Renovate Bot Cheat Sheet
Renovate automated dependency updates covering renovate.json config, presets, scheduling, and grouping rules.
Base renovate.json
A practical starting config extending Renovate's recommended preset.
{ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:recommended", ":semanticCommits", "schedule:weekly" ], "labels": ["dependencies"], "prConcurrentLimit": 10, "rangeStrategy": "bump"}
Grouping & Package Rules
packageRules let you customize behavior per ecosystem or package pattern.
{ "packageRules": [ { "matchPackagePatterns": ["^@types/"], "groupName": "type definitions" }, { "matchUpdateTypes": ["minor", "patch"], "matchCurrentVersion": "!/^0/", "automerge": true }, { "matchDepTypes": ["devDependencies"], "schedule": ["before 6am on monday"] }, { "matchPackageNames": ["react", "react-dom"], "groupName": "react" } ]}
Lock File Maintenance & Vulnerability Alerts
Keep transitive deps fresh and get security PRs prioritized.
{ "lockFileMaintenance": { "enabled": true, "schedule": ["before 6am on the first day of the month"] }, "vulnerabilityAlerts": { "enabled": true, "labels": ["security"] }, "osvVulnerabilityAlerts": true}
Useful Built-in Presets
Shareable config bundles you can drop straight into `extends`.
- config:recommended- sensible defaults for most repos, the standard starting point
- :semanticCommits- prefixes commit/PR titles with fix:/chore: based on update type
- :dependencyDashboard- opens/maintains a single issue listing all pending updates
- schedule:weekly / schedule:nonOfficeHours- controls when PRs are raised to reduce noise
- :automergeMinor- automatically merges minor/patch updates that pass CI
- group:monorepos- groups updates from packages published from the same monorepo
Custom regexManagers for Unsupported Files
Teach Renovate to bump versions pinned in files it has no built-in manager for (Dockerfiles ARGs, Makefiles, docs).
{ "customManagers": [ { "customType": "regex", "fileMatch": ["^Dockerfile$"], "matchStrings": [ "ARG NODE_VERSION=(?<currentValue>.*?)\n" ], "depNameTemplate": "node", "datasourceTemplate": "docker", "versioningTemplate": "node" } ]}
hostRules for Private Registries
Authenticate Renovate against a private npm/Docker/PyPI registry so it can resolve and bump internal packages.
{ "hostRules": [ { "matchHost": "npm.internal.example.com", "hostType": "npm", "token": "{{ secrets.NPM_TOKEN }}" }, { "matchHost": "registry.internal.example.com", "hostType": "docker", "username": "renovate", "password": "{{ secrets.DOCKER_REGISTRY_PASSWORD }}" } ]}
minimumReleaseAge (Stability Window)
Delay PRs for a package until a new release has existed for N days, avoiding day-zero regressions.
{ "packageRules": [ { "matchPackagePatterns": ["*"], "minimumReleaseAge": "3 days" }, { "matchDepTypes": ["dependencies"], "matchUpdateTypes": ["major"], "minimumReleaseAge": "14 days", "dependencyDashboardApproval": true } ]}
postUpgradeTasks
Run a command after Renovate bumps a dependency, e.g. to regenerate a lockfile-adjacent artifact.
{ "postUpgradeTasks": { "commands": [ "npm run generate:api-types" ], "fileFilters": ["src/generated/**"], "executionMode": "update" }, "allowedPostUpgradeCommands": [ "^npm run generate:api-types$" ]}
Advanced Config Fields
Less common but high-leverage fields once the basic setup is working.
- dependencyDashboardApproval- gates specific updates behind a manual checkbox click in the dashboard issue instead of auto-raising a PR
- prCreation: not-pending- waits for upstream CI/branch status checks to settle before opening the PR
- stabilityDays (legacy alias)- older name for minimumReleaseAge, still recognized but superseded
- ignorePaths / ignoreDeps- excludes specific directories (e.g. `test/fixtures`) or package names from scanning entirely
- rebaseWhen: conflicted- only rebases Renovate PRs when the base branch actually conflicts, reduces noisy force-pushes
- configMigration- opens an automated PR that rewrites renovate.json to the current schema when config keys are deprecated
Enable the Dependency Dashboard preset even if you don't need it day-to-day — it gives you a single searchable issue showing every pending, rate-limited, and rejected update, which is invaluable when auditing why a specific package hasn't been bumped.
