TL;DR:

  • Renovate automates dependency updates for 90+ package managers — npm, pip, Go modules, Docker, Terraform, GitHub Actions, and more — creating one PR per update (or grouped PRs) with full changelog context
  • The renovate.json config file controls everything: automerge rules, grouping strategies, schedule, semantic commit messages, and vulnerability-only modes
  • Unlike Dependabot, Renovate is self-hostable, supports monorepos natively, and has dramatically more configuration flexibility

Outdated dependencies are the dependency debt that never goes away on its own. You either systematically update them or you find out about them during a CVE response at 2am. Renovate Bot, maintained by Mend (formerly WhiteSource), is the tool most engineering teams with large dependency footprints reach for.

The basic pitch: Renovate watches your repositories, detects when a dependency has a new version, and opens a pull request with a helpful description that includes the changelog, release notes, and links to the commits between your current version and the new one. Your CI runs against the PR. If it passes, you merge — or configure automerge to handle it for you.

Why Renovate Over Dependabot

GitHub ships Dependabot built-in, which raises the obvious question. Renovate has several meaningful advantages for teams with real-world complexity:

Monorepo support: Renovate handles monorepos natively, detecting and updating packages across all sub-projects in a single pass. Dependabot requires separate configuration for each package location.

Grouping: Renovate can group related updates into single PRs (e.g. “all ESLint packages”, “all AWS SDK packages”, “all minor updates”). This dramatically reduces PR noise for large dependency trees. Dependabot’s grouping is more limited.

Self-hosting: You can run Renovate on your own infrastructure, which matters for private registries, compliance requirements, or just keeping your dependency information out of third-party systems.

Configuration depth: renovate.json has hundreds of configuration options. You can express complex rules: “automerge patch updates on weekdays only”, “require 3 days stabilisation time before merging any new major version”, “pin Docker image digests instead of tags”.

More package managers: 90+ package managers vs Dependabot’s more limited coverage.

Installation

The quickest path is the Renovate GitHub App, available at the GitHub Marketplace. Install it on your organization, grant access to your repositories, and Renovate creates an onboarding PR on each repository that includes a default renovate.json.

For self-hosting:

# Docker
docker run \
  -e RENOVATE_TOKEN=your-github-token \
  -e RENOVATE_REPOSITORIES=org/repo \
  renovate/renovate:latest

# npm global install
npm install -g renovate
RENOVATE_TOKEN=your-github-token renovate --repositories=org/repo

Basic Configuration

The onboarding PR creates renovate.json at your project root. The minimal starting config:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"]
}

config:recommended applies sensible defaults: non-major updates open PRs automatically, major updates open PRs but aren’t automerged, security updates are prioritised. Most teams start here and layer in customisation as needed.

Grouping Updates

The biggest quality-of-life improvement over default Renovate behaviour is grouping related updates:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchPackagePatterns": ["^@aws-sdk/"],
      "groupName": "AWS SDK packages"
    },
    {
      "matchPackagePatterns": ["^eslint", "^@typescript-eslint/"],
      "groupName": "ESLint packages"
    },
    {
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "dev dependency minor/patch updates",
      "automerge": true
    }
  ]
}

This groups all AWS SDK packages into one PR, all ESLint packages into another, and automerges all minor/patch dev dependency updates without human review (after CI passes).

Automerge Strategy

Automerge is where Renovate saves the most time. Configure it at the right granularity for your risk tolerance:

{
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "matchCurrentVersion": "!/^0/",
      "automerge": true
    },
    {
      "matchPackageNames": ["typescript"],
      "automerge": false,
      "stabilityDays": 7
    },
    {
      "matchDepTypes": ["action"],
      "automerge": true,
      "automergeType": "pr",
      "platformAutomerge": true
    }
  ]
}

The stabilityDays setting is underused: it makes Renovate wait N days after a release before opening a PR, reducing the chance of merging a version that’s quickly followed by a hotfix.

Schedule

By default, Renovate runs continuously. For most teams, it’s better to batch updates to predictable windows:

{
  "schedule": ["after 10pm on weekdays", "before 5am on weekdays", "every weekend"],
  "timezone": "Europe/London"
}

This runs Renovate overnight on weekdays and through the weekend, creating a daily batch of update PRs that your team sees at the start of each day without constant notifications.

Security-Only Mode

For repositories where you want to accept only security vulnerability updates (ignoring regular version bumps), use:

{
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchPackagePatterns": ["*"],
      "enabled": false
    },
    {
      "matchPackagePatterns": ["*"],
      "matchDepTypes": ["dependencies", "devDependencies"],
      "vulnerabilityAlerts": {
        "enabled": true
      }
    }
  ]
}

This disables all non-security updates while keeping vulnerability fixes active. Useful for stable production dependencies where you want to limit change surface but can’t afford to ignore CVEs.

Docker and GitHub Actions Updates

Renovate handles Docker image tags and GitHub Actions version pins — two places where manual update debt accumulates fast:

{
  "docker": {
    "enabled": true,
    "pinDigests": true
  },
  "github-actions": {
    "enabled": true
  }
}

With pinDigests: true, Renovate converts floating Docker tags like node:20 to pinned digests (node:20@sha256:abc123...) and then opens PRs when those digests update. This is the security-recommended approach for production container images.

For GitHub Actions, Renovate similarly pins uses: actions/checkout@v4 to the specific commit SHA behind that tag, and opens PRs when the referenced action releases new versions.

Monorepo Configuration

For monorepos, specify additional package file locations:

{
  "extends": ["config:recommended"],
  "npmrc": "@company:registry=https://npm.company.com",
  "packageFilePatterns": [
    "packages/**/package.json",
    "apps/**/package.json",
    "services/**/package.json"
  ],
  "ignorePaths": [
    "**/node_modules/**"
  ]
}

Renovate discovers package files matching these patterns and updates them all, grouping updates from the same package across the monorepo into a single PR where possible.

Migrating from Dependabot

If you’re moving from Dependabot, disable it first to avoid duplicate PRs:

# .github/dependabot.yml — disable all
version: 2
updates: []

Then install Renovate and migrate your Dependabot config to renovate.json. The Renovate docs include a Dependabot migration guide. Most Dependabot configurations have direct Renovate equivalents, often with more options available.

The Bottom Line

Dependency management is maintenance work — necessary, low-prestige, and easy to defer. Renovate makes it systematic. The configuration investment upfront (typically a few hours to tune grouping and automerge rules for your stack) pays back in the form of consistently updated dependencies, faster security patch response, and significantly less PR review time for routine dependency bumps. Start with config:recommended and tighten from there.