Renovate

Overview

Renovate is an automated dependency update tool that scans repositories for dependency files across 50+ ecosystems (npm, pip, Docker, Go, Rust, Terraform, GitHub Actions) and creates pull requests with changelogs, release notes, and configurable automerge policies. It supports grouping, scheduling, and per-package rules to keep dependencies current without overwhelming teams.

Instructions

• When setting up Renovate, start with config:recommended which provides sensible defaults for grouping, scheduling, and automerge, then add renovate.json to the repo root.
• When configuring automerge, enable it for low-risk updates (@types/*, devDependencies patches) and disable it for major updates, using platformAutomerge for GitHub's native merge feature.
• When reducing PR noise, use group:allNonMajor for a single weekly PR covering all minor and patch updates, and group monorepo packages (React, Angular, Babel) together.
• When setting schedules, configure update windows for low-traffic times (e.g., ["after 9am and before 5pm every weekday"]) to avoid disrupting developers.
• When defining package rules, use matchPackageNames, matchPackagePatterns, and matchUpdateTypes to set per-package automerge, grouping, and version strategies.
• When handling version strategies, pin exact versions in applications for reproducibility and use ranges in libraries for compatibility.

Examples

Example 1: Configure Renovate for a production monorepo