Renovate 44.45.0 covers more than 90 package managers
Renovate 44.45.0 searches repositories for dependency declarations, compares them with registries and release sources, then prepares branches and pull requests. The more-than-90-manager list spans npm, Python, Java, .NET, Go, Docker, infrastructure files, and less common formats. GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, Forgejo, and other platforms can share the same rule set. That breadth is the reason to choose it over a bot tied closely to one forge or package ecosystem.
The useful part is policy, not merely replacing an old number with a new one. Renovate can group related updates, limit when branches appear, hold young releases, separate major changes, and automerge changes that satisfy repository checks. Pull requests can include release age, adoption, pass rates, and merge-confidence data. A platform team can publish a preset so hundreds of repositories inherit the same defaults while allowing local exceptions where a service genuinely needs them.
What happened when we ran it
Our sandbox installed 1,094 packages in 40 seconds at commit 0cc9356, leaving 679 MB on disk. The repository contained 3,949 files and about 500,002 lines of source in a 34.8 MB checkout. Its pnpm build finished successfully in 15 seconds on 3 CPUs with 8 GB of memory. The project is a monorepo with workspaces, a tests directory, and 19 CI workflow files.
Tests ran for 607 seconds before exiting 1. The final output shows JUnit testcase records from GitLab platform handling, Bundler artifacts, Conan, Hex, NuGet, Terraform modules, HTTP caching, configuration migration, and pull-request creation. It then reports ELIFECYCLE. The tail contains no failed assertion, stack trace, or suite summary, so we cannot responsibly name the broken behavior. We can say that the full command consumed more than 10 minutes and did not pass in our clean Node 22 container.
That result changes the contributor story more than the user story. A hosted user never builds Renovate from source, while a contributor or company carrying patches inherits a 1,094-package workspace and a long test command. The README directs contributors to a separate guide, which is appropriate. Teams evaluating a source fork should reproduce the failure with fuller logs before deciding whether commit 0cc9356 or the sandbox environment needs attention.
Configuration depth is useful once several repositories need one policy
With more than 90 managers, universal defaults quickly become noisy. Renovate needs to know which updates can be grouped, which repositories accept automerge, when expensive CI may run, and how long a release should age before adoption. Presets let a platform owner make those decisions once. Package rules can then match names, sources, update types, or file managers and apply a schedule or review policy. This is much more expressive than turning a basic update bot on and hoping its pull-request volume stays reasonable.
That flexibility also creates review work. A permissive regex or package rule can affect more repositories than intended, and a badly chosen grouping rule can hide a risky major update inside a large pull request. Start with an onboarding pull request, inspect the dependency dashboard, and add automerge only after CI proves it can reject bad upgrades. Renovate provides information and branch mechanics. It cannot know whether an application-level behavior changed unless the repository's tests detect it.
Private registries put repository credentials at the center
Renovate supports private repositories and package registries, so a self-hosted installation must hold credentials capable of reading manifests and writing update branches. Host rules carry registry authentication, while the platform token reaches the source-control API. Open issue #45421, created on 2026-08-24, asks for GitLab fine-grained token scopes because current guidance requires full api access. That is a concrete blocker for organizations whose policy forbids such a broad token.
The hosting choice can remove some work. Mend's community cloud app supports GitHub.com and Bitbucket Cloud with little operator setup. GitLab and Bitbucket Data Center users can use Mend's community self-hosted option, while custom pipelines can invoke npx renovate. Direct CLI use is available across supported platforms. Self-hosting buys access to internal registries and control over scheduling, but the team owns secret storage, upgrades, job isolation, logs, and API-rate behavior.
AGPL-3.0 is another real boundary. Running an unchanged internal tool is a different legal question from modifying it and offering the result over a network. Teams planning a patched service should have counsel review the license obligations early. Commercial support and enterprise packaging are offered by Mend, which may be simpler than maintaining a private fork of a fast-moving TypeScript codebase.
A same-day push and release show active maintenance
Renovate had 22,330 stars, 1,331 open issues and pull requests combined, and a last push on 2026-08-25. Release 44.45.0 also arrived on 2026-08-25 with a Bitbucket deprecation warning, dependency updates, and test changes. Open issues were updated through the same day, including work on GitLab token scopes, Helmfile digest references, Deno lockfiles, and minimum-release-age behavior. The combined count is large, but the push, release, and issue dates show sustained maintenance rather than a dormant backlog.
The documentation matches the product's breadth. The README explains the hosted and self-hosted routes, supported platforms, and manager catalogue, then points to dedicated configuration, private-package, and merge-confidence references. Renovate is the stronger choice when dependency updates are an organization-wide system with explicit policy. For one GitHub repository using a mainstream package manager, Dependabot may solve the same problem with fewer credentials, fewer settings, and no separate scheduler.