{"slug": "renovate", "name": "Renovate", "category": "other", "category_name": "Other software", "description": "", "recommenders": 4, "commenters": 5, "warners": 0, "score": 3.69, "rising": -1.31, "first": "2025-11-13", "latest": "2026-07-30", "why": "Every one of my new projects uses Renovate. Not having to worry about having to check dependencies, manually bump them, etc. is a great thing", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Every one of my new projects uses Renovate. Not having to worry about having to check dependencies, manually bump them, etc. is a great thing", "icon": true, "domain": "renovatebot.com", "github_repo": null, "official_url": "https://www.renovatebot.com", "pricing": "", "aliases": ["Renovate"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 785747953, "item_id": 49109247, "url": "https://news.ycombinator.com/item?id=49109247", "by": "mxmehl", "date": "2026-07-30", "stance": "recommend", "quote": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies.", "excerpt": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies. But I hate when bumped dependencies break things, especially if it's the same version update across multiple projects! OK, there are email notifications, but it's a hell of a noise if you're maintaining projects on multiple platforms (GitHub, GitLab, Gitea, ...) in different contexts (personal, work, volunteering, ...). So", "context": "", "use_case": "dependency updates", "switched_from": "", "story": "PRoctr \u2013 doctor/triage for your renovate/dependabot PRs"}, {"id": 753526833, "item_id": 47095427, "url": "https://news.ycombinator.com/item?id=47095427", "by": "adamdecaf", "date": "2026-02-20", "stance": "recommend", "quote": "We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass.", "excerpt": "govulncheck is the much better answer and we use it. We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass. I hardly notice when deps have small updates. https://github.com/search?q=org%3Amoov-io+is%3Apr+is%3Amerged+sort%3Anewest+author%3Arenovate%5Bbot%5D&type=pullrequests&s=created&o=desc", "context": "", "use_case": "automated dependency updates", "switched_from": "", "story": "Turn Dependabot Off"}, {"id": 747330672, "item_id": 46708167, "url": "https://news.ycombinator.com/item?id=46708167", "by": "Alupis", "date": "2026-01-21", "stance": "recommend", "quote": "Every one of my new projects uses Renovate. Not having to worry about having to check dependencies, manually bump them, etc. is a great thing", "excerpt": "I've contributed to Renovate in the past, helping bring new language support. It was intimidating for me, being my first contribution to such a large-scale, widely-used project - but the team was absolutely wonderful to work with and guided me through the process, including multiple PR's and rounds of reviews. The Renovate project has served as an example of how I want to structure and operate my own open source proj", "context": "Renovate contributor", "use_case": "automated dependency updates", "switched_from": "", "story": "The first 100 days as a Renovate maintainer"}, {"id": 741344385, "item_id": 46334024, "url": "https://news.ycombinator.com/item?id=46334024", "by": "hanspagel", "date": "2025-12-19", "stance": "recommend", "quote": "We use commit hashes to pin actions, have the version as a comment (e.g # v4) and renovate will keep both up to date in the PRs.", "excerpt": "From what I see, this does not help with pinning the dependencies and it doesn\u2019t verify the downloaded action has the same content as it used to have. In other words, this is a tiny patch on a big wound. We use commit hashes to pin actions, have the version as a comment (e.g # v4) and renovate will keep both up to date in the PRs. And there is a more or less recently added repository setting to require actions to be ", "context": "", "use_case": "keeping pinned actions updated", "switched_from": "", "story": "Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions"}]}], "caveats": [], "who": [{"by": "Alupis", "context": "Renovate contributor", "url": "https://news.ycombinator.com/item?id=46708167", "date": "2026-01-21"}, {"by": "nullify88", "context": "runs a home lab", "url": "https://news.ycombinator.com/item?id=45913852", "date": "2025-11-13"}], "tags": [], "use_cases": ["automated dependency updates", "dependency updates", "keeping pinned actions updated", "automated dependency update prs"], "compared": [{"slug": "dependabot", "name": "Dependabot", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 744615376, "item_id": 46538461, "url": "https://news.ycombinator.com/item?id=46538461", "by": "jamietanna", "date": "2026-01-07", "stance": "recommend", "quote": "Before I joined Mend to work on Renovate, I wrote https://news.ycombinator.com/item?id=40011111 which goes into some ways I found Renovate better than Dependabot", "excerpt": "Renovate maintainer and Community manager here Before I joined Mend to work on Renovate, I wrote https://news.ycombinator.com/item?id=40011111 which goes into some ways I found Renovate better than Dependabot, and it still very much holds true (although I'm a little more