renovatebot/renovate
Renovate
Renovate is a GitOps-driven dependency management engine designed to automate the maintenance of software projects. It functions as an automated update tool that scans repository files to identify outdated dependencies, fetches the latest compatible versions from external sources, and generates pull requests to apply those updates. By integrating directly with code hosting platforms, it synchronizes project dependencies through declarative configuration files, ensuring that software components remain current and secure.
The project distinguishes itself through its platform-agnostic architecture and comprehensive policy enforcement capabilities. It utilizes a hierarchical configuration system that allows for the propagation of standardized update policies across multiple repositories, while supporting custom dependency extraction for non-standard or proprietary file formats. To ensure reliability, it incorporates confidence signals derived from community data and provides intelligent automerge logic that triggers only when updates meet specific safety criteria.
Beyond core updates, the tool manages the full lifecycle of infrastructure components, including container image tags and pipeline versions. It handles complex tasks such as lockfile synchronization by invoking native build tools in isolated environments, and it maintains supply chain security by monitoring for abandoned packages and integrating with private package registries. The system also offers granular control over update scheduling, grouping, and reviewer assignment to minimize developer overhead.
Renovate is distributed as a containerized application or package, supporting deployment across various infrastructure environments. It provides extensive observability through operational dashboards, debug log visualization, and status check labeling to assist in monitoring the health and progress of automated update workflows.
Features
- Automated Update Managers - Scans project files to identify outdated dependencies and generates pull requests to apply updates.
- Configuration Inheritance - Provides a hierarchical configuration system that merges global, repository-level, and preset-based settings to enforce update policies.
- Update Managers - Provides a centralized interface to track pending updates, view logs, trigger tasks, and manage manual approvals.
- Dependency Management - Automates the maintenance of software dependencies by scanning for updates and creating pull requests.
- GitOps Dependency Synchronizers - Synchronizes repository dependencies through declarative configuration files using GitOps principles.
- Software Supply Chain Security - Automates the monitoring and updating of dependencies and container images to maintain secure and consistent software builds.
- Reusable Configuration Blocks - Centralizes and propagates standardized update policies across multiple repositories by referencing reusable configuration files.
- Platform Integrations - Integrates with code hosting platforms to manage dependency updates across multiple repositories from a centralized location.
- Project Lockfile Management - Automatically regenerates lockfiles after dependency updates to ensure consistent and stable development environments.
- Package Registry Integrations - Authenticates with private and public package registries to resolve and validate software component versions.
- Repository Management - Executes dependency updates across several repositories from a single centralized pipeline using cross-project access permissions.
- Event-Driven - Orchestrates dependency update tasks by triggering logic sequences based on repository scanning, webhooks, and periodic schedules.
- Configuration Overrides - Forces specific settings to take precedence over other rules or repository-level configurations to ensure mandatory policies.
- Project Configuration Managers - Defines how dependency updates are managed through global settings, repository-specific files, and centralized presets.
- Cross-Repository Policy Propagators - Centralizes and propagates standardized update policies across multiple repositories to maintain consistent standards.
- Access Tokens - Manages personal access tokens and app installation tokens to authorize automated actions within development environments.
- API Abstraction Layers - Normalizes interactions with multiple code hosting services through a unified interface for repository and pull request management.
- Developer Tooling - Automated dependency update management.
- Dependency Management - Automated multi-language dependency update management.
- Metadata-Driven - Applies semantic versioning and community data to determine the safety and necessity of automated dependency changes.
- Container Image Management - Monitors and updates container image tags and digests within infrastructure files.
- Semantic Versioning Systems - Parses and compares version strings using semantic versioning or project-specific release patterns to identify updates.
- Extraction Plugins - Parses diverse project files using modular extractors to identify version declarations and dependency metadata.
- Automated Onboarding - Automatically creates initial pull requests with default configuration files to help new projects adopt standards.
- Configuration Merge Strategies - Applies preferred merge styles for pull requests and automatically selects alternatives to ensure successful integration.
- Build Tool Integrations - Identifies and updates module versions and URLs within build configuration files by querying remote registries.
- Pull Request Merging Tools - Automatically merges pull requests once safety criteria and test suites are satisfied.
- Repository Discovery Tools - Scans platforms for available projects and selectively includes them based on permission levels and repository settings.
- Subprocess Management - Invokes native package managers and build tools in isolated environments to regenerate lockfiles and validate updates.
- Dependency Tracking - Defines custom patterns to locate and track dependencies in non-standard or proprietary file formats.
- Update Reliability Signals - Uses community data to provide insights on update reliability for safer dependency management.
- Update Grouping Engines - Consolidates multiple dependency updates into single pull requests to reduce management overhead.
- Abandoned Dependency Detectors - Identifies and flags abandoned software packages to help developers proactively replace unmaintained code.
- Platform Versioning Tools - Adjusts behavior based on detected platform versions to enable features like merge trains or specific pull request formatting.
- Pipeline Task Versioning - Retrieves task version information from platform APIs to keep pipeline configurations accurate and up to date.
- Pull Request Review Tools - Applies multiple users to pull requests to improve collaboration when platform tiers support concurrent assignment.
- Update Maintenance Windows - Automates dependency updates using declarative scheduling and maintenance windows to minimize developer interruptions.
- Identity Configurations - Configures author name and email for automated commits to ensure compliance with platform-specific push rules.
- Sensitive Variable Redaction - Automatically masks sensitive credentials and tokens from log output to prevent accidental exposure during automated operations.
