Renovate
Hacker ApprovedDependency update bot in Developer tools
Automates dependency update pull requests across many package ecosystems, with flexible configuration and a free self-hosted option.
Automates dependency update pull requests across many package ecosystems, with flexible configuration and a free self-hosted option.
30 people gave an opinion
- recommend it
- 27
- criticize it
- 3
- approval share
- 90%
Recommended in 9 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 27 people recommend itNeeds 10 or more, met.
- 9 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 9 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Automates dependency update pull requests
“Every one of my new projects uses Renovate. Not having to worry about having to check dependencies, manually bump them, etc. is a great thing even for small codebases.”
Comment from 21 Jan 2026 in “The first 100 days as a Renovate maintainer” “renovate bot is a good option for automating dependency updates via PRs”
Comment from 23 Apr 2026 in “Arch Linux Now Has a Bit-for-Bit Reproducible Docker Image” “Renovate keeps me up to date and git keeps everyone honest.”
Comment from 11 Jan 2026 in “2026 is the Year of Self-hosting” - Comment from 5 Dec 2025 in “Show HN: Gopin – Automatically pin latest to specific versions in Go install”
- Comment from 8 Dec 2025 in “GitHub Actions has a package manager, and it might be the worst”
- Comment from 20 Dec 2025 in “Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions”
- Comment from 20 Dec 2025 in “Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions”
Works across many package ecosystems
“Renovate is _much_ more robust / the number of $things that it can detect and is a lot more extensible”
Comment from 8 Jan 2026 in “How Dependabot Actually Works” “I particularly like its ability to synchronize updates to packages across ecosystems!”
Comment from 8 Jan 2026 in “How Dependabot Actually Works” “one of the benefits of Dependabot (and Renovate) are that they are language-agnostic”
Comment from 21 Feb 2026 in “Turn Dependabot Off” - Comment from 21 Feb 2026 in “Turn Dependabot Off”
- Comment from 24 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain”
- Comment from 21 Feb 2026 in “Turn Dependabot Off”
Updates pinned GitHub Action SHAs
“Renovate and Dependabot can update pinned SHA references in workflows automatically”
Comment from 24 Mar 2026 in “Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Secrets” “by default will raise PRs to change any tags for actions with the SHA instead”
Comment from 28 Apr 2026 in “GitHub Actions is the weakest link” “I agree that the SHA pinning PR updates are a very nice feature”
Comment from 28 Apr 2026 in “GitHub Actions is the weakest link” Free to use and self-host
“Mend Renovate Self-Hosted Community (commercial-but-free) Edition is a nice packaging and layer on top of the CLI”
Comment from 8 Jan 2026 in “How Dependabot Actually Works” “Both work with mend's renovate WITHOUT a license key”
Comment from 11 Feb 2026 in “Show HN: Renovate – The Kubernetes-Native Way”
What people recommend instead
The same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Dependabot | 42 | 47 | 47% | 12 | — | — |
| RenovateThis page | 27 | 3 | 90% | 9 | — | Approved |
What people said
40 of the 44 comments that mention it, newest first. Each links to the original comment.
“Using Renovate can be one of those processes.”
“Use renovate in the future to automatically update your containers”
“I have renovate set to automerge gitlab patch releases”
“Dont even need "AI" for that. Just renovate.”
“let renovate automatically update packages, whose safety will be determined by said tests”
“Dependabot (and renovate) do have "cooldowns" supported, just need to set them up.”
“You should be using CI to manage updates of lock files (e.g. dependabot, renovate)”
“Dependabot won't send them, and neither will Renovate last time I checked.”
“Renovate handles this well.”
“I agree that the SHA pinning PR updates are a very nice feature”
“by default will raise PRs to change any tags for actions with the SHA instead”
“which does basically the same thing across npm, PyPI, and Cargo in one config”
“Renovate can do it as well”
“renovate bot is a good option for automating dependency updates via PRs”
“Services like renovate and dependabot do this lifting at no cost to the js developer, and probably do it better.”
“Renovate and Dependabot can update pinned SHA references in workflows automatically”
“Renovate has a nice feature wherein it'll maintain transitive dependencies”
“one of the benefits of Dependabot (and Renovate) are that they are language-agnostic”
“Renovate supports far more ecosystems, has a better community and customisation.”
“supports far more ecosystems and customisation options (like auto merging)”
“I hardly notice when deps have small updates.”
“ime works much better for the npm ecosystem than Dependabot”
“we've had it for a while in Renovate too”
“Both work with mend's renovate WITHOUT a license key”
“Every one of my new projects uses Renovate. Not having to worry about having to check dependencies, manually bump them, etc. is a great thing even for small codebases.”
“Renovate keeps me up to date and git keeps everyone honest.”
“Mend Renovate CLI (AGPL-3.0-only) is free to use and run as you want, and many folks do - it's very flexible and scales well as-is”
“Mend Renovate Self-Hosted Community (commercial-but-free) Edition is a nice packaging and layer on top of the CLI”
“We have also worked via Renovate recently and are enjoying it. The dashboard is particularly nice for onboarding repos with lots of old deps”
“Renovate is _much_ more robust / the number of $things that it can detect and is a lot more extensible”
“I particularly like its ability to synchronize updates to packages across ecosystems!”
“renovate is the better product”
“This only handle your actions, not their dependencies”
“allow renovatebot handle this for you”
“renovate will keep both up to date in the PRs”
“Pin the action's version via a digest and use Renovate for updates.”
“renovatebot and dependabot can take care of that”
“I have configured Renovate to updat these for me”
“I'm one of the Renovate maintainers and have recently pushed for this to be more of a widely used feature”
“I've grown sick of constant Renovate PRs against the helm charts in use”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.