Use Renovate for dependency updates

Cost

Open source. AGPL-3.0 licence, free to run on your own servers or in CI. The hosted app from Mend is a free service.

How to do it

Renovate was first published in January 2017, and 44.175.0 came out on 21 October 2026. It works on GitHub, GitLab, Bitbucket and others, and groups updates in more ways than Dependabot. Run it yourself in CI, or install the free hosted app. Set the waiting time and merge rules as Update dependencies in small automatic steps says. Choose something else when a repository lives on GitHub and needs one file and no setup. Dependabot is a free GitHub service, not open source, and runs only on GitHub.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

# Self-hosted run, for example in a nightly CI job
docker run --rm -e RENOVATE_TOKEN renovate/renovate example-org/shop

JSON example

{
  "extends": ["config:recommended"],
  "minimumReleaseAge": "7 days",
  "packageRules": [{ "matchUpdateTypes": ["minor", "patch"], "groupName": "minor and patch" }]
}

How to check

The repository holds renovate.json and no .github/dependabot.yml, and the config covers every package manager and the CI workflow files.

Sources

• Renovate
• Dependabot

Related rules

• Update dependencies in small automatic steps in Engineering