Handling automatic pull requests (renovate)

We can trust automatic PRs in terms of their execution, and that they are "needed" in some way. The key is to understand the dependency. Why is it in the project, what does it do? How will a change be managed by our test and deploy process?

We can run yarn why dependency-name to find out why a transitive dependency is in the project. If it's a dependency we've added to the project ourselves, we should have information in issues and PRs as to why we added it.

Vercel should catch build failures, and we can create a local build to investigate the failure. For passing builds, the deploy preview can be compared to the live site. A good understanding of what the dependency does will help with where to look for potential problems.