renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
33.2.4 is the newest release of 33.x.
In short
11 breaking1 deprecated9 new3 fixed6 changed2 internal
- breaking
Node 16 is the required runtime for Renovate.
- breaking
[NOTE: This was reverted in v34] config:
branchNameStrictdefault value is nowtrue - breaking
config:
internalChecksFilterdefault value is now"strict" - breaking
config:
ignoreScriptsdefault value is nowtrue. IfallowScripts=truein global config,ignoreScriptsmust be set tofalsein repo config if you want all repos to run scripts. - breaking
config:
autodiscoverfilters can no longer include commas - breaking
config: boolean variables must be
trueorfalsewhen configured in environment variables, and errors will be thrown for invalid values. Previously invalided values were ignored and treated asfalse. - breaking
datasource/go:
git-tagsdatasource will be used as the fallback instead ofgithub-tagsif a go package's host type is unknown. - breaking
jsonnet-bundler:
depNamenow uses the "absolute import" format (e.g.bar→github.com/foo/bar/baz-wow)
Security
3 advisories affect 33.0.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
Release note
This release contains some changes of default values/behavior:
internalChecksFilterwill now default tostrict, meaning that updates will be withheld by default when internal status checks are pending. This should reduce the number of "non-actionable" Pull Requests you get.azure-pipelinesmanager is disabled by default, because its primary datasource can unfortunately suggest updates which aren't yet installable. Users should opt into this manager once they know the risks.binarySource=installwill now be used instead ofglobalwhenever Renovate is run within a "containerbase" image. This means dynamic installation of most package managers and languagesDependencies will no longer be pinned by default if
rangeStrategy=auto. While we recommend pinning dependencies, we decided users should opt into this more explicitly.
And two major features!
AWS CodeCommit platform support
OpenTelemetry support
Both the above are considered "experimental". Please test them out and let us know your feedback - both positive or negative - so that we can progress them to fully available.
Breaking changes
- breaking
Node 16 is the required runtime for Renovate.
- breaking
[NOTE: This was reverted in v34] config:
branchNameStrictdefault value is nowtrue - breaking
config:
internalChecksFilterdefault value is now"strict" - breaking
config:
ignoreScriptsdefault value is nowtrue. IfallowScripts=truein global config,ignoreScriptsmust be set tofalsein repo config if you want all repos to run scripts. - breaking
config:
autodiscoverfilters can no longer include commas - breaking
config: boolean variables must be
trueorfalsewhen configured in environment variables, and errors will be thrown for invalid values. Previously invalided values were ignored and treated asfalse. - breaking
datasource/go:
git-tagsdatasource will be used as the fallback instead ofgithub-tagsif a go package's host type is unknown. - breaking
jsonnet-bundler:
depNamenow uses the "absolute import" format (e.g.bar→github.com/foo/bar/baz-wow) - breaking
azure-pipelines: azure-pipelines manager is now disabled by default.
- breaking
Users of
containerbaseimages (such as official Renovate images) will now have dynamic package manager installs enabled by default. - breaking
Dependencies are no longer automatically pinned if
rangeStrategy=auto, pinning must be opted into usingrangeStrategy=pin
Features
azure-pipelines: disable by default (#18142) (deea750), closes #15818
config: default branchNameStrict=true
config: move autodiscovery filter from string to array (#16525) (0a6d97f), closes #8763
Default internalChecksFilter to strict
Default to binarySource=install (#18027) (0be74f3), closes #14531
- deprecated
Deprecate node v14
Do not auto pin rangeStrategy (#18309) (cbca54d), closes #18304
jsonnet-bundler: Use absolute import format for depName (#14525) (5e7844f), closes #13568
Support AWS Code Commit platform
telemetry: add OpenTelemetry tracing MVC
Bug Fixes