Stackwatch and Renovate: updates or early warning?

The short version

Renovate keeps versions current through pull requests and understands more files than most update tools: Dockerfiles, docker-compose, .nvmrc, .python-version and .tool-versions. It does not answer whether a new vulnerability hits your stack: on GitHub it takes its security information from Dependabot alerts, and its own OSV integration is experimental and covers only direct dependencies from package registries. Stackwatch answers exactly that question and does not replace Renovate.

What Renovate checks

Renovate works with so-called managers, one per file type. For the stack down to the runtime, these matter:

• dockerfile and docker-compose read image references, meaning FROM lines (including multi-stage builds), COPY --from and images in Compose files. In Dockerfiles, Renovate also detects Alpine and Debian packages installed with a pinned version in RUN.
• nvm, nodenv and pyenv read .nvmrc, .node-version and .python-version.
• asdf reads .tool-versions, including PHP. There is no dedicated manager for a .php-version file, but the regex manager lets you define your own patterns.
• Plus the package managers such as composer, npm and the various pip flavours, and github-actions.

For vulnerabilities there are two paths. vulnerabilityAlerts reads the repo’s Dependabot alerts on GitHub (dependency graph and Dependabot alerts must be enabled) and opens fix PRs from them. These PRs skip the schedule and PR limits and carry the [SECURITY] suffix in the commit message. osvVulnerabilityAlerts queries OSV directly, is marked experimental, is off by default and, according to the docs, covers only direct dependencies from certain registries such as npm, Packagist and PyPI. Docker images are not among them. Why Dependabot alerts do not know about runtime vulnerabilities is covered in the Dependabot comparison.

The PHP2Shell example

On 21 October 2026, PHP2Shell (CVE-2026-109618) was published, a critical remote code execution in the PHP core. A typical repo looked like this:

FROM php:8.3.35-fpm

Renovate knows this line and proposes a newer image tag as soon as one exists. That is a regular update: it follows your schedule (schedule) and your PR limits and is not marked as a security update. No vulnerability PR is created, because neither Dependabot alerts nor Renovate’s OSV integration cover Docker images. Nobody tells you whether this PR has to be merged today or can wait for the next sprint.

Stackwatch reads the same Dockerfile, detects PHP 8.3.35 with evidence (Dockerfile:1) and matches new advisories against that version. On a match you get an alert with the fixed version, the concrete change for this repo and a workaround in case you cannot patch right away. You then have a good reason to merge the Renovate PR right away. How this works in detail is described in how it works.

The comparison

As of 5 November 2026. Stackwatch details refer to the beta.

When Renovate alone is enough

If your dependencies are reliably current because Renovate PRs get merged quickly, including those for Docker tags and version files, you are on a fixed version fast for most vulnerabilities. On GitHub, vulnerabilityAlerts adds fix PRs for packages that do not wait for the schedule. If you also do not run your own runtimes, what you need most is discipline in merging, not another tool.

When you need more

• Renovate PRs sometimes sit for a few days, and you want to know which one cannot wait.
• Your repos contain Dockerfiles, .php-version, .nvmrc or CI configs with pinned runtime versions, and you want a warning when the runtime is hit, not just the next tag update. Which versions still get security updates is shown in the end-of-life overview for PHP, Node.js and Python.
• You need to prove in an audit when you knew about a vulnerability and how you responded (ISO 27001, NIS2). More in the article vulnerability management under NIS2 and ISO 27001.

How they work together

Let Renovate maintain your versions, with your schedule, your rules and the Dependency Dashboard. Stackwatch reads runtime and packages from your repos, reports matches with evidence and tells you which update is due now. Often the matching Renovate PR is already open. We compare more tools in the overview Dependabot alternatives in 2026.

Sources

• Renovate Docs: Overview (platforms, license, ways to run)
• Renovate Docs: Managers
• Renovate Docs: Dockerfile manager
• Renovate Docs: Configuration options (vulnerabilityAlerts, osvVulnerabilityAlerts)
• Renovate Docs: Dependency Dashboard
• Renovate Docs: Mend-hosted Apps
• Renovate source: osvVulnerabilityAlerts option (experimental)
• PHP Security Advisory GHSA-w8hw-w9fx-j79w