Renovate/Dependabot: How to Take Back Control of Dependency Updates
summary
Shows how Dependabot and Renovate actually operate: configuration files live in dependabot.yml and renovate.json, Renovate can run as a Docker image or Kubernetes cronjob, and GitHub/GitLab integrations open PRs. Demonstrates managing many transitive dependencies (median 683), upgrading a package (from v632 to v667), auto‑merging a passing update, tagging 1.2.1 and deploying to Cloud Run; also covers grouping rules, presets (linters, automerge for patches), the dependency dashboard, PR rate limits (example: max 5), and Renovate self‑migration.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:16Why update dependencies
- 5:11Dependabot vs Renovate
- 7:17Basic tool setup
- 9:20Demo on GitLab project
- 11:04Renovate config customization
- 14:17Tracking updates with dashboard
- 16:11Successful setup tips
- 20:01Advanced automation with automerge
- 21:25Semantic Release integration
- 23:10Updating Renovate with Renovate
- 24:36Conclusion & Q&A
related talks
41mRenovate/Dependabot: How to Reclaim Control Over Dependency Updates
45mHow to Automate Dependency Updates with the Renovate@Roche Bot- 45mHow to Automate Dependency Updates with the Renovate@Roche Bot
25mRenovate, or how to keep your project up to date!
33mUsing Renovate to keep your version dependencies updated
16mRenovate to the Rescue
33mKeep your dependencies in check
33mAutomated update management with