renovate

What is renovate?

Renovate is a powerful tool for automating dependency updates in your projects. It helps keep your dependencies up-to-date, ensuring that your project remains secure and compatible with the latest versions of libraries and tools.

What are renovate's main functionalities?

Automated Dependency Updates

Renovate can automatically update your dependencies by creating pull requests for new versions. The configuration above extends the base configuration, which includes sensible defaults for most projects.

{
  "extends": ["config:base"]
}

Customizable Configuration

You can customize Renovate's behavior using a configuration file. In this example, packages that match the pattern '^@my-org/' are grouped together in a single pull request.

{
  "extends": ["config:base"],
  "packageRules": [
    {
      "packagePatterns": ["^@my-org/"],
      "groupName": "my-org packages"
    }
  ]
}

Scheduling Updates

Renovate allows you to schedule when updates should be created. The configuration above schedules updates to be created before 5 AM on Mondays.

{
  "extends": ["config:base"],
  "schedule": ["before 5am on monday"]
}

Other packages similar to renovate

dependabot

Dependabot is a GitHub-native tool for automating dependency updates. It is similar to Renovate in that it creates pull requests for new versions of dependencies. However, Dependabot is more tightly integrated with GitHub and may be easier to set up for users already using GitHub.

greenkeeper

Greenkeeper is another tool for automating dependency updates. It was one of the first tools in this space and offers similar functionality to Renovate. However, Greenkeeper has been deprecated in favor of Snyk, which now includes similar features.

snyk

Snyk is a comprehensive security tool that includes features for automating dependency updates. While it offers similar functionality to Renovate, Snyk also provides additional security features such as vulnerability scanning and remediation.

README

renovate

Keep npm dependencies up-to-date via Pull Requests

What does it do?

This script scans your repository package.json files, detects if any dependencies need version updating - or pinning - and if so then submits Pull Requests for each.

This was inspired by the services at Greenkeeper and Doppins.

Before you Start

To run this script, you will need to select a GitHub user account for it to create branches and submit Pull Requests from. The account will need read/write access to push and update upgrade branches to GitHub, as well as raise Pull Requests.

We recommend you consider using a "bot" account for this so that it's clear to other users of the repository that these are automated actions and not not confused with an actual team member's actions.

The script will need a GitHub Personal Access Token with "repo" permissions. You can find instructions for generating it here: https://help.github.com/articles/creating-an-access-token-for-command-line-use/

This token needs to be exposed via the environment variable RENOVATE_TOKEN or added to a configuration file.

Running the Script

To run the script from the command line, you will need Node.js version 6 or greater.

First, install dependencies for this script by running npm install.

The script can then be run like this:

npm start <username>/<repo> <path to package.json>

The <path to package.json> argument is optional, and is only needed if your package.json is located somewhere other than the root of the repository.

Example of running with default package.json location:

npm start foo/bar

Example of running with a custom package.json location:

npm start foo/bar src/package.json

Note: as mentioned above, you need to expose the environment variable RENOVATE_TOKEN. One way of doing it is like this:

RENOVATE_TOKEN=JDSUW284HSJDSFKSUS22942H2H15KK npm start foo/bar

Configuration file

It's also possible to configure renovate with a config.js file in the working directory. Here is an example:

module.exports = {
  token: 'JDSUW284HSJDSFKSUS22942H2H15KK',
  logLevel: 'verbose',
  repositories: [
    'foo/bar',
    'foo/baz',
    {
      name: 'foo/lint',
      packageFiles: [
        'package.json',
        'containers/build/package.json',
      ],
    },
    'foo/package-go',
  ],
};

As you can hopefully infer from the above, it's possible to define multiple repositories as well as multiple package files per repository, and they will be processed in sequence.

If you configure the token and at least one repository in your config.js then you don't need any CLI arguments and can just run npm start.

It's also possible to change the string templates used for generating branch names, commit messages, and Pull Request titles and body. To override the defaults, copy/paste/edit the templates from lib/config/default.js into your config.js. You must copy all of them, even if you only edit one.