Renovate vs Dependabot for a Self-Hosted Homelab: Best Use Cases and the Difficulties That Bite

If you have been following the automation side of this blog, you already know half of this story. The release-tracking workflow makes sure you notice when a new version lands on any forge, and the Docker vs Podman and Compose vs Kubernetes posts keep the runtime decisions honest.

What none of them answer is the question that shows up the moment your homelab holds more than a handful of git repositories: who opens the update pull requests? For most people the default is Dependabot, because it is built into GitHub and it is free. For anyone who self-hosts the forge itself, the answer is almost always Renovate.

In this post we’ll see what each one actually is, how you get both running, the best use cases for each, and the Renovate difficulties that only appear after the onboarding pull request is merged.

I run both, in different places. GitHub-hosted repositories get Dependabot, because on GitHub.com there is no reason to run anything else. The self-hosted Gitea instance gets Renovate, because Dependabot has no official support for Gitea at all. If everything you own lives on GitHub, this post is mostly about why you might still want the extra machinery. If you run Gitea, Forgejo, GitLab, or any self-hosted forge, it is about the only serious option.

The short version

• Dependabot is the zero-config option. It is built into GitHub, watches standard ecosystem manifests, and opens pull requests on a schedule you declare. No daemon, no dashboard, no arbitrary-file updates, no automerge.
• Renovate is the configurable option. A standalone bot that runs on Azure, Bitbucket, Forgejo, Gitea, GitHub, GitLab, and more, with a manager list past a hundred formats, grouping out of the box, and a Dependency Dashboard that Dependabot does not have.
• The homelab fork is the forge. If you self-host Gitea or Forgejo, Dependabot does not officially run there. Self-hosted Renovate is the answer.
• Renovate's power is its configuration, and the configuration is the difficulty. packageRules, regexManagers, and schedules are genuinely powerful, and genuinely easy to get subtly wrong.
• Neither tool makes updates safe. Both open the pull requests. CI, branch protection, and a merge policy decide whether the bump lands.

What each tool actually is

Dependabot: the GitHub-native bot

Dependabot is a service built into GitHub that opens pull requests for outdated and vulnerable dependencies. You enable it by committing one file, .github/dependabot.yml, in which each ecosystem gets a package manager, a directory, and a schedule. It checks for new versions, opens one pull request per update or per configured group, and attaches the changelog plus a compatibility score.

Security updates, driven by GitHub Advisory Database alerts, can run independently of version updates. The core is the MIT-licensed dependabot-core project, written in Ruby; its README says it can open pull requests against GitHub, GitHub Enterprise, Azure DevOps, GitLab, Bitbucket, and AWS CodeCommit, but only GitHub and Azure DevOps are official, and the community scripts that used to bolt it onto other forges have been broken since March 2023.

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: docker
    directory: /
    schedule:
      interval: weekly
      day: saturday
      time: '02:00'
    open-pull-requests-limit: 5
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: monthly
    groups:
      dev-deps:
        dependency-type: development
        update-types: [minor, patch]

That file is the whole control surface: ecosystems, schedules, and limits. There is no daemon to run, no database, no cron to babysit. The pull requests arrive in your normal review flow, and the compatibility badge tells you how many other repositories pass CI on the proposed version.

Renovate: the bot you configure and run anywhere

Renovate is a dependency-update bot from Mend, licensed AGPL-3.0 and written in TypeScript. It runs as the hosted Mend Renovate app, as a GitHub Action or GitLab Runner job, as the npm CLI, or as a Docker container you schedule yourself.

Its manager list covers more than a hundred package formats, including categories Dependabot has no concept of: regex-based updates for arbitrary files, docker-compose files, Helm charts, Ansible content, and raw version strings in any file.

The pipeline is different too. Renovate discovers dependencies, runs them through your rules, and decides whether to open, group, skip, or auto-merge pull requests, then reports the whole thing on a Dependency Dashboard issue that is on by default. First contact with a repository is an onboarding pull request that proposes a renovate.json. Merge it, and the bot takes over.

Hands-on: Dependabot in ten minutes

On GitHub.com there is nothing to install. Create the config above, push it, and the bot starts opening pull requests. The only real decisions are the schedule, the grouping, and the open-pull-request limit. The one thing Dependabot cannot do is merge its own work, so the standard pattern is a small Actions workflow that approves and auto-merges only Dependabot's pull requests:

name: Dependabot automerge
on: pull_request
permissions:
  contents: write
  pull-requests: write
jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Approve
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Enable auto-merge
        run: gh pr merge --auto --merge "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Hands-on: self-hosted Renovate

Self-hosting is one container plus one token. Create a dedicated bot account on your forge, issue a personal access token with repository read and write scope, put it in a 0600 environment file, and run the container on a schedule. The official docs recommend hourly if you can.

