Renovate Bot Cheat Sheet

Renovate automated dependency updates covering renovate.json config, presets, scheduling, and grouping rules.

1 PageBeginnerFeb 3, 2026

Base renovate.json

A practical starting config extending Renovate's recommended preset.

json

{  "$schema": "https://docs.renovatebot.com/renovate-schema.json",  "extends": [    "config:recommended",    ":semanticCommits",    "schedule:weekly"  ],  "labels": ["dependencies"],  "prConcurrentLimit": 10,  "rangeStrategy": "bump"}

Grouping & Package Rules

packageRules let you customize behavior per ecosystem or package pattern.

json

{  "packageRules": [    {      "matchPackagePatterns": ["^@types/"],      "groupName": "type definitions"    },    {      "matchUpdateTypes": ["minor", "patch"],      "matchCurrentVersion": "!/^0/",      "automerge": true    },    {      "matchDepTypes": ["devDependencies"],      "schedule": ["before 6am on monday"]    },    {      "matchPackageNames": ["react", "react-dom"],      "groupName": "react"    }  ]}

Lock File Maintenance & Vulnerability Alerts

Keep transitive deps fresh and get security PRs prioritized.

json

{  "lockFileMaintenance": {    "enabled": true,    "schedule": ["before 6am on the first day of the month"]  },  "vulnerabilityAlerts": {    "enabled": true,    "labels": ["security"]  },  "osvVulnerabilityAlerts": true}

Useful Built-in Presets

Shareable config bundles you can drop straight into `extends`.

config:recommended- sensible defaults for most repos, the standard starting point
:semanticCommits- prefixes commit/PR titles with fix:/chore: based on update type
:dependencyDashboard- opens/maintains a single issue listing all pending updates
schedule:weekly / schedule:nonOfficeHours- controls when PRs are raised to reduce noise
:automergeMinor- automatically merges minor/patch updates that pass CI
group:monorepos- groups updates from packages published from the same monorepo

Pro Tip

Enable the Dependency Dashboard preset even if you don't need it day-to-day — it gives you a single searchable issue showing every pending, rate-limited, and rejected update, which is invaluable when auditing why a specific package hasn't been bumped.

Was this cheat sheet helpful?

Buildkite Cheat Sheet

Docker Multi-Stage Builds Cheat Sheet