#renovate — Public Fediverse posts

The fun side of self-hosting my GitHub Actions runners for private projects (and thus on private repos) is that I now have nearly 60+ pending pods after doing some Renovate fixes and upgrades

#home-lab #Renovate #GitHub #self-hosting #HomeLab #SelfHosting

Destination Market Street awards Dulan’s Soul Food Kitchen a $250,000 grant to expand and renovate https://www.diningandcooking.com/restaurants/14235/ #AdolfDulan #business #DestinationMarketStreet #downtown #Dulan'sSoulFoodKitchen #Food #grant #inglewood #PCRBusinessFinanceCapitalAndAdvisoryServices #renovate #Restaurant #SmallBusiness #SoulFood #SoulFoodKitchen #SoulFoodKitchens #SoulFoodRestaurant #SoulFoodRestaurants #TerryDulan #TrifilettiConsultingGroup

How did only learn about #Renovate last week?! I’m blown away. It’s so much better than dependabot in every way.

Not to mention it’s super simple to set up on my self-hosted #Forgejo instance too!

Amazing tool!

https://docs.renovatebot.com/

The moment you realize that Oracles latest changes to the #jdk release cadence (see https://blogs.oracle.com/java/transitioning-java-to-more-frequent-security-updates which permanently introduces a fourth version part) is not compatible with #Renovate that expects exactly three parts... Probably need to push a PR that ignores the second part which, currently, is always zero? 🤔

CVE Alert: CVE-2024-58376 - renovatebot - renovate - https://www.redpacketsecurity.com/cve-alert-cve-2024-58376-renovatebot-renovate/

#OSINT #ThreatIntel #CyberSecurity #cve-2024-58376 #renovatebot #renovate

CVE Alert: CVE-2019-25766 - renovatebot - renovate - https://www.redpacketsecurity.com/cve-alert-cve-2019-25766-renovatebot-renovate/

#OSINT #ThreatIntel #CyberSecurity #cve-2019-25766 #renovatebot #renovate

Wednesday Links - Edition 2026-08-19
https://dev.to/0xkkocel/wednesday-links-edition-2026-08-19-p3
#java #jvm #gradle #renovate #stream #json

Announcing some improvements to renovate-pretty-log-tui

https://fed.brid.gy/r/https://www.jvt.me/posts/2026/08/17/renovate-pretty-log/

In case you are wondering why under #NPM v12 the #renovate PRs are failing for root dependencies with an EALLOWREMOTE error: https://github.com/npm/cli/issues/9800

I see this problem with projects that depend on @aws-cdk/cloud-assembly-schema for example.

#AWS

My current company has settled on using #Gradle. It doesn’t make me very happy, but you need to learn to work with constraints.

This week, I worked on improvements to a new project and set up #Renovate However, I quickly noticed that merges of new dependency versions failed the build. Here’s the full story on why, and how I fixed the issue.

https://blog.frankel.ch/gradle-metadata-renovate-integration/

Renovate Bot Configuration: Automated Dependency Updates Without the Pain — hands-on guide for sysadmins. #renovate #dependency-management #devsecops

https://www.valtersit.com/guides/automation/renovate-bot-configuration-automated-dependency-updates-without-the-pain/

⚙️ mogenius/renovate-operator

Operator to streamline renovate executions in Kubernetes

Manages Renovate dependency updates in Kubernetes with CRD-based scheduling, parallel execution, and a built-in UI

⭐ Stars: 521
📅 Last Update: Jul 31, 2026

https://github.com/mogenius/renovate-operator

#selfhosted #homelab #selfhost #selfhosting #opensource #kubernetes #renovate

Gnah - debugging why #forgejo doesn't send me emails for pull requests done by renovate

Turns out #renovate runs as my user and of course it doesn't send emails for actions that I trigger myself!!

🤦‍♂️

@britter If you want to use #Codeberg's hosted #WoodpeckerCI for #Renovate, feel free to copy a pipeline definition from me, e.g. https://codeberg.org/mathisdt/trackworktime/src/branch/master/.woodpecker/renovate.yaml

You'll need some more configuration in #Woodpecker CI for it to run, from the top of my head:
- a cron entry named "renovate" (like the step)
- the secrets RENOVATE_TOKEN (a Codeberg token which has write access, this is used to create PRs) and GITHUB_COM_TOKEN (used by Renovate for querying for current versions on Github AFAIR)

Someone else doing infrastructure as code at home or so? I forked an k8s based tool to only require docker/podman to run renovate against local forges like @forgejo

https://git.h.oluflorenzen.de/finkregh/renovate-docker-operator
#selfhosted #renovate #forgejo @homelab

[Перевод] Защита CI/CD в open source-проекте, часть 3: учётные данные, верификация и что дальше

Команда VK Cloud перевела заключительную часть цикла Cilium про защиту цепочки поставок. Часть 1 была про контроль доступа, часть 2 — про укрепление зависимостей. Эта же часть о том, как изолировать секреты CI и продакшена за разными окружениями GitHub, подписывать каждый релиз без долгоживущих ключей через Sigstore Cosign, и какие пробелы безопасности остаются открытыми. Отдельно — разбор дорожной карты безопасности GitHub Actions на 2026 год и того, как платформенные изменения соотносятся с уже выстроенными контролями. Полезно DevOps- и SRE-инженерам, специалистам по безопасности и мейнтейнерам OSS-проектов.

https://habr.com/ru/companies/vktech/articles/1060782/

#vk_cloud #ci_cd #supply_chain #защита_зависимостей #open_source #управление_зависимостями #github_actions #renovate #sha_pinning

Just found out that #Renovate's "lockfile maintenance" does not enforce its own "minimumReleaseAge"... You have to set it in you package manager so it does not try to pull recent dependencies -_-

Renovate Bot broke prod with a lodash patch bump. Not the tool's fault — it was our config. Here's how to automate dependency updates without the 3-week post-mortem. #DevSecOps #Renovate

https://www.valtersit.com/guides/automation/renovate-bot-configuration-automated-dependency-updates-without-the-pain/

[Перевод] Защита CI/CD для open source-проекта: запираем зависимости

Команда VK Cloud перевела второй пост из серии трёх частей о том, как Cilium укрепляет свой CI/CD-конвейер. Первая часть рассказывала про управление доступом: кто может запускать сборки и какой CI-код разрешено исполнять. Этот пост про уровень зависимостей: какой код эти сборки подтягивают и как мы убеждаемся, что его не подделали.

https://habr.com/ru/companies/vktech/articles/1057736/

#vk_cloud #supply_chain #защита_зависимостей #open_source #управление_зависимостями #github_actions #renovate #sha_pinning #kubernetes #k8s

It's the silent changes... A #refactor of literally every moving part of https://github.com/madnuttah/unbound-docker took place!

Also implemented @renovatebot.com #renovate, @step_security #hardenrunners, #zizmor, #codeql & #Linting all the things.

CC @nlnetlabs 💚

#dns #dnssec #doq #quic #selfhosting #homelab #foss #opensource

[Перевод] Пакетным менеджерам пора ввести период охлаждения

Когда злоумышленник получает доступ к учетной записи мейнтейнера или захватывает заброшенный пакет, вредоносная версия может разойтись по тысячам проектов быстрее, чем ее успеют заметить. Один из способов снизить риск — ввести период охлаждения для зависимостей: не устанавливать новую версию пакета сразу после публикации, а ждать несколько дней, пока сообщество и вендоры безопасности успеют отреагировать. Публикуем перевод статьи Эндрю Несбитта о dependency cooldown и о том, как этот подход реализуют разные пакетные менеджеры и инструменты обновления зависимостей: npm, pnpm, Yarn, Bun, Deno, pip, uv, Poetry, Bundler, Cargo, Dependabot, Renovate и другие. Отдельно в материале рассматриваются различия между относительными интервалами и абсолютными датами, проблемы временных меток, исключения для обновлений безопасности и ограничения подхода в разных экосистемах.

https://habr.com/ru/companies/codescoring/articles/1044132/

#пакетные_менеджеры #зависимости #supply_chain_security #open_source #npm #PyPI #RubyGems #Dependabot #Renovate #dependency_cooldown

RE: https://mastodon.social/@hugovk/116399324188897230

Starting with v8.0.0, Astral switched setup-uv to immutable releases with no floating v8 tags. This is good for security.

But unfortunately #Dependabot and #Renovate couldn't upgrade from v7 to v8.0.0, and need a manual bump to get back on track. This is not so good for security.

I posted about this on the three social networks, someone tagged @www.jvt.me and soon after Renovate now supports this! 🎉

Here's his writeup into the world of #GitHubActions tags:
https://www.jvt.me/posts/2026/04/24/github-actions-tagging/

Configuring Renovate to only suggest updates that match your go directive.

https://fed.brid.gy/r/https://www.jvt.me/posts/2026/05/02/renovate-only-go-directive/

I'm on Fallthrough: No Country for Old Maintainers

https://fed.brid.gy/r/https://www.jvt.me/posts/2026/04/25/fallthrough-supply-chain/

A deep dive into the wild world of GitHub Actions' tagging formats

https://fed.brid.gy/r/https://www.jvt.me/posts/2026/04/24/github-actions-tagging/

I'm on Fallthrough: Supply Chain Reaction

https://fed.brid.gy/r/https://www.jvt.me/posts/2026/04/18/fallthrough-supply-chain/

mogenius/renovate-operator: Operator to streamline renovate executions in Kubernetes

"Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI."

Link: https://github.com/mogenius/renovate-operator

#linkdump #dependencies #development #kubernetes #renovate #tool

Do you use astral-sh/setup-uv@v7 in #GitHubActions?

And it's not hash-pinned?

And you use #Dependabot or #Renovate?

The setup-uv project has switched to only Vx.y.z tags, no more Vx or Vx.y.

But Dependabot and Renovate won't upgrade from Vx to Vx.y.z, so you'll need to manually update to [email protected] to keep up with future updates.

"To increase security even more we will stop publishing minor tags. You won't be able to use v8 or v8.0 any longer."

https://github.com/astral-sh/setup-uv/issues/830
#Python #uv

Minimum Release Age Is an Underrated Supply Chain Defense, by @daniakash.com:

https://daniakash.com/posts/simplest-supply-chain-defense/

#security #dependencies #npm #bun #pnpm #yarn #deno #renovate #dependabot #axios

Renovate ~ in best and most tender ways.

#Renovate