Renovate

Renovate is an automated dependency update tool that scans software projects for outdated or vulnerable dependencies and creates pull requests to update them. Originally created by Rhys Arkins in 2017 and now maintained by Mend (formerly WhiteSource) as an open-source project, Renovate has become the most comprehensive dependency management automation tool, with over 17,000 stars as of 2026. Renovate supports over 70 package managers and file formats including npm (package.json and package-lock.json), Composer (composer.json), pip (requirements.txt, setup.py, pyproject.toml), Go modules (go.mod), Cargo (Cargo.toml), Maven (pom.xml), Gradle, NuGet (.csproj, packages.config), Dockerfile (base image updates), Helm charts, Terraform modules, Ansible Galaxy roles, GitLab CI includes, GitHub Actions workflows, CircleCI orbs, Kubernetes manifests, and many more. Key features include: automatic semantic version-aware updates (distinguishing between major, minor, and patch updates with configurable per-package rules), grouping strategies (grouping related updates into a single PR to reduce noise), scheduling (limiting when PRs are created, e.g., only on weekends or after business hours), vulnerability-alert priority (prioritizing updates that fix known CVEs), auto-merge capability (automatically merging PRs that pass CI), Docker digests updates (updating image digests even without version changes), fork-based PRs (for restricted repositories), range strategy configuration (pinning vs. ranging), custom managers via regex (extending Renovate to any file format), shared configuration presets (reusable configuration across repositories), and per-repository, per-manager, and per-package fine-grained rules.