<story><title>Why I recommend Renovate over any other dependency update tools</title><url>https://www.jvt.me/posts/2024/04/12/use-renovate/</url></story><parent_chain></parent_chain><comment><author>gbrindisi</author><text>I don&amp;#x27;t understand why Github does not invest more into Dependabot. Everyone need something like this, and Github is positioned to offer the best sca tool there is. And yet... stuff like grouping has only been recently added.&lt;p&gt;Anyhow, this is useful to rollout dependabot.yaml config at scale: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;github&amp;#x2F;evergreen&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;github&amp;#x2F;evergreen&lt;/a&gt;</text></comment>
<story><title>Why I recommend Renovate over any other dependency update tools</title><url>https://www.jvt.me/posts/2024/04/12/use-renovate/</url></story><parent_chain></parent_chain><comment><author>vlovich123</author><text>Cloudflare adopted Renovate when I worked there. Not sure if it was the config wasn’t good (we did try to wrangle with it a bit by customizing), but I found it to be a lot more pain that it was worth. PRs that wouldn’t build would be opened, trivial dependency updates that weren’t worth the PR time would be proposed, etc.&lt;p&gt;There’s also the security aspect of supply chain attacks of “button press” updates.&lt;p&gt;I think having reports sent to repo owners that they can review with the team on a periodic basis instead of click-through maintenance might be a better model but I also understand the desire for mindless automation of what seems like a chore.</text></comment>