Renovate Has a Free Dependency Update Bot — Automated PRs for Outdated Packages

#devops #dependencies #automation #security

Renovate is a dependency update automation tool that creates PRs for outdated packages.

What You Get for Free

Multi-platform — GitHub, GitLab, Bitbucket, Azure DevOps, Gitea
Multi-language — npm, pip, Maven, Go, Rust, Docker, Terraform, Helm, and 100+
Smart scheduling — group updates, schedule non-disruptive times
Auto-merge — merge patches automatically if tests pass
Changelogs — PR includes changelog and release notes
Vulnerability alerts — prioritize security updates
Monorepo support — handles workspace dependencies
Custom rules — pin, group, schedule per dependency
Dashboard — Dependency Dashboard issue for overview
Free hosted — Mend Renovate GitHub App, zero setup

Quick Start

# GitHub: Install Mend Renovate app from GitHub Marketplace (free)
# It auto-creates a config PR — merge it, and updates start flowing

# Or self-hosted
npx renovate --platform=github --token=xxx --repositories=org/repo

# renovate.json (customize behavior)
{
  "extends": ["config:base"],
  "automerge": true,
  "automergeType": "pr",
  "packageRules": [
    { "matchUpdateTypes": ["patch"], "automerge": true }
  ]
}

Why Teams Choose It Over Dependabot

Dependabot is GitHub-only and limited:

Multi-platform — works on GitLab, Bitbucket, Gitea too
Grouping — combine related updates into single PRs
Auto-merge — patch updates merge without human review
More ecosystems — Docker, Terraform, Helm (Dependabot lacks these)

A team was getting 30 Dependabot PRs per week — too noisy to review. They switched to Renovate with grouping and auto-merge — patches merge automatically, minor updates are grouped, and they review 5 PRs instead of 30.