If this works as smoothly as it sounds, that'll significantly reduce the overhead!

[0]: https://www.jvt.me/posts/2026/02/25/llm-attribute/

Comments URL: https://news.ycombinator.com/item?id=47245891

Points: 5

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=47164481

Points: 2

# Comments: 0

(I'm a Renovate maintainer)

(I agree with Filippo's post and it can also be applied to Renovate's security updates for Go modules - we don't have a way, right now, of ingesting better data sources like `govulncheck` when raising security PRs)

(a blog post I wrote, prior to joining Mend and working as a Renovate maintainer)

I'll see if I can help with clarifying this in the table!

(I'm a Renovate maintainer and employee at Mend)

Website: https://www.jvt.me (used for blog, but I also use as an IndieWeb site, so I i.e. reply to social media posts from my website, and they're syndicated out to the different platforms)

Blog: https://www.jvt.me/kind/articles/

Archives page: https://www.jvt.me/archives/

Feeds: https://www.jvt.me/subscribe/

As others have noted, there are a few areas to watch out for, and:

- some ecosystems have more dependencies over fewer, and so we need to consider how to apply a careful weighting in line with that - how do we handle forks? Does a % of the money go to the original maintainers who did 80% of the work? - how can companies be clever to not need to pay this? - some maintainers don't want financial support, and that's OK - some project creators / maintainers don't get into the work for the money (... because there is often very little) - there's a risk of funding requirements leading to "I'm not merging your PR without you paying me" which is /not problematic/ but may not be how some people (in particular companies) would like to operate

[0]: https://www.jvt.me/posts/2025/02/20/funding-oss-product/

Unless that's explicitly the intent, in which case that's fair

Before I joined Mend to work on Renovate, I wrote https://news.ycombinator.com/item?id=40011111 which goes into some ways I found Renovate better than Dependabot, and it still very much holds true (although I'm a little more biased now!)

You can also check out https://docs.renovatebot.com/bot-comparison/ for a high level comparison between the two

Re costs / why giving things away for free - @rarkins (Rhys Arkins, who created Renovate) has worked very hard over the years to give as much good stuff away to the community, and make it more straightforward for folks to run Renovate

The core (Mend Renovate CLI (AGPL-3.0-only)) is free to use and run as you want, and many folks do - it's very flexible and scales well as-is

But if you want things like real-time webhook processing of "rebase this PR" (and/or a few other features) then Mend Renovate Self-Hosted Community (commercial-but-free) Edition is a nice packaging and layer on top of the CLI for that

Running the CLI itself on a schedule against your repos is also absolutely viable as a solution, and we have many users who do that and are super happy with it

Thanks for sharing!