Renovate vs Dependabot

Both watch your manifests, open pull requests, and merge them without a human once your checks pass. Renovate is the configurable one and runs on most git hosts. Dependabot is built into GitHub and starts working before you write a config. The choice is mostly about where you host and how much you want to tune.

The short answer

Not on GitHub? Renovate, and the decision is over. On GitHub and happy with defaults? Dependabot, because it costs you no configuration. On GitHub with opinions about batching, timing, and what may merge on its own? Renovate pays for its config file. Running both is common and mostly harmless: you get duplicate PRs for the same bump.

RenovateDependabot
SetupA JSON config with ordered rules, plus shareable presets one org can inherit.One dependabot.yml per repo, an entry per ecosystem. Security updates need no config at all.
HostsGitHub, GitLab, Bitbucket, Azure DevOps, Gitea, Forgejo.GitHub.com and GitHub Enterprise Server. That is the service.
SchedulingPlain-language windows such as “after 10pm every weekday”, with a separate window for merges.Fixed intervals or a cron expression. Security updates ignore the schedule.
GroupingA group name on any rule bundles anything, across ecosystems. Known monorepo families group out of the box.Groups by pattern, dependency type, or update type, and across ecosystems. Security and version updates never share a PR.
MergingA config flag. It hands off to the host’s own auto-merge.No merge setting. You write an Actions workflow that merges, and grant it permissions the default token lacks.
Holding new releasesA minimum release age you set. Nothing appears until the release is old enough.A cooldown block, and since July 2026 a three-day cooldown applies by default on github.com. Never to security updates.
CoverageIts own README claims support for over 90 package managers, plus custom matchers for files nothing else reads.Around thirty ecosystems, curated by GitHub. What each one supports varies.
VisibilityA dashboard issue in the repo listing everything pending, held, or ignored.The security tab for alerts, and Insights, Dependency graph, Dependabot for version-update runs and their logs.
CostFree and open source, with a free hosted tier for public and private repos. Paid tiers buy throughput.Free on GitHub. Your merge workflow spends Actions minutes.

Verified against both projects’ documentation, August 2026.

The myth worth killing

“Bots open PRs, humans merge them” stopped being true a while ago. Renovate merges on a config flag. Dependabot merges through a small Actions workflow, with sharper edges: runs it triggers get a read-only token, its secrets live in a separate store, and a merge queue needs a token of your own. If your backlog is full of open update PRs, no tool is missing. Something else is stuck.

What neither one finishes

Both tools share one boundary: they change version numbers, not code. When an upgrade needs a renamed API updated at every call site, a config migrated, or a breaking major landed in sequence, the PR opens, the checks fail, and it waits for a person. That is the pile.

Where StackRadar sits

Keep whichever you run. StackRadar takes their pull requests and your scanners’ findings as input, ranks one backlog out of them, and puts agents on the work neither bot does: the code change, so your own CI can judge it and your policy can merge it. Longer versions per tool: StackRadar vs Renovate and StackRadar vs Dependabot.

StackRadar runs on GitHub today, fixing npm, Composer, and Python. Go, Rust, Java, Ruby, and .NET are planned.

Start free trialBook a walkthrough

Starts in observe mode. It merges nothing until a walkthrough hands you the dial.