threshold; security updates fire automatically | :x: binary on/off via [osvVulnerabilityAlerts](https://docs.renovatebot.com/configuration-options/#osvvulnerabilityalerts) only | :white_check_mark: [score threshold 0–1000 + severity selector](https://docs.snyk.io/scan-fix-and-prevent/fix/snyk-pull-or-merge-requests/enable-automatic-upgrade-prs-for-new-dependency-upgrades) | :x: no Customer Zero feedback | | 9 | Max update level (patch / minor / major) | :white_check_mark: [versioning-strategy](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#versioning-strategy) | :white_check_mark: [maxMajorIncrement](https://docs.renovatebot.com/configuration-options/#maxmajorincrement) | :white_check_mark: [major version upgrade toggle](https://docs.snyk.io/scan-fix-and-prevent/fix/snyk-pull-or-merge-requests/enable-automatic-upgrade-prs-for-new-dependency-upgrades) | :warning: indirect — Customer Zero ("many people wanted to bump to the first safe version" — secondhand) | | 10 | Max open MRs | :white_check_mark: [open-pull-requests-limit](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit) | :white_check_mark: [prConcurrentLimit](https://docs.renovatebot.com/configuration-options/#prconcurrentlimit) | :white_check_mark: [limit 1–10 per project](https://docs.snyk.io/scan-fix-and-prevent/fix/snyk-pull-or-merge-requests/enable-automatic-upgrade-prs-for-new-dependency-upgrades) | :white_check_mark: Customer Zero ("Can we limit the amount of MRs being open?"); [work item #97](https://gitlab.com/gitlab-com/gl-security/product-security/product-security-engagements/product-security-requests/-/work_items/97) lists "Only 5 MRs open at one time" as known limitation | ### Excluded configuration | # | Capability | Dependabot | Renovate | Snyk | Customer Zero | |---|---|---|---|---|---| | 1 | Reviewers | | | | |