biased now!) You can also check out https://docs.renovatebot.com/bot-comparison/ for a high level comparison between the two Re costs / why giving t", "context": "Renovate maintainer and Community manager at Mend", "use_case": "automated dependency updates", "switched_from": "", "story": "How Dependabot Actually Works"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49109246", "title": "PRoctr \u2013 doctor/triage for your renovate/dependabot PRs", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47094192", "title": "Turn Dependabot Off", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46705512", "title": "The first 100 days as a Renovate maintainer", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46470927", "title": "How Dependabot Actually Works", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46289955", "title": "Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45902604", "title": "Helm 4.0", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {"recommend": 1}, "2026-01": {"recommend": 1}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 785747953, "item_id": 49109247, "url": "https://news.ycombinator.com/item?id=49109247", "by": "mxmehl", "date": "2026-07-30", "stance": "recommend", "quote": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies.", "excerpt": "I love bots like Renovate and Dependabot for taking care of updating my projects' dependencies. But I hate when bumped dependencies break things, especially if it's the same version update across multiple projects! OK, there are email notifications, but it's a hell of a noise if you're maintaining projects on multiple platforms (GitHub, GitLab, Gitea, ...) in different contexts (personal, work, volunteering, ...). So", "context": "", "use_case": "dependency updates", "switched_from": "", "story": "PRoctr \u2013 doctor/triage for your renovate/dependabot PRs"}, {"id": 753526833, "item_id": 47095427, "url": "https://news.ycombinator.com/item?id=47095427", "by": "adamdecaf", "date": "2026-02-20", "stance": "recommend", "quote": "We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass.", "excerpt": "govulncheck is the much better answer and we use it. We also let renovate[bot] (similar to dependabot) merge non-major dep updates if tests pass. I hardly notice when deps have small updates. https://github.com/search?q=org%3Amoov-io+is%3Apr+is%3Amerged+sort%3Anewest+author%3Arenovate%5Bbot%5D&type=pullrequests&s=created&o=desc", "context": "", "use_case": "automated dependency updates", "switched_from": "", "story": "Turn Dependabot Off"}, {"id": 747330672, "item_id": 46708167, "url": "https://news.ycombinator.com/item?id=46708167", "by": "Alupis", "date": "2026-01-21", "stance": "recommend", "quote": "Every one of my new projects uses Renovate. Not having to worry about having to check dependencies, manually bump them, etc. is a great thing", "excerpt": "I've contributed to Renovate in the past, helping bring new language support. It was intimidating for me, being my first contribution to such a large-scale, widely-used project - but the team was absolutely wonderful to work with and guided me through the process, including multiple PR's and rounds of reviews. The Renovate project has served as an example of how I want to structure and operate my own open source proj", "context": "Renovate contributor", "use_case": "automated dependency updates", "switched_from": "", "story": "The first 100 days as a Renovate maintainer"}, {"id": 741344385, "item_id": 46334024, "url": "https://news.ycombinator.com/item?id=46334024", "by": "hanspagel", "date": "2025-12-19", "stance": "recommend", "quote": "We use commit hashes to pin actions, have the version as a comment (e.g # v4) and renovate will keep both up to date in the PRs.", "excerpt": "From what I see, this does not help with pinning the dependencies and it doesn\u2019t verify the downloaded action has the same content as it used to have. In other words, this is a tiny patch on a big wound. We use commit hashes to pin actions, have the version as a comment (e.g # v4) and renovate will keep both up to date in the PRs. And there is a more or less recently added repository setting to require actions to be ", "context": "", "use_case": "keeping pinned actions updated", "switched_from": "", "story": "Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions"}, {"id": 734621633, "item_id": 45913852, "url": "https://news.ycombinator.com/item?id=45913852", "by": "nullify88", "date": "2025-11-13", "stance": "neutral", "quote": "I've grown sick of constant Renovate PRs against the helm charts in use", "excerpt": "Running my home lab at home, I've grown sick of constant Renovate PRs against the helm charts in use. I recall one \"minor\" update not long ago recently in CoreDNS was messing with the exposed ports in the service and installs broke for a lot of folks. If I need to run some software now, I `helm template` the resources and commit those to git. I'm so tired of some random \"Extended helm chart to customise labels / anno", "context": "runs a home lab", "use_case": "automated dependency update PRs", "switched_from": "", "story": "Helm 4.0"}]}