Renovate — Automated Dependency Update Bot

What it is

Renovate is an open-source tool that automates dependency updates by scanning repositories for outdated packages and opening pull requests with the latest versions. Unlike simple bots, it supports 90+ package managers and gives you full control over grouping, scheduling, and automerge rules.

Renovate targets engineering teams that want to eliminate the manual work of keeping projects secure and up to date. It handles package.json, Dockerfile, Helm charts, Terraform modules, Go modules, and dozens more dependency formats.

How it saves time or tokens

Manually checking for dependency updates, reading changelogs, and creating pull requests is time-consuming and error-prone. Renovate automates the entire cycle: scan for updates, generate changelogs, create PRs, and optionally automerge minor/patch updates when CI passes. Grouping related updates (e.g., all ESLint packages) into a single PR reduces review overhead. Rate limiting prevents PR floods that overwhelm reviewers.

How to use

1. Install the hosted Mend Renovate GitHub App (zero config):

# Visit github.com/apps/renovate and install on your repositories
# Renovate opens an onboarding PR with a default renovate.json config

1. Or run Renovate locally via npx:

npx renovate --token $GITHUB_TOKEN --repositories your-org/your-repo

1. Customize behavior with a renovate.json in your repository:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "packageRules": [
    {
      "matchPackagePatterns": ["eslint"],
      "groupName": "eslint",
      "automerge": true
    }
  ],
  "schedule": ["before 7am on Monday"]
}

Example

A comprehensive Renovate configuration for a production monorepo:

{
  "extends": ["config:recommended", ":automergeMinor"],
  "baseBranches": ["main"],
  "labels": ["dependencies"],
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "automerge": true,
      "automergeType": "branch"
    },
    {
      "matchPackagePatterns": ["@types/*"],
      "groupName": "type-definitions",
      "automerge": true
    },
    {
      "matchManagers": ["dockerfile"],
      "groupName": "docker-images"
    }
  ],
  "prConcurrentLimit": 5,
  "schedule": ["after 10pm and before 5am every weekday"]
}

Related on TokRepo

• DevOps tools — More CI/CD and infrastructure automation tools on TokRepo.
• Testing tools — Browse testing and validation tools for software projects.

Common pitfalls

• Not configuring grouping leads to dozens of individual PRs for related packages. Group packages by ecosystem (eslint, babel, testing) to reduce review load.
• Enabling automerge without adequate CI coverage risks merging breaking changes. Ensure your test suite covers critical paths before turning on automerge.
• Running Renovate without a schedule means PRs appear at random times. Set a schedule that aligns with your team's review workflow.