Renovate config

renovate.json → schedule

Configure Renovate for automatic dependency updates, automating PRs for security fixes.

Use it when you want update automation: Renovate (from Mend) generates PRs for outdated dependencies (including vulnerable ones) with the renovate.json configuration — the schedule (when), groups, and major version policies. It's SCA automation: dependencies updated by Renovate PRs (with CI validating) and security fixes applied without manual work. In DevSecOps, Renovate complements Dependabot: fine-grained configuration (schedule, grouping) and monorepo updates. The renovate.json defines the policy: dependencies are updated with the CI gate.

Don't use it without CI validating PRs: Renovate generates PRs — CI validation (tests, SCA) is what allows confident merging; without CI, Renovate PRs pile up unreviewed. And watch out: automatic major updates break things (breaking changes): the policy (separate or grouped majors) must be configured with care. The Renovate bot requires installation (GitHub app) and a token. For security alerts (not updates), use Dependabot (024); Renovate is broad automation.