Renovate
Automated dependency update PRs with merge confidence and smart scheduling.
About
Renovate, maintained by Mend, is the open-source engine that automatically opens pull requests for dependency updates across 90+ package managers, from npm and Maven to Docker images, Terraform modules, and GitHub Actions. It groups related updates, schedules them around your workflow, and uses crowdsourced merge-confidence data to flag risky upgrades and auto-merge the safe ones.
Compared with Dependabot, Renovate's edge is first-class grouping, scheduling, lock-file maintenance, and config presets shareable from a central repo. The core CLI is free and community-driven; Mend packages it as free hosted Community and paid Enterprise editions with advanced security checks and scheduling. For teams drowning in stale dependencies and zero-day fire drills, it is the standard way to keep hundreds of repos current without manual toil.
What it can do
- Automated update PRs across 90+ package managers
- Merge Confidence from crowdsourced test data
- Grouping, scheduling, and automerge rules
- Lock-file maintenance and major-update gating
- Self-hosted CLI or managed Community/Enterprise
Setup
Install the Mend Renovate GitHub App or run the CLI as a container scheduled in CI with a renovate.json config.
Prerequisites
Repositories with declared dependencies; CI checks for safe automerging.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 88; Trending score 78/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.