CRACI vs Renovate

The short answer

Renovate is built for dependency hygiene: it finds package files, opens update pull requests, and lets you control the noise with schedules, grouping and automerge. CRACI is a GitHub Actions runner that records what each build fetched and monitors those SBOMs for new vulnerabilities. Renovate asks "is there a newer version?" CRACI asks "is something in what we built and shipped vulnerable, and where?" They do not compete for the same job, and they run side by side: Renovate opens the update pull requests, CRACI tells you which builds need one.

What Renovate does well

Renovate's documentation opens with "Automated dependency updates. Multi-platform and multi-language." It earns both halves. It "looks for references to dependencies (both public and private)" in your repository and, when newer versions exist, opens pull requests that update them and their lock files.

• Breadth. Over 90 package managers, and repositories on GitHub, GitLab, Bitbucket, Azure DevOps, Gitea and Forgejo, with AWS CodeCommit, Gerrit and SCM-Manager listed as experimental.
• Control. Shareable config presets, packageRules for per-package behavior, schedules to limit when pull requests appear, and automerge for the updates you trust. Its docs note that most teams leave major updates to a human.
• Visibility. A Dependency Dashboard issue, on by default in config:recommended, and information to help decide which updates to accept: age, adoption, pass rates and merge confidence.
• Reach. Custom managers handle proprietary file formats and popular formats that Renovate does not support yet.
• Deployment choice. Open source under AGPL-3.0 and maintained by Mend. You can run the CLI or Docker image yourself, use the free Mend Renovate Community cloud app on GitHub.com and Bitbucket Cloud, or run the self-hosted Community or paid Enterprise editions.

How Renovate handles vulnerabilities

Renovate has two routes to security fixes. With vulnerabilityAlerts, it reads GitHub's vulnerability alerts, which requires the dependency graph and Dependabot alerts to be enabled. Those pull requests "skip the line," ignoring schedules and hourly limits, and by default they move to the lowest fixed version. With osvVulnerabilityAlerts, it checks dependencies against the OSV database, which it downloads and queries offline. The docs are precise about the limit: "You will only get OSV-based vulnerability alerts for direct dependencies," for a listed set of datasources.

CRACI does not replace any of this, and it does not open pull requests. If your goal is to keep hundreds of repositories current with minimal effort, Renovate is built for that.

Where CRACI is different

It starts from the build, not the package files

Renovate works from what your repository declares. A build often does more than that: it resolves versions at install time, restores packages from caches, and downloads tools, OS packages and images that no manifest lists. expressjs/express 5.2.1 shows the gap at its plainest: it commits no lockfile, so a generator pointed at a clean checkout has nothing to resolve and reports none of its npm dependencies, however well the tool works. CRACI cannot be compared that way, because it records builds rather than scanning directories. The files in a repository and the packages in a build are not the same list.

CRACI runs the build. You change runs-on to craci, and a package-aware proxy records what each job pulls from npm, PyPI, RubyGems, Cargo, Go, Nix and OCI sources, plus OS and download sources. Every job and cache gets a completeness state: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Monitoring what you shipped

CRACI aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs as new advisories appear. When one lands, you see which builds and repositories actually used the affected package, including packages no manifest lists, and security teams can triage the finding and route it to the team that owns the fix. The trigger is a vulnerability in something a build actually used, not the arrival of a new version.

More than monitoring

Because CRACI is the runner, it also enforces a per-job egress policy (default deny or allow, validated before the job starts, failing closed), signs provenance (Ed25519 over SHA-512) that links each artifact to its build, and exports reports in PDF, HTML, CSV, Excel and JSON. None of that is Renovate's job.

Running both

• Renovate keeps every dependency current on a schedule, across all your platforms and package managers, with automerge for low-risk updates.
• CRACI records each GitHub Actions build, monitors what shipped, and tells you which builds and teams a new vulnerability affects, so you know which update pull requests to merge first.

There is nothing to migrate. Renovate keeps reading your repositories, and your workflows keep running on GitHub Actions on a different runner.

For the Cyber Resilience Act

The CRA expects manufacturers to know what is in each release and to handle vulnerabilities in it. Renovate helps by keeping dependencies patched and current. CRACI records the SBOM of each build, ties it to the artifact, monitors it for new vulnerabilities and keeps the evidence. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process. See what the CRA is and vulnerability tracking.