Auto-merge is a setting that tells a repository platform to merge a pull request automatically once all required conditions are met, such as passing tests and any required approvals. It saves time by removing the need for a person to wait and click the merge button after the checks finish.
It is common for routine changes, such as dependency updates, where the checks give enough confidence. Used with branch protection, it ensures a change cannot merge until the required reviews and status checks are complete.
The convenience carries risk if the requirements are weak. If the checks do not actually test what matters, or if a change needs no human approval, a faulty or malicious change can reach the main branch automatically. Auto-merged dependency updates can also pull in a compromised or broken package without anyone reading the change. Passing checks show that those tests passed, not that the change is safe.
To use it safely, require meaningful tests and, for sensitive code, human review, restrict it to low-risk changes, keep branch protection rules in place and watch what gets merged. Review the setting periodically and turn it off where the checks are not trustworthy.