Renovate

Renovate

@renovatebot.com

Open Source Automated Dependency Updates by Mend 22k+ ⭐ - GitHub πŸ‘‰ https://github.com/renovatebot/renovate

27 followers4 following61 posts

Renovate reposted

aly
@aly.codes

i cannot stress enough that if you are self-hosting shit you need to set up some sort of CI bot that will auto bump versions for you. won't protect you from compromised updates, but you really should not be running out of data versions of the commonly self-hosted apps

Renovate
@renovatebot.com

We're back after a great week at #OpenSourceSummit, where we've had some great chats with users, registry operators, security researchers and other Open Source projects, and have a tonne of exciting new things we want to work on!

Renovate reposted

Kostas Konstantinidis
@codesennin.com

Automatic dependency update PR-raising tooling! We actually introduced Renovate recently in our azure devops CICD pipeline setup and it works pretty well. For years we didn’t have a dependabot- like solution and I am glad that we now have Renovate to cover that gap!

The Lobste.rs RSS feed@lobsters-feed.bsky.social

Why I recommend Renovate over any other dependency update tools (2024) https://lobste.rs/s/kt0yxd #programming

jvt.meWhy I recommend Renovate over any other dependency update tools Β· Jamie Tanna | Software EngineerExplaining why Renovate is going to be my solution to keeping up-to-date with dependencies and it's not likely to change any time soon.
Renovate
@renovatebot.com

We've announced 1 Critical, 2 High and 1 Moderate security advisories - we recommend you upgrade to a minimum of 44.79.0 (2026-09-10) More info: github.com/renovatebot/...

github.com[SECURITY]: Announcing 1 Critical, 2 High and 1 Moderate advisories Β· renovatebot renovate Β· Discussion #46549We're announcing 4 GitHub Security Advisories (GHSAs) that affect the Renovate CLI. There are 1 Critical, 2 High and 1 Moderate advisories. It is recommended that you upgrade to a minimum of Renova...
Renovate
@renovatebot.com

We're excited to announce that Renovate maintainers Sebastian Poxhofer and Jamie Tanna will be at @linuxfoundation.org's Open Source Summit Europe in Prague in a couple of weeks, and look forward to meeting folks who are there We'll also be at the @openssf.org's Community Day, too

Renovate
@renovatebot.com

Renovate maintainer Jamie Tanna looks back at the last year of being Renovate's Project Lead, and shares some interesting stats about how the project and the wider ecosystem have changed: www.jvt.me/posts/2026/0...

jvt.meLooking back at my first year as the Renovate Project Lead Β· Jamie Tanna | Software EngineerReviewing some of the key highlights of my last year working as the Renovate Project Lead, and showing some stats about the project, its community and myself.
Renovate
@renovatebot.com

We've announced 9 High and 1 Moderate security advisories on #Renovate. We recommend updating to 44.14.7 (2026-08-07) at a minimum See github.com/renovatebot/... for more details

github.com[SECURITY]: Announcing 9 High and 1 Moderate security vulnerabilities in Renovate Β· renovatebot renovate Β· Discussion #45495We're announcing 10 GitHub Security Advisories (GHSAs) that affect the Renovate CLI. There are 9 High and 1 Moderate findings. It is recommended that you upgrade to a minimum of Renovate 44.14.7. T...

Renovate reposted

Erkan Doğan
@erkan.erkandogan.tr.ap.brid.gy

Renovate, repolarınızdaki bağımlılıkları otomatik tarayıp güncel sürümler için pull request açan açık kaynak bir bot. Dependabot'tan farkları, kurulumu, ârnek renovate.json yapılandırması ve self-hosted CI'da kullanımı bu yazıda.

