Renovate project

[ramikhd]

Assignment Proposal

Title

Automated Dependency Management and Package Updates with Renovate

Names and KTH ID

• Rami Khedair (khedair@kth.se)
• Dawa Arkhang (arkhang@kth.se)

Deadline

Week 6

Category

Demo

Description

Software projects rely on external packages that require continuous updates. Managing these manually leads to security vulnerabilities, outdated packages, and unnecessary effort.

This demo showcases how Renovate automates dependency management by monitoring repositories, detecting outdated packages, and creating Pull Requests for updates.

The demo covers scanning dependencies, CI validation, categorizing updates by impact (patch, minor, major), policy-based automerging, lock-file maintenance, and update grouping.

Relevance

Dependency maintenance is a key DevOps practice. Renovate replaces manual checking with continuous automated detection, shifting maintenance into standard Git/CI workflows. Automated testing provides immediate feedback before changes are integrated, maintaining stability while reducing technical debt.

Demo Plan (can be changed)

1. Problem: Show manual update overhead using a repository with outdated dependencies.
2. Setup: Show Renovate configuration rules (schedules, grouping, automerge rules).
3. Detection: Show Renovate identifying dependencies and generating PRs with changelogs.
4. CI Validation: Run automated build and test pipelines on the generated PR.
5. Update Policy: Highlight automerging for safe patch/minor updates versus manual review for major breaking changes.
6. Live Experiment (Extra): Modify a dependency version live to demonstrate Renovate detecting it, opening a PR, and triggering CI.

[ericcornelissen]

Thank you for the proposal, it looks quite good. The plan is quite clear and the topic is good. I also like that you tie it back to topics of earlier weeks through, e.g., the automated testing aspect.

My only concern is that it's bit simplistic. While the demo plans to cover a bunch of topics ("scanning dependencies, CI validation, categorizing updates by impact (patch, minor, major), policy-based automerging, lock-file maintenance, and update grouping."), most are pretty straightforward. Grouping and policy-based automerging could be quite interesting but from the description it seems these will be quite simple too.

To improve the proposal I'd like to see either 1) more interesting/complicated/advanced uses of the existing topics, 2) the addition of a more advanced topic such as dependency orchestration (monorepo, cross-repo), automated migrations, or custom dependency managers, or 3) the addition of 2 more topics such as dependency freshness, automated pinning, or security updates.