$devvkit learn --librarie renovate:-automated-dependency-updates-guide

Renovate: Automated Dependency Updates Guide

[oss-stack][dependencies][automation][ci][maintainer]

Open Source

Install

# GitHub: install the Renovate App on the repo (renovatebot/renovate)
# or self-host:
npx renovate

Renovate watches your dependency manifests and opens pull requests when updates are available: with intelligent grouping (related packages in one PR), scheduled runs, version pinning rules, and custom managers for anything from npm to Terraform. It is the standard alternative to Dependabot for repos that need finer control.

For open source maintainers its superpower is calm: updates arrive as tested PRs on your schedule instead of surprise breakage, and a green dependabot-style history is a quality signal to contributors and users.

Setup

Onboarding· Renovate creates an onboarding PR with a default config.

# Install the GitHub App: github.com/apps/renovate
# It opens a PR adding renovate.json:
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "dependencyDashboard": true
}

Configuration

Basic config· Common settings for a healthy repo.

{
  "extends": ["config:recommended"],
  "labels": ["dependencies"],
  "assignees": ["you"],
  "timezone": "Asia/Karachi",
  "schedule": ["after 6pm every weekday"],
  "automerge": false
}

Grouping

Group related updates· Bundle ecosystem updates into fewer PRs.

"packageRules": [
  {
    "matchPackagePatterns": ["^@types/"],
    "groupName": "typescript types"
  },
  {
    "matchUpdateTypes": ["patch"],
    "automerge": true,
    "groupName": "patch updates"
  }
]

CLI

Self-host and CLI· Run Renovate without the app (GitLab, Gitea, on-prem).

# Self-host (requires a bot token):
RENOVATE_TOKEN=xxx npx renovate owner/repo

# Dry run first:
RENOVATE_TOKEN=xxx npx renovate owner/repo --dry-run

# Log level:
npx renovate --log-level=debug