// the take
Renovate is an automated dependency update bot that scans your repo's package files and opens PRs when newer versions are available. It supports around 90 package managers and every major hosting platform (GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit), making it the closest thing to a universal answer to 'what updated my dependencies' for teams that don't want to do it by hand.
The package manager and platform coverage is genuinely unmatched — nothing else touches npm, Go, Python, Docker, Terraform, Bazel, and dozens more from one tool. Config is JSON5/JSON with a real schema and a migration system (lib/config/migrations) so old configs auto-upgrade instead of breaking on version bumps. Merge confidence and adoption data give you more than just 'a new version exists' when deciding whether to merge. It's been in production at scale for years (22k+ stars, Mend-backed, OpenSSF Scorecard badge) so the core update logic is well battle-tested.
Self-hosting it is nontrivial — you're running a Node service that needs tokens with broad repo/package registry access, and the config surface is huge enough that getting it dialed in for a monorepo with mixed ecosystems takes real tuning time. Cloud-hosted free tier only covers GitHub.com and Bitbucket Cloud; everything else (GitLab self-managed, Azure DevOps, on-prem) means self-hosting or paying for Mend Enterprise. AGPL-3.0 licensing is a real consideration if you're building anything that bundles or offers Renovate as a service. PR volume on a stale repo with many outdated deps can be overwhelming out of the box until you tune scheduling and grouping rules.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →