# renovate Published articles for renovate. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## GitHub agentic workflows and Renovate DevFeed: [GitHub agentic workflows and Renovate]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-02T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [GitHub](), [GitHub Actions]() Tags: [agentic-workflow](), [dependencies](), [github](), [github-actions](), [github-agentic-workflows](), [pull-requests](), [renovate](), [rollback](), [technical]() ### AI overview This article explains how Renovate dependency updates can break GitHub agentic workflows by changing an action SHA without updating the matching generated scripts. It also describes a failed recompilation workflow that rolled back an unrelated Node.js update, then identifies the need to keep the generated lock file synchronized with its release. ### Source excerpt I've been a big fan of Renovate for a couple of years already. Renovate scans your repositories, detects outdated package versions, and opens pull requests to automatically bump them. It's similar to Dependabot in that it keeps your dependencies up to date. If I had to compare them in one sentence, I'd say Renovate is less integrated in the GitHub ecosystem, but handles more ecosystems and, more importantly, is extensible. ## Running Renovate as a GitHub Action (and NO PAT!) DevFeed: [Running Renovate as a GitHub Action (and NO PAT!)]() Original publisher: [Read original article]() Published: 2026-01-19T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [renovate](), [GitHub Actions](), [octo sts](), [github personal access token](), [Security](), [maintenance]() Tags: [chainguard-containers](), [chainguard-images](), [dependabot](), [dependencies](), [github](), [github-action](), [github-pat-alternative](), [guide](), [maintenance](), [octo-sts](), [personal-access-token](), [renovate](), [run](), [security](), [software-supply-chain-security]() ### AI overview This tutorial explains how to run Renovate as a scheduled GitHub Action to update repository dependencies without using a long-lived GitHub Personal Access Token. It presents Octo STS as the replacement for the PAT and outlines the workflow setup. ### Source excerpt Discover how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS. ## An Ode to Defense in Depth DevFeed: [An Ode to Defense in Depth]() Original publisher: [Read original article]() Published: 2025-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [GitHub](), [Security](), [Open Source](), [Maintainers]() Tags: [2025](), [automation](), [awareness](), [chainguard](), [defense-in-depth](), [github](), [maintainers](), [open-source](), [pull-requests](), [renovate](), [secrets](), [security](), [software-supply-chain-security](), [spoof](), [supply-chain](), [supply-chain-security](), [team]() ### AI overview Chainguard describes how a March 14, 2025 supply chain attack compromised tags in the tj-actions/changed-files GitHub repository, causing a malicious commit to dump action-runner memory and potentially expose secrets. The article outlines Chainguard's defense-in-depth response, including blocking affected updates, suspending some automation, checking affected repositories, contacting customers and maintainers, and treating build systems like production systems. ### Source excerpt Chainguard's defense in depth approach to security helped protect it from the recent tj-actions/changed-files GitHub repository compromise. Learn more about how. ## Using Renovate to update build JDK DevFeed: [Using Renovate to update build JDK]() Original publisher: [Read original article]() Published: 2025-01-08T00:00:00Z Content type: tutorial Language: en Sources: [Jake Wharton]() Topics: [Java](), [GitHub Actions](), [ci](), [Spring Boot](), [JSON](), [Development](), [Homebrew](), [toolchains]() Tags: [build](), [ci](), [dependencies](), [github-actions](), [gradle](), [java](), [jdk](), [json](), [jvm](), [renovate](), [toolchains](), [update]() ### AI overview This article explains how to use Renovate to keep the JDK used by a GitHub Actions CI build updated automatically. It moves the Java version into a .github/.java-version file, configures setup-java to read that file, and adds a custom regex manager in renovate.json to update the file. The approach allows local development with the latest JDK while