Renovate

Visit Website

Introduction

Renovate is a bot that keeps dependencies up to date. It scans a repository for package files, compares the versions you pin with what the registries publish, and opens pull requests that bump each outdated dependency. Mend maintains the project, and the README calls it cross-platform dependency automation.

Breadth is its main selling point. The README says it supports over 90 package managers, covering ecosystems such as npm, Java, Python, .NET, Scala, Ruby, Go and Docker. It works on GitHub, GitLab, Bitbucket, Azure DevOps, Gitea and Forgejo, with AWS CodeCommit, Gerrit and SCM-Manager listed as experimental. That makes it one of the few update bots that a company with mixed hosting can standardise on.

Renovate is driven by a renovate.json (or similar) configuration file in each repository, plus optional shared presets. Presets let a platform team define one policy, for example grouping all linters into a single weekly pull request, automerging patch updates that pass CI, or holding back major versions, and then have every repository extend it. A Dependency Dashboard issue lists pending, rate-limited and ignored updates in one place.

You can run it three ways: the hosted Mend Renovate app for GitHub and other platforms, a self-hosted container or CLI (npx renovate) in your own CI, or the Mend Renovate Community or Enterprise self-hosted editions. The open-source CLI is the same engine in every case.

In the quality loop, Renovate sits at the release and CI gate. A dependency bump is only safe if your tests catch what it breaks, so Renovate works best paired with a solid test suite, required status checks and, for low-risk updates, automerge. Teams that adopt it usually find the real work is tuning noise: scheduling, grouping and limits keep the stream of pull requests manageable.

The source code is at renovatebot/renovate on GitHub under the AGPL-3.0 licence, with about 23,100 stars; the most recent commit was on 11 November 2026.

Features

1. 90+ package managers: npm, Maven, Gradle, pip, Poetry, Go modules, Cargo, NuGet, Bundler, Docker, Helm, Terraform, GitHub Actions and many more.
2. Multi-platform: GitHub, GitLab, Bitbucket, Azure DevOps, Gitea and Forgejo, plus experimental support for others.
3. Shareable presets: Extend config:recommended or your own organisation preset so every repo follows the same rules.
4. Grouping and scheduling: Bundle related updates into one pull request and limit when pull requests may be opened.
5. Automerge: Merge updates automatically once required checks pass, typically for patch and minor versions.
6. Dependency Dashboard: An issue that lists every pending, blocked and ignored update for the repository.
7. Lock file maintenance: Periodically refreshes lock files to pull in transitive updates.
8. Release notes in PRs: Pull requests include changelog and release-note excerpts so reviewers see what changed.
9. Vulnerability alerts: Can raise security-fix pull requests based on vulnerability data, with their own labels and schedule.
10. Self-hosting: Run the CLI or container on your own runners against private registries.

Pros

1. Wide ecosystem coverage: One bot can handle application code, containers, CI files and infrastructure definitions.
2. Highly configurable: Nearly every behaviour can be tuned, from commit message format to which versions are allowed.
3. Free to use: Open source under the AGPL-3.0 licence, so the core tool costs nothing to use.
4. Actively maintained: The repository had commits as recent as 11 November 2026.
5. Community: About 23,100 GitHub stars.

Cons

1. Configuration depth: The number of options is large, and debugging why an update did or did not appear can take time.
2. Pull request volume: Without grouping and schedules, busy repositories receive many pull requests.
3. AGPL licence: Self-hosting the open-source CLI is free, but some organisations have policies about AGPL software.
4. Needs good tests: Automerge is only as safe as the checks that guard it.

Usage and Links (Example)

Add a configuration file to the repository root:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "schedule": ["before 6am on monday"],
  "packageRules": [
    { "matchUpdateTypes": ["patch", "minor"], "automerge": true },
    { "matchPackagePatterns": ["^eslint"], "groupName": "eslint" }
  ]
}

Run it self-hosted in CI:

export RENOVATE_TOKEN=<token-with-repo-access>
npx renovate --platform=github your-org/your-repo

Practical tips:

1. Start with config:recommended and a weekly schedule, then loosen limits once the team trusts the flow.
2. Turn on automerge only for update types your test suite reliably covers.
3. Use the Dependency Dashboard to approve major upgrades deliberately.

Resources:

• Renovate website
• GitHub repository

Pricing

Renovate is free and open source under the AGPL-3.0 licence.

Recommended for?

1. Organisations with many repositories that want one dependency policy across them.
2. Polyglot or multi-host teams whose code lives on more than one Git platform.
3. Teams with strong CI checks that can safely automerge low-risk updates.
4. Not ideal for a single small repo where Dependabot’s built-in GitHub integration is enough.

Conclusion

Renovate is the most flexible dependency update bot available. Its package-manager coverage, presets and grouping rules make it practical to keep hundreds of repositories current without drowning reviewers.

The cost is configuration effort and the need for trustworthy tests. Invest in both, and Renovate turns dependency drift from a quarterly chore into a steady, reviewable stream of small changes.

On CheckOps, Renovate is filed under the Release & CI gates and Security testing stages. Related tools listed here include Dependabot, Snyk, OSV-Scanner, OWASP Dependency-Track, Socket and pre-commit. When comparing them, weigh the licence, the languages and platforms each supports, whether it is self-hosted or managed, and how cleanly it slots into your existing CI pipeline. Details on this page were checked against the official website, documentation and repository on 11 November 2026.