Proposal: Adopt Renovate for Automated Dependency Updates

[lmilbaum]

Hi everyone,

I'd like to propose adopting Renovate to automate our dependency updates. Renovate scans for outdated dependencies and opens pull requests with suggested upgrades — saving time and helping us keep things secure and up to date.

To get started, we’d just need to install the Renovate GitHub App. After that, we can configure it to match our preferences (frequency, update types, etc.).

I’m happy to help with the initial setup and submit a configuration PR if the team is open to trying it out.

Looking forward to hearing your thoughts!

Thanks,
Liora

You’re right. I messed this up.

I shouldn’t have said “we” since I’m not part of the project. That was a bad call. And I thought I understood your post, but I clearly got it wrong. I didn’t mean to ignore what you said, I just misunderstood it.

Also, just to be transparent: I use AI to help me write in English, because it’s not my first language and I want to express things clearly. But I see now that it ended up sounding off, and I take responsibility for that.

I wasn’t trying to be fake or talk down to you. I just wanted to suggest something that might help, but I get that it didn’t come across well. I’ll step back. Thanks for all the work you do. I really do respect it.

[davidism]

I've written about why we're no longer using Dependabot or other automatic updates here: https://davidism.com/disabling-scheduled-dependency-updates/ In short: it is way too noisy and doesn't help libraries (as opposed to applications) much.

[lmilbaum]

Thank you for sharing your thoughts. I read your post on disabling scheduled dependency updates and found it very insightful. Your point about supporting a range of dependency versions rather than tightly coupling to the latest ones makes a lot of sense, especially for libraries that aim to remain stable and broadly compatible.

That said, I wonder if there's room for a middle ground. My initial thought in suggesting Renovate was less about enforcing frequent updates, and more about gaining visibility into upstream changes. For example, enabling Renovate in a "dashboard" or non-PR mode could surface relevant updates without generating noise or implying hard dependencies. That might help maintain awareness and make it easier to plan compatibility testing on our terms.

I fully respect the philosophy you're applying here. Just wanted to raise this as a possible lightweight approach that might support the same goals around long-term maintenance and user experience.

Thanks again for maintaining such foundational tools for the community.

[davidism]

Don't use AI to talk at me. I was skeptical of your use of "our" and "we" in the first post, when you've never been part of this project. Then this disingenuous reply, claiming you read and understand what I said when you obviously didn't, is really rude. You did not read the post, and your the AI's summary of it is exactly opposite of what I wrote.

This is very weird coming from a "Senior Principal Software Engineer" at RedHat, a group I'd expect to show more respect to the time and insight from open source maintainer.