(Cancelled) Renaming Renovate Bot to Mend Bot (Cloud hosted GitHub app) #37842
Replies: 10 comments 54 replies
-
|
Hello, Renaming the bot on Action workflows could be the simple thing, just adding extra "bot" in advance, Thank you in advance. PS My assumption GitHub app slug will be also changed, right ? Or? |
Beta Was this translation helpful? Give feedback.
-
|
The timeline would be very handy to know indeed. The discussion is 2 weeks old and says "coming soon"...? |
Beta Was this translation helpful? Give feedback.
-
|
We are planning to make this change on 28-Sep-2025. |
Beta Was this translation helpful? Give feedback.
-
|
I think the app ID will remain the same, but the app username email address will change. |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
I'm interested in the reply for this, if we would need to change the branch creation rules restrictions or not |
Beta Was this translation helpful? Give feedback.
-
|
Based on these in OP:
I'm guessing both 1. and 2. are "no", because they're default configuration:
|
Beta Was this translation helpful? Give feedback.
-
my repo has |
Beta Was this translation helpful? Give feedback.
-
Really, the only thing changing from "Renovate" to "Mend" is the name of the GitHub app. |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
Will there be any change in the username / user_id? |
Beta Was this translation helpful? Give feedback.
-
|
Maybe a good idea to find out sooner rather than later, then, so we can properly prepare for the change? |
Beta Was this translation helpful? Give feedback.
-
|
I have confirmed that the "Mend" app name is reserved for @mend. |
Beta Was this translation helpful? Give feedback.
-
|
@justo-mend, just to be sure, will the number suffix for the email remain the same ( |
Beta Was this translation helpful? Give feedback.
-
|
Many seem concerned with attributes like mail author, but that concern is misplaced. Such fields (email, author name, …) are easily spoofed, and the GitHub user ID is the only reliable source. It’s acceptable to inquire about them, but actually depending on them is clearly an error. |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
So this product and repo are still called Renovate? It's just the GitHub bot getting a name change? |
Beta Was this translation helpful? Give feedback.
-
|
Correct. |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
We have less than two weeks to update our tooling based on your changes, and we still don't know what the changes will be. Would greatly appreciate if you could confirm the points addressed in these comments as soon as possible, so the community has time to prepare for this change.
|
Beta Was this translation helpful? Give feedback.
-
Correct
No. Branches will still be the same.
Correct.
No need to rename files. |
Beta Was this translation helpful? Give feedback.
-
as i know (maybe not correct but) when GitHub app will be renamed it gets a new url (slug). I mean, P.S. As i posted in the beginning of this discussion it seems it will affect data lookup of Terraform app data |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
I'm not the biggest fan of silent scope changes... I signed up for renovate, and I allowed renovate on my repos. Or the other way around: I did not allow any other apps than renovate to access my repos. That's a security matter. I understand the change from the convenience point of view, but you're asking for a lot of trust with this, without providing an option to opt out. I wish you would have asked your users before planning that change. |
Beta Was this translation helpful? Give feedback.
-
|
@justo-mend I highly appreciate your response! I actually meant proactively contacting your users, either by creating issues in the affected repositories, or by sending out e-mails (definitely a justified case!). Opening an issue in your own repo where probably less than 2% of your users are subscribed to notifications... good intention, improvable execution.
Your post actually sounded (and still does) like the decision for that change was already made, just without a proper timeline.
I do trust mend for a long time now, so my concern isn't directly aimed at you. I'm not really worried about you having bad intentions with this change, like preparing to monetize on successful products like many other projects did. My concern is about giving a bad example to others by "mishandling" the oauth authenticity and trust. I mean, there's a reason why apps need to re-auth if new scopes are added. If I'm offering an application that requires access to mails on outlook.com, and I introduce a new feature now also requiring access to calendars on outlook.com, I need to explain and ask my users to approve the changed scopes. I would even go a step further and ask for a new approval if I intent to add a new use-case already covered by the approved scopes, while I'm technically not enforced to do so. Same goes for re-using a client identity (with scopes) for a different application. I consider this as fair and transparent, especially when a lot of companies forget about these values nowadays. It's okay if you see me as pedantic or overly correct - it's part of my moral and ethical values, and I'm proud of that. |
Beta Was this translation helpful? Give feedback.
-
@max06 I'm receiving emails, more than 10 a day with this text:
+ it's the first line on every PR. I'm surprised the Dependency Dashboard doesn't have it though. It could be a permanent warning for a few weeks on every run. I think this is quite an outreach. That said, looking at the number of reactions at OP here, it's not really working. I share some of your sentiment about scope increase and would add a thought about the affected user count (everyone in the world using the hosted version) vs the number of users who need to be affected due to the new offerings. |
Beta Was this translation helpful? Give feedback.