$ docker run --rm \
    -e RENOVATE_PLATFORM=gitea \
    -e RENOVATE_ENDPOINT=https://git.home.arpa/api/v1 \
    -e RENOVATE_TOKEN=glpat-... \
    -e RENOVATE_REPOSITORIES=sysadmin/infra \
    renovate/renovate:44

# schedule it with a systemd timer or cron; Renovate exits after each run

Two tokens matter here. RENOVATE_TOKEN authenticates the bot to your forge. RENOVATE_GITHUB_COM_TOKEN is optional but strongly recommended: Renovate uses it to fetch changelogs and release notes from GitHub.com, which is what makes the pull requests it opens useful, and without it changelog features degrade silently. Neither belongs in the command line or in git.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "labels": ["dependencies"],
  "dependencyDashboard": true,
  "schedule": ["after 2am every saturday"],
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "groupName": "minor and patch updates",
      "automerge": true
    }
  ],
  "regexManagers": [
    {
      "fileMatch": ["^docker-compose\\.ya?ml$"],
      "matchStrings": ["image: (?<depName>.*?):(?<currentValue>.*?)\\s"],
      "datasourceTemplate": "docker"
    }
  ]
}

That config does three representative things: groups all minor and patch updates into one pull request and auto-merges them, schedules work for Saturday after 2 AM, and adds a regexManager that can update image tags inside a docker-compose file that Dependabot would ignore entirely. The regexManager is the feature that makes Renovate the answer on a homelab, and it is also the one that will cost you an evening.

Best use cases

• GitHub-only and zero-config: Dependabot. The stack fits the built-in ecosystems, the config is one small file, and the security-update pipeline is wired into GitHub advisories.
• Self-hosted forge: Renovate. Gitea, Forgejo, GitLab, and a self-hosted GitHub Enterprise all work, because the platform list is official and broad.
• Monorepos and many related packages: Renovate. The group:monorepos preset and custom groups combine what would otherwise be a wall of pull requests. Dependabot groups manually and does not combine common monorepo packages.
• Docker tags, compose files, Helm, Ansible, or any version string in any file: Renovate. regexManagers are the only practical way to automate updates for things that have no package manager.
• PR noise is the problem: Renovate. Grouping plus automerge collapses a flood into a trickle. Dependabot groups exist, but the controls are coarser.
• Security updates as the whole job: Dependabot. The advisory-driven flow is GitHub-native territory. Renovate can read OSV data, but the alert pipeline is not its home turf.

The difficulties that bite

Both tools have rough edges, and the honest review spends most of its time on Renovate, because Dependabot's surface is small enough that its limits are visible up front. The Renovate list, in the order they actually bite:

• The configuration is the product, and it has a learning curve. Presets, packageRules, regexManagers, templates. The onboarding pull request proposes a minimal baseline, and the real work starts after you merge it.
• A rule that matches nothing is silent. A mistyped option or a matchFields that never fires produces no error, and you find out weeks later when the group you expected arrives as twenty separate pull requests. Run renovate-config-validator before each change and read the logs after every run.
• regexManagers are powerful and fiddly. You are writing regular expressions against real files and hoping the datasource template is right. A careless pattern matches too much, and garbage regex produces garbage pull requests.
• Merge confidence is Mend-hosted data. The four badges, age, adoption, passing, confidence, come from an API that defaults to developer.mend.io. Public repositories work out of the box; private ones need a token, and the extra data can read as noise.
• Self-hosted OSS is stateless and exits after each run. You own the cron. Miss the schedule and nothing updates. The docs recommend hourly, the default image downloads its tools at runtime, and the full image weighs several gigabytes.
• The bot token is a credential. Use a dedicated bot account, keep the token in a 0600 environment file, scope it to the repositories it should touch, and rotate it like every other secret. AGPL-3.0 is fine for internal self-hosting; read the license before redistributing a modified bot.
• Dependabot's limits are structural. No arbitrary-file updates, no built-in automerge, coarse grouping, GitHub-only in practice, schedules limited to intervals, and the PR volume that pushed teams toward Renovate in the first place.
• Automerge without a green CI gate merges broken builds. Both tools will happily skip the human if you let them. Branch protection and required checks come first, automation second.

Renovate vs Dependabot at a glance

Which should you pick?

• Choose Dependabot when everything is on GitHub.com, the stack fits the built-in ecosystems, zero-config matters more than control, and advisory-driven security updates are the priority.
• Choose Renovate when the forge is self-hosted, you need grouping and automerge without extra workflows, or your dependencies live in files no standard manager understands.
• Pick one per repository. Running both on the same repository means two bots fighting over the same lockfile. The workable split is Dependabot on the GitHub repositories where zero-config wins and Renovate on the self-hosted forge.
• Consider neither when the dependency set is small and stable. The release-tracking workflow covers noticing, and a monthly manual bump is cheaper than a bot.

Official sources

• Renovate bot comparison: https://docs.renovatebot.com/bot-comparison/
• Running Renovate (self-hosting): https://docs.renovatebot.com/getting-started/running/
• Renovate self-hosted configuration: https://docs.renovatebot.com/self-hosted-configuration/
• renovatebot/renovate on GitHub: https://github.com/renovatebot/renovate
• dependabot-core on GitHub: https://github.com/dependabot/dependabot-core
• GitHub Dependabot documentation: https://docs.github.com/en/code-security/dependabot
• Our release-tracking workflow: https://systhoughts.com/posts/tracking-software-releases-across-forges
• Our Docker vs Podman comparison: https://systhoughts.com/posts/docker-vs-podman-self-hosted-apps

Are you on Dependabot, self-hosted Renovate, or both? What did the first regexManager teach you, and where did the bot earn its keep? Drop it in the comments.

Until next time, keep your systems thoughtful.