Renovate

Definition

Renovate is an automated dependency update tool that scans a project's package manifests, checks for newer versions of its dependencies, and opens pull requests to upgrade them on a schedule the team controls. It supports a broad range of package ecosystems and languages, and is commonly run as a bot inside a CI/CD pipeline or as a hosted app on platforms like GitHub, GitLab, and Bitbucket, reducing the manual effort of keeping dependencies current.

Overview

Dependency staleness is a quiet but persistent risk in software projects: libraries accumulate known vulnerabilities, fall out of support, or simply drift far enough from current versions that eventually upgrading becomes a large, risky project instead of routine maintenance. Renovate was built to keep that drift from accumulating by continuously checking for new dependency versions and proposing updates as small, reviewable pull requests rather than leaving the work to be discovered later. Mechanically, Renovate runs on a schedule against a repository, parsing manifest files such as package.json, requirements.txt, go.mod, or Terraform provider blocks depending on the ecosystems in use. For each dependency, it queries the relevant package registry for newer versions, applies the update rules configured in a renovate.json file (for example, grouping minor updates together, pinning certain packages, or requiring passing tests before merge), and opens a pull request containing the version bump along with release notes pulled from the dependency's changelog when available. Teams can configure automerge for low-risk updates that pass CI, while higher-risk major version bumps are left for human review. Renovate is frequently compared to Dependabot, GitHub's built-in dependency update bot; the two overlap heavily in purpose, but Renovate is generally seen as more configurable, supporting a wider range of ecosystems, more granular grouping and scheduling rules, and self-hosting outside of GitHub, whereas Dependabot is more tightly integrated by default into GitHub's own interface. Renovate focuses specifically on version currency, distinguishing it from security-specific scanners that flag known vulnerabilities in dependencies already in use without necessarily proposing an upgrade path. In practice, teams add a Renovate configuration file to a repository and let it run on a recurring schedule, reviewing and merging the resulting pull requests as part of normal code review. Many teams group updates by type (patch, minor, major) or by package ecosystem to keep pull request volume manageable, and rely on automated test suites to validate that an update hasn't broken anything before merging. The main trade-off is pull request volume: an unconfigured Renovate setup on an active project can generate a large number of update pull requests that create review overhead if not tuned with grouping, scheduling, and automerge rules. Renovate also cannot guarantee an update is safe purely by version number; a passing CI suite is only as good as the tests it runs, and semantic-versioning violations in an upstream package can still break a build despite following expected version conventions.

Key Features

• Scans and updates dependency manifests across dozens of package ecosystems
• Opens individual or grouped pull requests for version upgrades on a schedule
• Configurable automerge rules for low-risk updates that pass CI
• Pulls changelog and release note context into each update pull request
• Supports self-hosting or running as a managed app on major Git platforms
• Fine-grained scheduling to control when and how often updates are proposed
• Dependency dashboards summarizing pending, open, and ignored updates
• Presets and shareable configuration for standardizing rules across repositories

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps