Renovate is an alternative to Dependabot or CompatHelper for keeping dependencies up to date. Renovate and Dependabot both support multiple programming language ecosystems, so you can use one tool for multiple ecosystems.
Renovate supports Julia from version 44.221.0. Unlike Dependabot, it is not tied to GitHub: it runs on most platforms, including GitHub (e.g. with the Mend Renovate GitHub app), GitLab, Azure DevOps, Bitbucket, Gitea and Forgejo. It can even be run locally (see below for details).
It updates the [compat] entries of every Project.toml (and JuliaProject.toml) in the repository, docs/ and test/ included, against the General registry. As CompatHelper and Dependabot do, it widens the range by default: "0.10, 0.11" with 0.12.1 released becomes "0.10, 0.11, 0.12". It skips the julia entry and the standard libraries.
A renovate.json like the following is sufficient - in combination with a runner such as the Renovate GitHub App:
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:recommended"]
}
As demonstrated by GitHub - stemann/RenovateExample.jl · GitHub, with Dependency Dashboard · Issue #1 · stemann/RenovateExample.jl · GitHub.
Renovate’s packageRules can match test dependencies, whether they’re in [targets] or in test/Project.toml, for example to group their updates:
{
"packageRules": [
{
"matchManagers": ["julia"],
"matchDepTypes": ["test"],
"groupName": "test dependencies"
},
{
"matchManagers": ["julia"],
"matchFileNames": ["**/test/Project.toml"],
"groupName": "test dependencies"
}
]
}
Documentation: Automated Dependency Updates for Julia - Renovate Docs
Self-hosting
Running locally, e.g. for self-hosting a Renovate runner for GitLab, can be accomplished with:
RENOVATE_PLATFORM=gitlab \
RENOVATE_TOKEN=secret_token_for_your_gitlab_user \
npx --yes renovate@44.221.0
Also consider env vars, LOG_LEVEL=debug, and, e.g., RENOVATE_DRY_RUN=lookup when testing - and whether to set RENOVATE_AUTODISCOVER=true or list the repositories that Renovate should process with RENOVATE_REPOSITORIES.
Pending changes
Notable pending enhancements:
- registries other than General, private ones included: feat(datasource): add `julia` datasource - Pull Request #47699 - renovatebot/renovate - GitHub
- updating
Manifest.toml: feat(manager/julia): update `Manifest.toml` - Pull Request #47788 - renovatebot/renovate - GitHub - release notes and changelogs in Renovate’s PRs: Add repo and subdir to info.json - Pull Request #82 - JuliaRegistries/GeneralMetadata.jl - GitHub (with a follow-up in the renovate repo)
- reading locked versions from the manifest, needed for vulnerability alerts from the Julia Security Advisory Database: feat(manager/julia): extract locked versions - Pull Request #47863 - renovatebot/renovate - GitHub
Also, note the pending fix: fix(versioning/julia): widen to the bare major from 1.0 on - Pull Request #47795 - renovatebot/renovate - GitHub