Put your rules in a shareable preset file in a central repository, then have each repo extend it from its own Renovate config. Pin the preset to a tag when stability matters, and keep team overrides small. This gives every repo the same update policy from one place.
How presets work
According to the Renovate documentation, shareable config presets are files stored in a repository and referenced from the extends array. They must be JSON, JSONC or JSON5, and can be nested. Supported hosts include github>, gitlab>, gitea>, forgejo> and local>.
File naming rules from the docs:
| Reference | Loads |
|---|---|
github>org/repo | default.json from that repo |
github>org/repo:name | name.json |
github>org/repo//path/name | path/name.json |
...#1.2.3 | Pins a Git tag |
Without a tag, the default branch is used. The docs say using renovate.json as the default preset file name is deprecated, so use default.json.
Org level presets
During onboarding, Renovate looks for a repo named renovate-config containing default.json in the owning user, group or org, or a repo named like .github with renovate-config.json. If found, it is suggested as the extended preset for new onboarding pull requests.
A sensible preset for security
Include in the shared preset:
- Grouping rules so minor and patch updates arrive in fewer pull requests
- Security update handling with a higher priority and labels
- A schedule that avoids interrupting working hours
- Pin digests or SHAs for CI actions and container images
- A limit on open pull requests so teams are not flooded
Keep language specific rules in separate named presets, such as default.json plus node.json, so teams opt in by language.
Team overrides
Repos can add their own settings after the extends line. The docs describe ignorePresets for skipping a preset a repo would otherwise inherit, and note that you must use the absolute preset string including the tag to match. Prefer narrow overrides, such as a package rule, over ignoring the whole preset.
Rollout steps
- Create the preset repo with two owners.
- Copy the common rules from a few repos into
default.json. - Tag a release, such as 1.0.0.
- Open onboarding pull requests that extend the preset at that tag.
- Release new versions, and let a bot move callers forward.
Security note
Anyone who can change the preset can change update behaviour in every repo that uses it. Protect it with review rules and CODEOWNERS.
Quick check
Does a shared preset force teams to merge updates?
No. It sets how pull requests are opened. Merge policy is controlled by repo settings and your pipeline gates.
Can we do the same with Dependabot?
The mechanics differ, so check its own documentation. This post covers Renovate only.
Safeguard offers autonomous remediation with fix pull requests, off by default with every category on Manual, which can complement update bots.
Sources
- Renovate Docs: Shareable config presets, fetched 19 October 2026
Last reviewed: 19 October 2026.
