Renovate
Overview
Renovate is an automated dependency update tool that scans repositories for dependency files across 50+ ecosystems (npm, pip, Docker, Go, Rust, Terraform, GitHub Actions) and creates pull requests with changelogs, release notes, and configurable automerge policies. It supports grouping, scheduling, and per-package rules to keep dependencies current without overwhelming teams.
Instructions
- When setting up Renovate, start with
config:recommended which provides sensible defaults for grouping, scheduling, and automerge, then add renovate.json to the repo root.
- When configuring automerge, enable it for low-risk updates (
@types/*, devDependencies patches) and disable it for major updates, using platformAutomerge for GitHub's native merge feature.
- When reducing PR noise, use
group:allNonMajor for a single weekly PR covering all minor and patch updates, and group monorepo packages (React, Angular, Babel) together.
- When setting schedules, configure update windows for low-traffic times (e.g.,
["after 9am and before 5pm every weekday"]) to avoid disrupting developers.
- When defining package rules, use
matchPackageNames, matchPackagePatterns, and matchUpdateTypes to set per-package automerge, grouping, and version strategies.
- When handling version strategies, pin exact versions in applications for reproducibility and use ranges in libraries for compatibility.
Examples
Example 1: Configure Renovate for a production monorepo
User request: "Set up Renovate with automerge for safe updates and weekly batching"
Actions:
- Create
renovate.json extending config:recommended and schedule:weekly
- Add package rules to automerge
@types/* and devDependency patches
- Group React, Next.js, and testing library packages into single PRs
- Enable the dashboard issue for an overview of all pending updates
Output: A Renovate configuration that automerges safe updates, batches non-major changes weekly, and groups related packages.
Example 2: Manage Docker and Terraform dependency updates
User request: "Keep Docker base images and Terraform provider versions up to date"
Actions:
- Configure Renovate to scan Dockerfiles and
.tf files
- Set
matchDatasources: ["docker"] with automerge: false for base image updates
- Group Terraform providers by cloud provider (AWS, GCP, Azure)
- Enable vulnerability alerts to prioritize updates that fix known CVEs
Output: Automated PRs for Docker and Terraform dependency updates with grouped providers and security prioritization.
Guidelines
- Start with
config:recommended since it handles grouping, scheduling, and automerge sensibly.
- Automerge
@types/* and devDependencies patches since they are low-risk and high-volume.
- Group monorepo packages (React, Vue, Angular, Babel, Jest) into single PRs to reduce noise.
- Schedule updates for low-traffic times to avoid disrupting developers during peak hours.
- Pin exact versions in applications and use ranges in libraries.
- Review major updates manually since breaking changes require human judgment.
1---2name: renovate3description: Assists with automating dependency updates across JavaScript, Python, Docker, Go, Rust, Terraform, and 50+ ecosystems using Renovate. Use when configuring update strategies, automerge policies, grouping rules, or scheduling to keep dependencies current. Trigger words: renovate, dependency updates, automerge, package rules, dependency management.4license: Apache-2.05---67# Renovate89## Overview1011Renovate is an automated dependency update tool that scans repositories for dependency files across 50+ ecosystems (npm, pip, Docker, Go, Rust, Terraform, GitHub Actions) and creates pull requests with changelogs, release notes, and configurable automerge policies. It supports grouping, scheduling, and per-package rules to keep dependencies current without overwhelming teams.1213## Instructions1415- When setting up Renovate, start with `config:recommended` which provides sensible defaults for grouping, scheduling, and automerge, then add `renovate.json` to the repo root.16- When configuring automerge, enable it for low-risk updates (`@types/*`, devDependencies patches) and disable it for major updates, using `platformAutomerge` for GitHub's native merge feature.17- When reducing PR noise, use `group:allNonMajor` for a single weekly PR covering all minor and patch updates, and group monorepo packages (React, Angular, Babel) together.18- When setting schedules, configure update windows for low-traffic times (e.g., `["after 9am and before 5pm every weekday"]`) to avoid disrupting developers.19- When defining package rules, use `matchPackageNames`, `matchPackagePatterns`, and `matchUpdateTypes` to set per-package automerge, grouping, and version strategies.20- When handling version strategies, pin exact versions in applications for reproducibility and use ranges in libraries for compatibility.2122## Examples2324### Example 1: Configure Renovate for a production monorepo2526**User request:** "Set up Renovate with automerge for safe updates and weekly batching"2728**Actions:**291. Create `renovate.json` extending `config:recommended` and `schedule:weekly`302. Add package rules to automerge `@types/*` and devDependency patches313. Group React, Next.js, and testing library packages into single PRs324. Enable the dashboard issue for an overview of all pending updates3334**Output:** A Renovate configuration that automerges safe updates, batches non-major changes weekly, and groups related packages.3536### Example 2: Manage Docker and Terraform dependency updates3738**User request:** "Keep Docker base images and Terraform provider versions up to date"3940**Actions:**411. Configure Renovate to scan Dockerfiles and `.tf` files422. Set `matchDatasources: ["docker"]` with `automerge: false` for base image updates433. Group Terraform providers by cloud provider (AWS, GCP, Azure)444. Enable vulnerability alerts to prioritize updates that fix known CVEs4546**Output:** Automated PRs for Docker and Terraform dependency updates with grouped providers and security prioritization.4748## Guidelines4950- Start with `config:recommended` since it handles grouping, scheduling, and automerge sensibly.51- Automerge `@types/*` and devDependencies patches since they are low-risk and high-volume.52- Group monorepo packages (React, Vue, Angular, Babel, Jest) into single PRs to reduce noise.53- Schedule updates for low-traffic times to avoid disrupting developers during peak hours.54- Pin exact versions in applications and use ranges in libraries.55- Review major updates manually since breaking changes require human judgment.
eliferjunior