Dependency updates

River Pro is distributed via private package sources, which may require custom configuration to work with automated dependency upgrade tools like Dependabot. This page describes how to configure those dependency update tools to work with River Pro.

Dependabot

Dependabot’s support for private Go proxies is available as of September 2025 and is not yet fully documented. The recommended way to configure Dependabot to work with River Pro is with a go.env file in your project root, as well as custom private registry configuration in your .github/dependabot.yaml file.

The GONOSUMDB environment variable is required to prevent Go from attempting to verify checksums for private modules which are not accessible to the checksum database.

GONOSUMDB=riverqueue.com/riverpro

version: 2
registries:
  golang-proxy:
    type: goproxy-server
    url: https://proxy.golang.org
    username: ""
    password: ""
  riverpro-proxy:
    type: goproxy-server
    url: https://riverqueue.com/goproxy
    username: river
    password: ${{secrets.RIVER_PRO_SECRET}}
updates:
  - package-ecosystem: "gomod"
    directory: "/" # Location of package manifests
    groups:
      go-dependencies:
        update-types:
          - "minor"
          - "patch"
    registries:
      # Prefer to fetch from the main public Go proxy, falling back to
      # River's private proxy for modules not found there.
      - golang-proxy
      - riverpro-proxy
    schedule:
      interval: "weekly"

Keep the private source block in your Gemfile and configure a rubygems-server registry for Dependabot:

version: 2
registries:
  riverpro-gems:
    type: rubygems-server
    url: https://riverqueue.com/rubygems
    username: river
    password: ${{secrets.RIVER_PRO_SECRET}}
updates:
  - package-ecosystem: "bundler"
    directory: "/" # Location of Gemfile and Gemfile.lock
    registries:
      - riverpro-gems
    schedule:
      interval: "weekly"

Keep rubygems.org as your Gemfile’s default source for public gems. The private source only serves riverqueue-pro.

Update the Rust crates together using the supported version pair.

Configure Dependabot’s cargo-registry support. Use the registry URL without Cargo’s sparse+ prefix:

version: 2
registries:
  riverpro-cargo:
    type: cargo-registry
    registry: river
    url: https://riverqueue.com/cargo/
    token: ${{secrets.RIVER_PRO_SECRET}}
updates:
  - package-ecosystem: cargo
    directory: "/" # Location of Cargo.toml and Cargo.lock
    registries:
      - riverpro-cargo
    groups:
      river:
        patterns:
          - "riverqueue*"
    schedule:
      interval: weekly

Keep the named registry in .cargo/config.toml and registry = "river" on Pro dependencies. Store your River Pro license key (river_secret_...) as the Dependabot secret RIVER_PRO_SECRET, without a username or URL encoding. Review grouped updates against Pro’s required River version, update the separately installed CLI to match, and apply both migration lines before starting upgraded workers.

Configuring your secret

Add your River Pro license key as RIVER_PRO_SECRET to GitHub’s Dependabot secrets so the registry can authenticate. Refer to GitHub’s documentation for storing credentials for Dependabot to use, either as a repository secret or an organization secret. For more about River secrets, see private package installation.