renovate.json

renovate.json is the configuration file that drives the Renovate bot, an open-source tool that automates dependency updates across a repository. Renovate scans a project’s manifests, detects outdated dependencies, and opens pull requests to bump them; the renovate.json (or .renovaterc) file at the repository root is where you tell it how to behave. It turns dependency maintenance from a manual chore into a governed, repeatable pipeline step.

• Broad package-manager support - One config format spans npm, Docker, Maven, pip, Go modules, GitHub Actions, and dozens more ecosystems.
• Update policies - packageRules, schedule, and groupName let teams batch updates, pin versions, or hold back major bumps until they are ready.
• Presets and inheritance - Shareable extends presets let an organization standardize update behavior across every repository from one place.
• Automerge and stability - Rules can auto-merge low-risk updates and enforce minimum release age, keeping the dependency graph current without babysitting.

In API operations, renovate.json is a quiet but important part of supply-chain governance. Keeping SDKs, server frameworks, and toolchain dependencies patched is where a lot of API security posture actually lives, and codifying that policy in a versioned file makes it auditable rather than tribal knowledge. As more of this maintenance shifts to autonomous agents opening and reviewing pull requests, a declarative config like this becomes the machine-readable contract that keeps automated updates inside guardrails the team actually chose.