preserving compatibility with older Java versions for targeting and testing. ### Source excerpt You want to be using the latest JDK for development. Don't use Gradle toolchains, they'll needlessly force you to use old JDKs. You can still target and test on old JVM versions but develop with the latest and greatest. Java and the JDK are literally built for this. Locally this hasn't been a problem. Homebrew (or your favorite equivalent) will keep your default JDK at the latest. Keeping my GitHub actions up-to-date, however, frequently slips my mind. I find projects using 19 or 20 simply because I haven't touched the CI build in the two years since 19 or 20 was the latest. We're already using Renovate to keep dependencies up to date. With a little extra programming in JSON (wince) we can have the JDK version updated to latest as well. First, migrate the existing build JDK version in your GitHub Action to a .github/.java-version file1. 21 Next, change the setup-java action to use this file rather than a hard-coded version. - uses: actions/setup-java@v4 with: distribution: 'zulu' - java-version: 21 + java-version-file: .github/.java-version Finally, in your renovate.json52, add a custom manager to update this file3. ignorePresets: [ // Ensure we get the latest version and are not pinned to old versions. 'workarounds:javaLTSVersions', ], customManagers: [ // Update .java-version file with the latest JDK version. { customType: 'regex', fileMatch: [ '\\.java-version$', ], matchStrings: [ '(?.*)\\n', ], datasourceTemplate: 'java-version', depNameTemplate: 'java', // Only write the major version. extractVersionTemplate: '^(?\\d+)', }, ], Commit, push, and wait for Renovate to send you a PR4. Now your CI build automatically tracks the latest JDK. I'm putting the .java-version file into the .github/ folder because I don't want to force this version on people using jenv or the like. The whole point of this setup is you can build with any version of Java newer than our very, very old baseline of Java 8 (although things like Gradle have a higher minimum ## Automatic updates of Docker images with Renovate Bot DevFeed: [Automatic updates of Docker images with Renovate Bot]() Original publisher: [Read original article]() Author: Tom Published: 2024-03-01T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Docker](), [Dockerfile](), [renovate](), [configuration]() Tags: [automate-docker-updates](), [bash](), [best-practices](), [dependencies](), [dependency](), [developers](), [devops](), [devops-best-practices](), [docker](), [docker-image-updates](), [docker-security](), [dockerfiles](), [how-to](), [linux](), [renovate](), [renovate-bot](), [renovate-vs-dependabot](), [security](), [updates]() ### AI overview A practical guide to automating Docker image and dependency updates with Renovate Bot. It explains how Renovate detects parent image changes, tracks binaries downloaded from sources such as GitHub or Maven, and uses custom comments and configuration to identify dependencies and propose or automatically merge updates. ### Source excerpt Learn how to automate Docker image updates using Renovate Bot, a versatile tool that supports various package managers and custom dependency links. ## Using Renovate Bot to automate Kubernetes container image updates DevFeed: [Using Renovate Bot to automate Kubernetes container image updates]() Original publisher: [Read original article]() Author: Techno Tim Published: 2023-07-01T13:00:00Z Content type: tutorial Language: en Sources: [Techno Tim]() Topics: [Automation](), [Kubernetes](), [Docker](), [Pull Request](), [GitHub](), [Open Source](), [Command-line interface]() Tags: [automation](), [cli](), [docker](), [docker-container](), [github](), [kubernetes](), [open-source](), [pull-requests](), [renovate]() ### AI overview This video tutorial explains how Renovate Bot scans dependencies and automates pull requests for updated container images. It focuses on configuring Renovate for Kubernetes resources and discusses running it through a Node module, CLI, Docker, Kubernetes, or hosted Git-provider integrations. ### Source excerpt Keeping track of container image updates is hard. I started using Renovate Bot to to track these for me and I now get pull requests from a bot for my Docker and Kubernetes container images. It's a game changer. A HUGE thanks