erkandogan.trRenovate Bot Nedir, Neden KullanmalΔ±sΔ±nΔ±z?BağımlΔ±lΔ±k gΓΌncellemeleri, Γ§oğu geliştiricinin ihmal ettiği ama teknik borcun en hΔ±zlΔ± biriktiği alanlardan biri. package.json, requirements.txt, Dockerfile, GitHub Actions workflow'larΔ±... hepsi zamanla eskir ve bir gΓΌn kritik bir gΓΌvenlik açığıyla karşınΔ±za Γ§Δ±kar. Renovate tam olarak bu sorunu çâzmek iΓ§in var. ## Renovate Nedir? Renovate, repolarΔ±nΔ±zdaki bağımlΔ±lΔ±klarΔ± otomatik olarak tarayan, gΓΌncel sΓΌrΓΌmleri tespit eden ve her gΓΌncelleme iΓ§in ayrΔ± bir pull request aΓ§an aΓ§Δ±k kaynak bir bottur. Mend (eski adΔ±yla WhiteSource) tarafΔ±ndan geliştirilir ve GitHub, GitLab, Bitbucket, Azure DevOps gibi platformlarda Γ§alışır. Dependabot'a benzese de Renovate Γ§ok daha esnek bir yapΔ±landΔ±rma sistemine sahiptir. npm, pip, Docker, Terraform, GitHub Actions, Cargo, Go modules dahil onlarca ekosistemi tek bir araΓ§la yΓΆnetebilirsiniz. ## Neden Dependabot Değil de Renovate? * **Tek yapΔ±landΔ±rma dosyasΔ±** β€” `renovate.json` ile tΓΌm repo genelinde tutarlΔ± kurallar tanΔ±mlanΔ±r. * **Gruplama desteği** β€” Δ°lgili paketleri (ΓΆrneğin tΓΌm `eslint-*` paketlerini) tek bir PR'da toplayabilirsiniz, PR kalabalığı azalΔ±r. * **Zamanlama kontrolΓΌ** β€” GΓΌncellemelerin sadece belirli saatlerde/gΓΌnlerde aΓ§Δ±lmasΔ±nΔ± sağlayabilirsiniz (mesai dışı gece build'lerini tetiklememek gibi). * **Otomatik merge** β€” Minor/patch seviyesindeki düşük riskli gΓΌncellemeler iΓ§in testler geΓ§erse otomatik merge tanΔ±mlanabilir. * **Daha geniş ekosistem desteği** β€” Docker base image'larΔ±, Helm chart'larΔ±, Terraform provider'larΔ± gibi Dependabot'Δ±n zayΔ±f kaldığı alanlarda daha gΓΌΓ§lΓΌ. ## Kurulum GitHub ΓΌzerinde en pratik yol Renovate GitHub App'i kurmak: 1. github.com/apps/renovate adresinden uygulamayΔ± yΓΌkleyin. 2. Erişim vermek istediğiniz repolarΔ± seΓ§in. 3. Bot ilk taramadan sonra otomatik olarak bir "Configure Renovate" PR'Δ± aΓ§ar; bu PR varsayΔ±lan `renovate.json` dosyasΔ±nΔ± iΓ§erir. Kendi altyapΔ±nΔ±zda (self-hosted GitLab, Gitea vb.) Γ§alıştΔ±rmak isterseniz `renovate` npm paketini CLI olarak veya resmi Docker image'Δ± ΓΌzerinden CI pipeline'Δ±nda da Γ§alıştΔ±rabilirsiniz. ## Γ–rnek YapΔ±landΔ±rma json { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["config:recommended"], "timezone": "Europe/Istanbul", "schedule": ["after 22:00 every weekday", "every weekend"], "packageRules": [ { "matchUpdateTypes": ["minor", "patch"], "automerge": true }, { "matchPackagePatterns": ["^eslint"], "groupName": "eslint packages" } ], "vulnerabilityAlerts": { "enabled": true, "labels": ["security"] } } Bu ΓΆrnekte: * GΓΌncellemeler yalnΔ±zca mesai dışı saatlerde aΓ§Δ±lΔ±yor. * Minor ve patch seviyesindeki gΓΌncellemeler testler geΓ§erse otomatik birleşiyor. * ESLint ile ilgili paketler tek PR'da gruplanΔ±yor. * GΓΌvenlik açığı bulunan paketler iΓ§in ayrΔ±, etiketlenmiş uyarΔ±lar oluşturuluyor. ## Self-Hosted Ortamlarda KullanΔ±m Proxmox/Docker tabanlΔ± bir altyapΔ±da Γ§alışan projeler iΓ§in Renovate'i bir cron job veya GitHub Actions scheduled workflow olarak tetiklemek yaygΔ±n bir pattern. Γ–rneğin: yaml name: Renovate on: schedule: - cron: '0 3 * * *' workflow_dispatch: jobs: renovate: runs-on: ubuntu-latest steps: - uses: renovatebot/github-action@v40 with: configurationFile: renovate.json token: ${{ secrets.RENOVATE_TOKEN }} Bu, harici bir servise bağımlΔ± olmadan kendi CI altyapΔ±nΔ±z ΓΌzerinden tam kontrol sağlar. ## Pratik Δ°puΓ§larΔ± * **`config:recommended` ile başlayΔ±n** β€” SΔ±fΔ±rdan kural yazmak yerine ΓΆnerilen preset ΓΌzerine küçük ΓΆzelleştirmeler eklemek daha sΓΌrdΓΌrΓΌlebilir. * **Dashboard PR'Δ±nΔ± kapatmayΔ±n** β€” Renovate, tΓΌm bekleyen gΓΌncellemeleri listeleyen bir "Dependency Dashboard" issue'su aΓ§ar; bu genel gΓΆrΓΌnΓΌm iΓ§in değerlidir. * **Lock file maintenance'Δ± aktif edin** β€” `lockFileMaintenance` seΓ§eneği, doğrudan versiyon değişikliği olmasa bile lock dosyasΔ±nΔ± dΓΌzenli tazeler. * **Major gΓΌncellemeleri ayrΔ± tutun** β€” Major sΓΌrΓΌm atlamalarΔ± genelde breaking change iΓ§erir; bunlarΔ± otomerge dışında bΔ±rakΔ±p manuel gΓΆzden geΓ§irin. ## SonuΓ§ Renovate, "bağımlΔ±lΔ±klarΔ± gΓΌncel tutma" işini insan hafΔ±zasΔ±ndan Γ§Δ±karΔ±p sΓΌrece dΓΆnüştΓΌrΓΌyor. Δ°lk kurulumu birkaΓ§ dakika sΓΌrse de, uzun vadede gΓΌvenlik aΓ§Δ±klarΔ±nΔ± erken yakalamak ve teknik borcu biriktirmemek aΓ§Δ±sΔ±ndan kazandΔ±rdığı zaman katbekat fazla. Küçük bir yapΔ±landΔ±rma dosyasΔ±yla başlayΔ±p ihtiyaca gΓΆre kurallarΔ± genişletmek en sağlΔ±klΔ± yaklaşım.
Renovate
@renovatebot.com

