Renovate Bot for Java: Complete Dependency Management Guide

Table of Contents

Article

Renovate Bot is an automated dependency update tool that helps keep your Java projects up-to-date with the latest package versions. It automatically creates pull requests for dependency updates, supports multiple package managers, and provides flexible configuration options.

Why Renovate for Java?

Automated Updates: Automatic PR creation for dependency updates
Multi-Platform Support: Maven, Gradle, Docker, GitHub Actions
Flexible Scheduling: Configurable update frequency
Security Updates: Immediate PRs for security vulnerabilities
Grouping: Batch related updates together
Customizable: Extensive configuration options
CI/CD Integration: Works with all major CI systems

Basic Configuration Setup

renovate.json - Basic Configuration:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard"
],
"platform": "github",
"autodiscover": true,
"autodiscoverFilter": ["my-org/java-*"],
"java": {
"enabled": true,
"packageRules": [
{
"matchPackagePatterns": ["*"],
"groupName": "all Java dependencies",
"groupSlug": "all-java"
}
]
},
"packageRules": [
{
"matchManagers": ["maven"],
"rangeStrategy": "auto"
},
{
"matchManagers": ["gradle"],
"rangeStrategy": "auto"
}
],
"prConcurrentLimit": 5,
"prHourlyLimit": 2
}

1. Maven-Specific Configuration

Maven-focused renovate.json:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
"docker:enableMajor",
"helpers:disableTypesNode"
],
"platform": "github",
"repositoryCache": "enabled",
"maven": {
"enabled": true,
"fileMatch": [
"^(|.*[\\/])pom\\.xml$",
"^(|.*[\\/]).mvn/wrapper/maven-wrapper\\.properties$"
]
},
"packageRules": [
// Major versions for Spring Boot
{
"matchPackagePatterns": ["^org\\.springframework\\.boot:"],
"matchUpdateTypes": ["major"],
"enabled": true
},
// Group Spring dependencies
{
"matchPackagePatterns": ["^org\\.springframework:"],
"groupName": "Spring Framework",
"groupSlug": "spring-framework"
},
// Group Spring Boot starters
{
"matchPackagePatterns": ["^org\\.springframework\\.boot:spring-boot-starter"],
"groupName": "Spring Boot Starters",
"groupSlug": "spring-boot-starters"
},
// Test dependencies
{
"matchPackagePatterns": ["^org\\.junit:", "^org\\.testcontainers:", "^org\\.mockito:", "^org\\.assertj:"],
"groupName": "Test Dependencies",
"groupSlug": "test-deps",
"schedule": ["on saturday"]
},
// Database drivers
{
"matchPackagePatterns": ["^org\\.postgresql:", "^mysql:", "^com\\.oracle\\.database\\.jdbc:"],
"groupName": "Database Drivers",
"groupSlug": "db-drivers"
},
// Logging dependencies
{
"matchPackagePatterns": ["^org\\.slf4j:", "^ch\\.qos\\.logback:", "^org\\.apache\\.logging\\.log4j:"],
"groupName": "Logging Dependencies",
"groupSlug": "logging-deps"
},
// Security dependencies
{
"matchPackagePatterns": ["^org\\.springframework\\.security:", "^io\\.jsonwebtoken:"],
"groupName": "Security Dependencies",
"groupSlug": "security-deps"
},
// Apache Commons
{
"matchPackagePatterns": ["^org\\.apache\\.commons:"],
"groupName": "Apache Commons",
"groupSlug": "apache-commons"
},
// Ignore beta/RC versions
{
"matchPackagePatterns": ["*"],
"matchCurrentVersion": "/[-_](beta|rc|alpha|milestone|preview)/i",
"allowedVersions": "/^[0-9]+\\.[0-9]+\\.[0-9]+$/"
}
],
"vulnerabilityAlerts": {
"enabled": true,
"schedule": ["at any time"]
},
"schedule": [
"before 5am on monday"
],
"timezone": "America/New_York",
"prCreation": "not-pending",
"dependencyDashboard": true,
"dependencyDashboardTitle": "📦 Dependency Updates Dashboard",
"rebaseWhen": "behind-base-branch",
"labels": ["dependencies", "renovate"],
"assignees": ["my-team"],
"reviewers": ["senior-devs"],
"commitMessagePrefix": "⬆️",
"commitMessageAction": "Update",
"commitMessageTopic": "{{depName}}",
"commitMessageExtra": "to {{newVersion}}"
}

2. Gradle-Specific Configuration

Gradle-focused renovate.json:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
"gradle:updateTestedDependencies"
],
"platform": "github",
"gradle": {
"enabled": true,
"fileMatch": [
"^(|.*[\\/])build\\.gradle(?:\\.kts)?$",
"^(|.*[\\/])gradle\\.properties$",
"^(|.*[\\/])gradle/wrapper/gradle-wrapper\\.properties$"
]
},
"packageRules": [
// Kotlin dependencies
{
"matchPackagePatterns": ["^org\\.jetbrains\\.kotlin:"],
"groupName": "Kotlin",
"groupSlug": "kotlin"
},
// Gradle plugins
{
"matchPackagePatterns": ["^com\\.gradle\\.enterprise:", "^io\\.spring\\.dependency-management:"],
"groupName": "Gradle Plugins",
"groupSlug": "gradle-plugins"
},
// Android dependencies
{
"matchPackagePatterns": ["^com\\.android\\.tools\\.build:"],
"groupName": "Android Build Tools",
"groupSlug": "android-build-tools"
},
// Gradle wrapper
{
"matchManagers": ["gradle-wrapper"],
"groupName": "Gradle Wrapper",
"groupSlug": "gradle-wrapper"
}
],
"gradle-lite": {
"enabled": true
},
"ignoreDeps": [
{
"depName": "com.github.spotbugs",
"version": "4.0.0" // Known breaking change
}
]
}

3. Multi-Module Maven Configuration

renovate.json for Multi-module Projects:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
"group:javaLibraries"
],
"platform": "github",
"maven": {
"enabled": true
},
"packageRules": [
// Parent POM updates
{
"matchFiles": ["pom.xml"],
"matchPackageNames": ["com.mycompany:parent-pom"],
"groupName": "Parent POM",
"groupSlug": "parent-pom",
"commitMessageTopic": "Parent POM",
"semanticCommitType": "build"
},
// BOM (Bill of Materials) updates
{
"matchPackagePatterns": ["^org\\.springframework\\.cloud:spring-cloud-dependencies"],
"groupName": "Spring Cloud Dependencies",
"groupSlug": "spring-cloud-deps",
"semanticCommitType": "build"
},
// Module-specific rules
{
"matchPaths": ["core-module/**"],
"matchPackagePatterns": ["^io\\.micrometer:", "^org\\.springframework\\.boot:spring-boot-actuator"],
"groupName": "Core Module Dependencies",
"groupSlug": "core-module-deps"
},
{
"matchPaths": ["web-module/**"],
"matchPackagePatterns": ["^org\\.springframework\\.boot:spring-boot-starter-web"],
"groupName": "Web Module Dependencies",
"groupSlug": "web-module-deps"
},
{
"matchPaths": ["data-module/**"],
"matchPackagePatterns": ["^org\\.springframework\\.boot:spring-boot-starter-data-"],
"groupName": "Data Module Dependencies",
"groupSlug": "data-module-deps"
},
// Shared dependencies across modules
{
"matchPackagePatterns": ["^org\\.projectlombok:lombok"],
"groupName": "Lombok",
"groupSlug": "lombok"
}
],
"ignorePaths": [
"**/target/**",
"**/build/**",
"**/node_modules/**",
"experimental/**"
],
"postUpdateOptions": [
"mvnClean",
"mvnCompile"
],
"prBodyNotes": [
"### 🔍 Verification Steps",
"",
"Please verify the following after merging:",
"- [ ] All tests pass (`mvn clean test`)",
"- [ ] Application starts successfully",
"- [ ] No breaking changes in API",
"- [ ] Check dependency compatibility matrix"
]
}

4. Enterprise Configuration

renovate.json for Enterprise:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
":semanticCommits",
":semanticCommitTypeAll(build)",
"group:recommended",
"group:javaLibraries"
],
"platform": "github",
"autodiscover": true,
"autodiscoverFilter": ["my-company/*"],
"enabledManagers": [
"maven",
"gradle",
"dockerfile",
"github-actions",
"npm"
],
"maven": {
"enabled": true
},
"constraints": {
"java": "17"
},
"packageRules": [
// Company internal libraries
{
"matchPackagePatterns": ["^com\\.mycompany:"],
"groupName": "Internal Libraries",
"groupSlug": "internal-libs",
"schedule": ["on friday"],
"prPriority": 10
},
// Security-critical updates
{
"matchPackagePatterns": ["^org\\.springframework\\.security:", "^io\\.jsonwebtoken:"],
"matchUpdateTypes": ["patch", "minor", "major"],
"prPriority": 100,
"dependencyDashboardApproval": false
},
// Breaking changes require approval
{
"matchUpdateTypes": ["major"],
"dependencyDashboardApproval": true,
"prPriority": -1
},
// Auto-merge safe patches
{
"matchUpdateTypes": ["patch"],
"matchPackagePatterns": ["^org\\.springframework\\.boot:", "^org\\.springframework:"],
"automerge": true,
"automergeType": "branch",
"requiredStatusChecks": null
},
// Test dependencies - lower priority
{
"matchPackagePatterns": ["^org\\.junit:", "^org\\.mockito:", "^org\\.testcontainers:"],
"prPriority": -10,
"schedule": ["on weekend"]
},
// Documentation dependencies
{
"matchPackagePatterns": ["^org\\.asciidoctor:", "^io\\.github\\.java-diff-utils:"],
"prPriority": -20
}
],
"vulnerabilityAlerts": {
"enabled": true,
"schedule": ["at any time"],
"prCreation": "immediate",
"labels": ["security", "dependencies"],
"assignees": ["security-team"]
},
"schedule": [
"before 6am on weekday"
],
"timezone": "America/New_York",
"prConcurrentLimit": 10,
"prHourlyLimit": 5,
"branchConcurrentLimit": 10,
"branchHourlyLimit": 5,
"labels": ["dependencies", "renovate", "automated-pr"],
"assignees": ["platform-team"],
"reviewers": ["senior-engineers"],
"semanticCommits": "enabled",
"semanticCommitType": "fix",
"semanticCommitScope": "deps",
"commitMessageTopic": "{{depName}}",
"commitMessageExtra": "to {{newVersion}}",
"rebaseWhen": "behind-base-branch",
"rebaseLabel": "rebase",
"dependencyDashboard": true,
"dependencyDashboardTitle": "🚀 Dependency Updates",
"dependencyDashboardLabels": ["dependencies", "dashboard"],
"configMigration": true,
"prBodyNotes": [
"---",
"### 📋 Checklist",
"",
"#### For Reviewers",
"- [ ] Verify compatibility with existing code",
"- [ ] Check for breaking changes",
"- [ ] Review test results",
"- [ ] Approve if changes look good",
"",
"#### For Mergers", 
"- [ ] All checks passed ✅",
"- [ ] No conflicts with base branch",
"- [ ] Approved by required reviewers",
"",
"---",
"🤖 This PR was created by [Renovate Bot](https://github.com/renovatebot/renovate)."
],
"ignoreDeps": [
"com.sun.xml.ws:jaxws-ri", // Known compatibility issues
"javax.xml.bind:jaxb-api"  // Java 11+ compatibility
]
}

5. Security-Focused Configuration

renovate-security.json:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
":security"
],
"platform": "github",
"vulnerabilityAlerts": {
"enabled": true,
"schedule": ["at any time"],
"prCreation": "immediate",
"labels": ["security", "dependencies", "vulnerability"],
"assignees": ["security-team"],
"reviewers": ["security-team"],
"automerge": false,
"commitMessageSuffix": "[SECURITY]",
"prTitle": "🚨 Security update: {{depName}}"
},
"packageRules": [
// Critical security packages
{
"matchPackagePatterns": [
"^org\\.springframework\\.security:",
"^io\\.jsonwebtoken:",
"^com\\.fasterxml\\.jackson\\.core:",
"^org\\.yaml:"
],
"matchUpdateTypes": ["patch", "minor"],
"prPriority": 100,
"automerge": true,
"automergeType": "pr",
"requiredStatusChecks": null
},
// Log4j security updates
{
"matchPackagePatterns": ["^org\\.apache\\.logging\\.log4j:"],
"prPriority": 200,
"dependencyDashboardApproval": false
},
// Apache Commons security
{
"matchPackagePatterns": ["^org\\.apache\\.commons:"],
"matchUpdateTypes": ["patch"],
"prPriority": 50
}
],
"osvVulnerabilityAlerts": true,
"prCreation": "immediate",
"schedule": ["at any time"],
"labels": ["security", "dependencies"],
"ignoreTests": false,
"postUpdateOptions": [
"mvnClean",
"mvnTest"
]
}

6. Monorepo Configuration

renovate.json for Monorepo:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
"group:monorepos"
],
"platform": "github",
"monorepos": {
"enabled": true
},
"packageRules": [
// Root dependencies
{
"matchFiles": ["package.json", "pom.xml", "build.gradle"],
"matchPaths": [""],
"groupName": "Root Dependencies",
"groupSlug": "root-deps"
},
// Shared library updates across services
{
"matchPackagePatterns": ["^com\\.mycompany:common-lib"],
"groupName": "Common Library",
"groupSlug": "common-lib",
"prBodyNotes": [
"### 🔄 Cross-Service Impact",
"This update affects multiple services. Please verify:",
"- [ ] Service A compatibility",
"- [ ] Service B compatibility", 
"- [ ] Shared API contracts"
]
},
// Service-specific rules
{
"matchPaths": ["services/user-service/**"],
"matchPackagePatterns": ["^org\\.springframework\\.boot:spring-boot-starter-data-"],
"groupName": "User Service Dependencies",
"groupSlug": "user-service-deps"
},
{
"matchPaths": ["services/order-service/**"],
"matchPackagePatterns": ["^org\\.springframework\\.boot:spring-boot-starter-web"],
"groupName": "Order Service Dependencies",
"groupSlug": "order-service-deps"
},
// Infrastructure dependencies
{
"matchPaths": ["infrastructure/**"],
"matchPackagePatterns": ["^io\\.fabric8:kubernetes-client", "^com\\.spotify:dockerfile-maven"],
"groupName": "Infrastructure Dependencies",
"groupSlug": "infra-deps"
}
],
"ignorePaths": [
"**/node_modules/**",
"**/target/**",
"**/build/**",
"**/dist/**",
"archived/**",
"experimental/**"
],
"separateMajorMinor": true,
"separateMultipleMajor": true,
"prConcurrentLimit": 3,
"prHourlyLimit": 2,
"branchConcurrentLimit": 5,
"branchHourlyLimit": 3
}

7. GitHub Actions Configuration

renovate.json with GitHub Actions:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard"
],
"platform": "github",
"github-actions": {
"enabled": true,
"fileMatch": [
"^\\.github/workflows/[^/]+\\.ya?ml$",
"^\\.github/workflows/[^/]+\\.yml$"
]
},
"packageRules": [
// GitHub Actions updates
{
"matchManagers": ["github-actions"],
"groupName": "GitHub Actions",
"groupSlug": "github-actions",
"schedule": ["on monday"]
},
// Java setup action
{
"matchManagers": ["github-actions"],
"matchPackagePatterns": ["actions/setup-java"],
"groupName": "Java Setup Action",
"groupSlug": "setup-java"
},
// Maven action
{
"matchManagers": ["github-actions"],
"matchPackagePatterns": ["actions/setup-java", "actions/cache"],
"matchUpdateTypes": ["patch", "minor"],
"automerge": true
}
],
"maven": {
"enabled": true
}
}

