renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Your version
32.241.11 is the newest release of 32.x.
npm marks 32.146.0 as deprecated: Renovate versions older than the latest major version are unsupported
In short
3 new5 fixed2 internal
Security
3 advisories affect 32.146.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
Release note
Features
Add hermit binary source
github-actions: update job and service containers
Bug Fixes
buildpack: execute
preCommadson install modeFix failed hermit binary source tests due to findUp module acts differently in windows
Join env var lines with os.EOL to fix test failure on different systems
manager/bazel: fix regex and tests for update function
manager/npm: support yarn update without yarnPath
renovate-config-validator: add validate presets to the validator