If you're in the preview for GitHub Actions Lockfiles, but are waiting for Dependabot to ship support for updating them, Renovate's had support since Tuesday :) And a few other things GitHub Actions-y too!

Renovate
@renovatebot.com

As folks may have noticed - Renovate 44 was (accidentally) released yesterday with a non-breaking change. Please treat Renovate 44.0.0 as 43.x, and upgrade as normal!

Renovate
@renovatebot.com

You can read more about why this happened + what we've done to reduce the risk of this happening again in github.com/renovatebot/...

github.comRenovate 44 was accidentally released as a major version (with a non-breaking change) Β· renovatebot renovate Β· Discussion #44952Renovate 44.0.0 was incorrectly released from #44004 due to the BREAKING CHANGE reference in the commit message. To be very clear - the changes in 44.0.0 are not breaking changes. Renovate uses Squ...

Renovate reposted

aly
@aly.codes

Of all the bots I think renovatebot is the #1 GOAT and Claude is maybe #3

Renovate
@renovatebot.com

There are patched versions available for Renovate 42.x and 43.x, and the Mend Renovate Self-Hosted Community and Enterprise edtions (CE and EE)

Renovate
@renovatebot.com

Renovate maintainer @www.jvt.me.web.brid.gy writes about some of the things he's learned in the last 100 days since joining #Renovate - some good behind-the-scenes tidbits in here πŸ‘€ www.jvt.me/posts/2026/0...

jvt.meThe first 100 days as a Renovate maintainer: the shocking inside view of a popular Open Source project Β· Jamie Tanna | Software EngineerLessons learned from the first 100 days as my role as a Renovate maintainer, and a sneak peek into how the project works behind the scenes.
Renovate
@renovatebot.com

Why does #Renovate use GitHub Discussions for our user support? Community Manager @www.jvt.me.web.brid.gy took the opportunity to look into the history, off the back of recent discussion around #Ghostty, and wrote an in-depth post about it: github.com/renovatebot/...

github.comWhy do we use GitHub Discussions as our triage process? Β· renovatebot renovate Β· Discussion #40306Over the weekend, there has been some good discussion on Hacker News about how the Ghostty project uses GitHub Discussions for triage purposes, and then promotes the feature request/bug reports int...
Renovate
@renovatebot.com

FYI: We've changed the `GOSUMDB` environment variable on the Mend-hosted Renovate Cloud infrastructure, which may lead to impact to users with private Go modules. As we've noted in github.com/renovatebot/..., this is due to previously used settings leaving users open to supply chain attacks

github.comChanges to default `GOSUMDB` environment variable on the Mend Developer Platform (and what it means for private Go modules) Β· renovatebot renovate Β· Discussion #40041NoteThis only affects Renovate Cloud on developer.mend.io (Mend Developer Platform), and does not modify anything for users of the Renovate CLI deployed as part of any self-hosted usage. This also ...
Renovate
@renovatebot.com

Renovate maintainer and community manager @www.jvt.me.web.brid.gy recently spoke to Josh Bressers on the #OpenSourceSecurity podcast all about #Renovate, the "fun" of updating dependencies, and more! opensourcesecurity.io/2025/2025-12...

opensourcesecurity.ioUpdating open source dependencies with Jamie TannaJosh discusses updating open source dependencies with Jamie Tanna. Jamie works on Renovate which gives them a lot of insight into the challenges of keeping your open source updated. We discuss the cha...
Renovate
@renovatebot.com

Today we've released #Renovate v42 onto the Mend Developer Platform (developer.mend.io) so y'all will start being protected by some of the big changes we've made - check out the details below:

Renovate@renovatebot.com

#Renovate 42 is now out πŸš€ Our latest major release with a number of breaking changes is released, most notably: