Guide
Compared with Dependabot and Renovate
Dependabot and Renovate open the version bump and leave the breakage to you. Teire also covers API and model changes, fixes the code they break, and proves it before it asks for a review.
Dependabot and Renovate keep versions current. When a new version needs code changes, your CI fails on their PR, and someone has to read the release notes and fix the code. When an API retires a model or an endpoint, no new version appears at all, so neither tool opens anything.
Teire starts where they stop.
| Dependabot, Renovate | Teire | |
|---|---|---|
| What it watches | Package versions, plus advisories | Package versions and advisories, plus the APIs your code calls: model retirements, removed endpoints and API changes, read from the providers' own pages |
| How it decides you are affected | A newer version exists | For a major, the API diff between your version and the target, and the exact lines in your code that use what changed |
| Code changes | Manifest and lockfile | Manifest and lockfile, the swaps the source names, and NVIDIA Nemotron edits for what a swap cannot fix |
| Proof | Your CI runs on the PR afterwards | Your own checks run in a sandbox before and after the change, with the network off, compared check by check and by test counts |
| What a PR tells you | The version range and release notes | Why your code is affected (lines linked), the quoted source, the verification table, the receipt, the risks not covered |
| When it can't prove the fix | The PR stays red | A draft that says why, or an issue for a person |
Where they go further
- More package managers. Renovate and Dependabot also update Docker images, GitHub Actions, Terraform and other formats. Teire covers npm, PyPI, Go, Cargo, RubyGems and Maven/Gradle.
- Fine-grained scheduling and grouping rules. Teire has
upgrades.allow/deny, PR limits and a daily or weekly rescan. It groups one PR per package version and one per provider.
Using them together
They can run side by side. To leave minor and patch bumps to your other bot, set this in teire.yml. Teire then keeps to breaking changes that reach your code, security fixes and API retirements:
upgrades:
plainBumps: false