-
|
@TWiStErRob good point. I completely missed that, since I'm only reading the subject of these mails. And I wasn't very ... persistent merging these PRs in the past weeks. So, that approach clearly failed for me 😅 Sending an extra email... I mean, I get newsletters all the time. Some more often, some only every now and then. Mend has our mail-addresses. Out of all these newsletters, this would actually be a justified case to send one. It wouldn't be filtered out by whatever automation users use for github mails, so it would very likely be seen by users. (I just checked my mailbox to not make a fool of myself ...) |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, it could be lost in the noise of the notifications. And some users have emails turned off for GitHub notifications, if they prefer to manage them via the web interface or other methods. An extra communication outside of the regular updates notifications would have been good. |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I’d like to express my gratitude to the renovate team for enabling automation through continuous library upgrades. I truly appreciate the value renovate brings. When searching for code labeled as Simply renaming would likely disrupt a lot of automation. I completely understand the motivation behind Mend's branding, especially if it enables new features beyond renovate itself. At the same time, such a change could have a wide impact on existing automations and a large number of users. May I kindly ask you to reconsider the approach? For instance, introducing a new bot application (like |
Beta Was this translation helpful? Give feedback.
-
|
Even without the hijacking concern, a lot of CI jobs are bound to break. How does Mend.io weigh that impact when choosing to push the rename? |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
One possible mitigation would be for Renovate bot to automatically open PRs correcting files that rely on the app name. Whether that’s actually feasible is unclear, but it would certainly reduce the pain. |
Beta Was this translation helpful? Give feedback.
-
|
@polixswe Yes, we thought of that. It might ease the pain, but it would still require many people to make a small update, and we would not be able to help private repos, or the many other places where people have hardcoded the value into their own systems. |
Beta Was this translation helpful? Give feedback.
-
|
I appreciate you looking into it… |
Beta Was this translation helpful? Give feedback.
-
Q: Today is 09/24, and has it ultimately been decided whether this will proceed? |
Beta Was this translation helpful? Give feedback.
-
|
@justo-mend could you answer this question? |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
@justo-mend , we can still use same |
Beta Was this translation helpful? Give feedback.
-
|
Yes |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
-
|
I don't mind so much that the app name itself changes, we are benefiting from a free service after all (Based on how I understand the given rationale, it seems it is also easier for Mend itself (managing one app vs. several) and I assume from a marketing perspective to get more exposure to the other (paid) services.). Although I must add that I am also not a fan of this scope change after the fact as someone mentioned earlier. What would be nice is if at the minimum the Git author for the Renovate commits would stay as they are now: "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",That way at least the commits would still be attributed to the Renovate bot. Is this planned? |
Beta Was this translation helpful? Give feedback.
-
|
That Git author is the identity of the GitHub App itself, if it's going to change I think they should change in step, otherwise if you want to inspect the provenance of changes now you have two different identities to care about - one for the PR author and another for the commits. |
Beta Was this translation helpful? Give feedback.
-
|
As mentioned in other threads, we should only rely on the GitHub user id (actor id)(#37842 (comment)). Everything else like git author can be easily forged and should not be trusted. |
Beta Was this translation helpful? Give feedback.
-
|
Due to concerns raised by the community, we will not be moving forward with the rename at this stage. |
Beta Was this translation helpful? Give feedback.
and others
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Tell us more.
Renovate [bot] will become Mend [bot]
Important
Update 2025-09-26: Due to concerns raised by the community, we will not be moving forward with the rename at this stage.
!! Update: We are planning to make this change on 28-Sep-2025.Coming soon, the much used and well loved Renovate GitHub app (a.k.a. "Renovate Bot") will be getting renamed to "Mend".
Commits, PRs, Issues and Comments authored by the Renovate app will reflect the new name and you will see "Mend [bot]" where you used to see "Renovate [bot]".
Background / Motivation
The Renovate CLI (this repo) is an open source product supported and maintained by Mend.io.
The "Renovate [bot]" is a cloud service hosted by Mend that runs the Renovate CLI on connected GitHub repos.
The Web UI for working with Mend's Renovate Cloud service is Mend's Developer Platform (developer.mend.io).
Renovate is just one of a suite of products offered by Mend.io. More Mend products will soon be available on the Developer Platform for GitHub users - just as they are today for users of Bitbucket and Azure DevOps repos.
Merging Mend products with Renovate in the same app means that users of the existing GitHub app will be able to seamlessly integrate with other Mend services without needing to onboard repos with a new app.
Check your automation and filtering systems
If you have systems or processes in place that are relying on the GitHub user name of "renovate" (eg. to trigger actions or provide filtering), you might need to update those to look for actions from "mend" instead.
Seeking feedback
We are interested in your feedback about renaming the Renovate GitHub app. Please leave comments and questions in the comments section below.
Beta Was this translation helpful? Give feedback.
All reactions