8. Custom Manager for Docker

renovate.json with Docker support:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
"docker:enableMajor"
],
"platform": "github",
"docker": {
"enabled": true,
"fileMatch": [
"^(|.*/)(Dockerfile|Dockerfile\\.[^/]*|\\..*dockerignore)$"
]
},
"packageRules": [
// Base image updates
{
"matchManagers": ["dockerfile"],
"matchPackagePatterns": ["eclipse-temurin", "openjdk"],
"groupName": "Java Base Images",
"groupSlug": "java-base-images",
"prBodyNotes": [
"### 🐳 Base Image Update",
"Verify:",
"- [ ] Application starts with new base image",
"- [ ] No breaking changes in runtime behavior",
"- [ ] Security scan passes"
]
},
// Alpine images
{
"matchManagers": ["dockerfile"],
"matchPackagePatterns": ["alpine"],
"groupName": "Alpine Base Images",
"groupSlug": "alpine-images"
}
],
"maven": {
"enabled": true
}
}

9. Preset Configurations

Java-specific Presets:

{
"extends": [
"config:base",
":dependencyDashboard",
// Java-specific presets
"group:javaLibraries",
"group:springBoot",
"group:springCloud",
// Testing presets
"group:testNG",
"group:junit",
"group:mockito",
// Database presets  
"group:postgresql",
"group:mysql",
"group:mongoDb",
// Tooling presets
"group:checkstyle",
"group:spotbugs",
"group:jacoco"
]
}

10. GitHub Workflow Integration

.github/workflows/renovate.yml:

name: Renovate
on:
workflow_dispatch:
schedule:
- cron: '0 2 * * 1'  # Run every Monday at 2 AM
jobs:
renovate:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Run Renovate
uses: renovatebot/github-action@v36
with:
configurationFile: .github/renovate.json
token: ${{ secrets.RENOVATE_TOKEN }}
env:
LOG_LEVEL: debug

.github/renovate.json (Repository-specific):

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"local>my-org/renovate-config:java",
"local>my-org/renovate-config:security"
],
"baseBranches": ["main", "develop"],
"packageRules": [
{
"matchPackageNames": ["com.mycompany:shared-lib"],
"allowedVersions": "<=2.0.0"
}
],
"ignoreDeps": [
"org.example:legacy-lib"  // Cannot be updated
]
}

11. Advanced Configuration Features

renovate-advanced.json:

{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:base",
":dependencyDashboard",
":semanticCommits"
],
"platform": "github",
"maven": {
"enabled": true
},
"customManagers": [
{
"customType": "regex",
"fileMatch": ["^versions\\.properties$"],
"matchStrings": [
"^(?<depName>.*?)\\s*=\\s*\"?(?<currentValue>.*?)\"?\\s*$"
],
"datasourceTemplate": "maven"
}
],
"hostRules": [
{
"hostType": "maven",
"matchHost": "https://nexus.mycompany.com",
"username": "{{ secrets.NEXUS_USERNAME }}",
"password": "{{ secrets.NEXUS_PASSWORD }}"
}
],
"onboarding": true,
"onboardingConfig": {
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:base"]
},
"onboardingBranch": "renovate/configure",
"requireConfig": "optional",
"branchPrefix": "renovate/",
"branchName": "{{branchPrefix}}{{managerBranchPrefix}}{{depNameSanitized}}-{{newVersion}}",
"prTitle": "{{#if isPin}}Pin{{else}}Update{{/if}} dependency {{depName}} to version {{#if isRange}}{{newVersion}}{{else}}{{#if isMajor}}{{prettyNewMajor}}{{else}}{{newVersion}}{{/if}}{{/if}}",
"gitAuthor": "Renovate Bot <[email protected]>",
"productLinks": {
"documentation": "https://docs.mycompany.com/renovate",
"help": "https://slack.mycompany.com/renovate-support"
},
"force": {
"constraints": {
"java": "17"
}
}
}