to Datree for sponsoring this video! Secure Your Kubernetes, Prevent Misconfigurations https://www.datree.io 📺 Watch Video Why use Renovate? How much time do you sp... ## Tips and tricks for using Renovate DevFeed: [Tips and tricks for using Renovate]() Original publisher: [Read original article]() Author: Harsh Shandilya Published: 2023-01-17T19:32:18Z Content type: tutorial Language: en Sources: [Posts on Harsh Shandilya]() Topics: [renovate](), [configuration](), [Dependabot](), [ci](), [GitHub Actions](), [Regular expression](), [Hugo](), [JavaScript](), [Netlify]() Tags: [config](), [configuration](), [dependabot](), [dependencies](), [dependency-management](), [github](), [github-actions](), [hugo](), [netlify](), [regex](), [renovate](), [tips]() ### AI overview A practical guide to using Renovate for dependency management. It covers disabling updates for selected packages, grouping related updates, setting semver bounds, detecting dependencies in non-standard declarations with regular expressions, securing GitHub Actions with exact commit SHAs, and automatically merging compatible updates. ### Source excerpt Renovate is an extremely powerful tool for keeping your dependencies up-to-date, and its flexibility is often left unexplored. I'm hoping to change that ## Configure renovate bot for npm at Homegate DevFeed: [Configure renovate bot for npm at Homegate]() Original publisher: [Read original article]() Author: Khanh Nguyen Published: 2022-05-23T12:29:19Z Content type: tutorial Language: en Sources: [Homegate Engineering Blog - Medium]() Topics: [renovate](), [npm](), [npm packages](), [configuration](), [GitLab](), [Automation](), [Development]() Tags: [automatic-deployment](), [automation](), [configuration](), [dependencies](), [github](), [gitlab](), [nodejs](), [npm](), [npm-packages](), [pipeline](), [pipelines](), [project](), [renovate](), [renovate-bot](), [review](), [security](), [upgrade](), [vulnerabilities]() ### AI overview This article explains how Homegate configured Renovate Bot to automate npm dependency updates across more than 200 repositories. It describes scheduled merge requests, concurrency limits, smart bundling, automatic merging for minor and development dependencies, review requirements for major upgrades, custom npm hosts, and team responsibilities for handling failures and breaking changes. ### Source excerpt Renovate bot is an automated dependency upgrade for npm packages. It supports many services such as gitlab & github. Homegate repositories structure At Homegate, we have over 200 repositories in micro-services architecture. Keeping services up to date is quite a big overhead. However, the benefits are obvious: Bugfixes New features Security issues / less vulnerabilities Evaluation session result from our engineering teamThe standard configuration We try to make process as automated and standardised as possible. The configuration will automatically create MRs for minor and major upgrade in our gitlab repos and auto-merge them. It is necessary to allow merge without approval in these repositories. Below you'll see our standard configuration with the following features: Schedule MR creations every hour on weekdays Limits apply (concurrent MRs / Rate of creation) Smart bundling can be configured, such as having all linters together or all of our shared frontend library related MRs together Auto-merge for minor and dev-dependencies Separation of major upgrade (requiring review) vs. minor upgrade (auto-merged) Configuration for custom npm host Each project has renovate.json that extends the standard homegate.json with custom config if necessary { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:base", ":prHourlyLimitNone", ":automergeLinters", ":automergeTesters", ":automergeTypes", ":automergeMinor", "group:definitelyTyped", "group:postcss", "group:linters", ":rebaseStalePrs", ":maintainLockFilesMonthly" ], "prConcurrentLimit": 2, "schedule": [ "after 6am and before 5pm every weekday" ], "ignoreDeps": ["node-sass", "stylelint", "stylelint-scss", "stylelint-config-standard", "stylelint-config-css-modules"], "packageRules": [ { "matchPackagePatterns": ["vue", "vue-router", "vuex"], "matchUpdateTypes": ["major"], "enabled": false }, { "matchPackagePatterns": ["^@aws-cdk", "aws-cdk"], "matchUpdateTypes": ["major"], "enabled": false }, { "d