# renovate Renovate is an open-source tool for automating software dependency updates, including pull requests to update dependencies and lock files. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Solving Gradle metadata and Renovate integration DevFeed: [Solving Gradle metadata and Renovate integration]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-08-16T00:00:00Z Content type: tutorial Language: en Sources: [Nicolas Fränkel]() Topics: [Gradle](), [renovate](), [Kotlin](), [Groovy]() Tags: [ci](), [dependencies](), [dependency](), [development](), [gradle](), [renovate](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview The article describes setting up Renovate for a Gradle project and investigating why merges of updated dependency versions caused build failures. It also discusses dependency verification and software supply chain risks. ### Source excerpt My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc. This week, I worked on improvements to a new project and set up Renovate. ## Running Renovate as a GitHub Action (and NO PAT!) DevFeed: [Running Renovate as a GitHub Action (and NO PAT!)]() Original publisher: [Read original article]() Published: 2026-01-19T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [renovate](), [GitHub Actions](), [octo sts](), [github personal access token](), [Security](), [maintenance]() Tags: [chainguard-containers](), [chainguard-images](), [dependabot](), [dependencies](), [github](), [github-action](), [github-pat-alternative](), [guide](), [maintenance](), [octo-sts](), [personal-access-token](), [renovate](), [run](), [security](), [software-supply-chain-security]() ### AI overview This tutorial explains how to run Renovate as a scheduled GitHub Action to update repository dependencies without using a long-lived GitHub Personal Access Token. It presents Octo STS as the replacement for the PAT and outlines the workflow setup. ### Source excerpt Discover how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS. ## Automatic updates of Docker images with Renovate Bot DevFeed: [Automatic updates of Docker images with Renovate Bot]() Original publisher: [Read original article]() Author: Tom Published: 2024-03-01T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Docker](), [Dockerfile](), [renovate](), [configuration]() Tags: [automate-docker-updates](), [bash](), [best-practices](), [dependencies](), [dependency](), [developers](), [devops](), [devops-best-practices](), [docker](), [docker-image-updates](), [docker-security](), [dockerfiles](), [how-to](), [linux](), [renovate](), [renovate-bot](), [renovate-vs-dependabot](), [security](), [updates]() ### AI overview A practical guide to automating Docker image and dependency updates with Renovate Bot. It explains how Renovate detects parent image changes, tracks binaries downloaded from sources such as GitHub or Maven, and uses custom comments and configuration to identify dependencies and propose or automatically merge updates. ### Source excerpt Learn how to automate Docker image updates using Renovate Bot, a versatile tool that supports various package managers and custom dependency links. ## Tips and tricks for using Renovate DevFeed: [Tips and tricks for using Renovate]() Original publisher: [Read original article]() Author: Harsh Shandilya Published: 2023-01-17T19:32:18Z Content type: tutorial Language: en Sources: [Posts on Harsh Shandilya]() Topics: [renovate](), [configuration](), [Dependabot](), [ci](), [GitHub Actions](), [Regular expression](), [Hugo](), [JavaScript](), [Netlify]() Tags: [config](), [configuration](), [dependabot](), [dependencies](), [dependency-management](), [github](), [github-actions](), [hugo](), [netlify](), [regex](), [renovate](), [tips]() ### AI overview A practical guide to using Renovate for dependency management. It covers disabling updates for selected packages, grouping related updates, setting semver bounds, detecting dependencies in non-standard declarations with regular expressions, securing GitHub Actions with exact commit SHAs, and automatically merging compatible updates. ### Source excerpt Renovate is an extremely powerful tool for keeping your dependencies up-to-date, and its flexibility is often left unexplored. I'm hoping to change that ## Configure renovate bot for npm at Homegate DevFeed: [Configure renovate bot for npm at Homegate]() Original publisher: [Read original article]() Author: Khanh Nguyen Published: 2022-05-23T12:29:19Z Content type: tutorial Language: en Sources: [Homegate Engineering Blog - Medium]() Topics: [renovate](), [npm](), [npm packages](), [configuration](), [GitLab](), [Automation](), [Development]() Tags: [automatic-deployment](), [automation](), [configuration](), [dependencies](), [github](), [gitlab](), [nodejs](), [npm](), [npm-packages](), [pipeline](), [pipelines](), [project](), [renovate](), [renovate-bot](), [review](), [security](), [upgrade](), [vulnerabilities]() ### AI overview This article explains how Homegate configured Renovate Bot to automate npm dependency updates across more than 200 repositories. It describes scheduled merge requests, concurrency limits, smart bundling, automatic merging for minor and development dependencies, review requirements for major upgrades, custom npm hosts, and team responsibilities for handling failures and breaking changes. ### Source excerpt Renovate bot is an automated dependency upgrade for npm packages. It supports many services such as gitlab & github. Homegate repositories structure At Homegate, we have over 200 repositories in micro-services architecture. Keeping services up to date is quite a big overhead. However, the benefits are obvious: Bugfixes New features Security issues / less vulnerabilities Evaluation session result from our engineering teamThe standard configuration We try to make process as automated and standardised as possible. The configuration will automatically create MRs for minor and major upgrade in our gitlab repos and auto-merge them. It is necessary to allow merge without approval in these repositories. Below you'll see our standard configuration with the following features: Schedule MR creations every hour on weekdays Limits apply (concurrent MRs / Rate of creation) Smart bundling can be configured, such as having all linters together or all of our shared frontend library related MRs together Auto-merge for minor and dev-dependencies Separation of major upgrade (requiring review) vs. minor upgrade (auto-merged) Configuration for custom npm host Each project has renovate.json that extends the standard homegate.json with custom config if necessary { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:base", ":prHourlyLimitNone", ":automergeLinters", ":automergeTesters", ":automergeTypes", ":automergeMinor", "group:definitelyTyped", "group:postcss", "group:linters", ":rebaseStalePrs", ":maintainLockFilesMonthly" ], "prConcurrentLimit": 2, "schedule": [ "after 6am and before 5pm every weekday" ], "ignoreDeps": ["node-sass", "stylelint", "stylelint-scss", "stylelint-config-standard", "stylelint-config-css-modules"], "packageRules": [ { "matchPackagePatterns": ["vue", "vue-router", "vuex"], "matchUpdateTypes": ["major"], "enabled": false }, { "matchPackagePatterns": ["^@aws-cdk", "aws-cdk"], "matchUpdateTypes": ["major"], "enabled": false }, { "d