12. Best Practices and Tips

Incremental Adoption:

{
"packageRules": [
// Phase 1: Security updates only
{
"matchUpdateTypes": ["patch"],
"matchPackagePatterns": ["*"],
"enabled": false
},
{
"matchUpdateTypes": ["minor", "major"],
"enabled": false
},
{
"vulnerabilityAlerts": {
"enabled": true
}
}
]
}

Performance Optimization:

{
"prConcurrentLimit": 3,
"prHourlyLimit": 2,
"branchConcurrentLimit": 5,
"rebaseWhen": "behind-base-branch",
"rebaseLabel": "rebase",
"platform": "github",
"repositoryCache": "enabled",
"ignorePaths": [
"**/node_modules/**",
"**/bower_components/**",
"**/vendor/**",
"**/examples/**",
"**/test/**"
]
}

Conclusion

Renovate Bot provides powerful, flexible dependency management for Java projects. Key benefits include:

Automated Updates: Automatic PR creation for dependency updates
Security Focus: Immediate updates for vulnerable dependencies
Flexible Grouping: Batch related dependencies together
Multi-Platform: Support for Maven, Gradle, Docker, GitHub Actions
Enterprise Ready: Scalable for large organizations with custom rules
CI/CD Integration: Seamless integration with existing workflows

By implementing the configurations shown above, you can establish a robust dependency management system that keeps your Java projects secure, up-to-date, and maintainable with minimal manual effort.

Secure Java Dependency Management, Vulnerability Scanning & Software Supply Chain Protection (SBOM, SCA, CI Security & License Compliance)

https://macronepal.com/blog/github-code-scanning-in-java-complete-guide/
Explains GitHub Code Scanning for Java using tools like CodeQL to automatically analyze source code and detect security vulnerabilities directly inside CI/CD pipelines before deployment.

https://macronepal.com/blog/license-compliance-in-java-comprehensive-guide/
Explains software license compliance in Java projects, ensuring dependencies follow legal requirements (MIT, Apache, GPL, etc.) and preventing license violations in enterprise software.

https://macronepal.com/blog/container-security-for-java-uncovering-vulnerabilities-with-grype/
Explains using Grype to scan Java container images and filesystems for known CVEs in OS packages and application dependencies to improve container security.

https://macronepal.com/blog/syft-sbom-generation-in-java-comprehensive-software-bill-of-materials-for-jvm-applications/
Explains using Syft to generate SBOMs (Software Bill of Materials) for Java applications, listing all dependencies, libraries, and components for supply chain transparency.

https://macronepal.com/blog/comprehensive-dependency-analysis-generating-and-scanning-sboms-with-trivy-for-java/
Explains using Trivy to generate SBOMs and scan Java dependencies and container images for vulnerabilities, integrating security checks into CI/CD pipelines.

https://macronepal.com/blog/dependabot-for-java-in-java/
Explains GitHub Dependabot for Java projects, which automatically detects vulnerable dependencies and creates pull requests to update them securely.

https://macronepal.com/blog/parasoft-jtest-in-java-comprehensive-guide-to-code-analysis-and-testing/
Explains Parasoft Jtest, a static analysis and testing tool for Java that helps detect bugs, security issues, and code quality problems early in development.

https://macronepal.com/blog/snyk-open-source-in-java-comprehensive-dependency-vulnerability-management-2/
Explains Snyk Open Source for Java, which continuously scans dependencies for vulnerabilities and provides automated fix suggestions and monitoring.

https://macronepal.com/blog/owasp-dependency-check-in-java-complete-vulnerability-scanning-guide/
Explains OWASP Dependency-Check, which scans Java dependencies against the National Vulnerability Database (NVD) to detect known security vulnerabilities.

https://macronepal.com/blog/securing-your-dependencies-a-java-developers-guide-to-whitesource-mend-bolt/
Explains Mend (WhiteSource) Bolt for Java, a dependency management and SCA tool that provides vulnerability detection, license compliance, and security policy enforcement in enterprise environments.