renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
36.109.4 is the newest release of 36.x.
In short
20 breaking1 removed14 new2 fixed4 changed5 internal
- breaking
postUpgradeTasks.fileFilters is now optional and defaults to all files
- breaking
languagesare now calledcategoriesinstead. UsematchCategoriesinpackageRules - breaking
Node v19 is no longer supported
- breaking
datasource:
semver-coercedis now the default versioning - breaking
presets: Preset
config:baseis now calledconfig:recommended(will be migrated automatically) - breaking
Remove
BUILDPACKenv support - breaking
package-rules:
matchPackageNamesnow matches bothdepName(existing) andpackageName(new) and warns if onlydepNamematches - breaking
release-notes: Release notes won't be fetched early for
commitBodyinsertion unless explicitly configured withfetchReleaseNotes=branch
Security
4 advisories affect 36.0.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-fr4j-65pv-gjjj · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
Release note
Breaking changes for 36
- breaking
postUpgradeTasks.fileFilters is now optional and defaults to all files
- breaking
languagesare now calledcategoriesinstead. UsematchCategoriesinpackageRules - breaking
Node v19 is no longer supported
- breaking
datasource:
semver-coercedis now the default versioning - breaking
presets: Preset
config:baseis now calledconfig:recommended(will be migrated automatically) - breaking
Remove
BUILDPACKenv support - breaking
package-rules:
matchPackageNamesnow matches bothdepName(existing) andpackageName(new) and warns if onlydepNamematches - breaking
release-notes: Release notes won't be fetched early for
commitBodyinsertion unless explicitly configured withfetchReleaseNotes=branch - breaking
dockerImagePrefixis now replaced bydockerSidecarImage - breaking
matchPathsandmatchFilesare now combined intomatchFileNames, supporting exact match and glob-only. The "any string match" functionality ofmatchPathsis now removed - breaking
presets: v25 compatibility for language-based branch prefixes is removed
- breaking
npm: Rollback PRs will no longer be enabled by default for npm (they are now disabled by default for all managers)
- breaking
post-upgrade-tasks: dot files will now be included by default for all minimatch results
- breaking
platform/gitlab: GitLab
gitAuthorwill change from the account's "email" to "commit_email" if they are different - breaking
automerge: Platform automerge will now be chosen by default whenever automerge is enabled
- breaking
Post upgrade templating is now allowed by default, as long as the post upgrade task command is itself already allowed
- breaking
Official Renovate Docker images now use the "slim" approach with
binarySource=installby default. e.g.renovate/renovate:latestis the slim image, not full - breaking
The "full" image is now available via the tag
full, e.g.renovate/renovate:40-full, and defaults tobinarySource=global(no dynamic installs) - breaking
Third party tools in the full image have been updated to latest/LTS major version
Commentary for 36
If you're self-hosting Renovate, pay particular attention to:
Do you want to run the full, or slim versions of the image? We have switched the defaults (latest is now slim, not full)
Have you configured
dockerImagePrefix? If so then you need to usedockerSidecarImageinsteadIf you're using
config:basein youronboardingConfigthen switch toconfig:recommendedgitAuthormay change if you're on GitLab and have a different commit email for your bot account. If so then configuregitIgnoredAuthorswith the old email
Breaking changes
- breaking
postUpgradeTasks.fileFilters is now optional and defaults to all files
- breaking
languagesare now calledcategoriesinstead. UsematchCategoriesinpackageRules - breaking
Node v19 is no longer supported
- breaking
datasource:
semver-coercedis now the default versioning - breaking
presets: Preset
config:baseis now calledconfig:recommended(will be migrated automatically) - breaking
Remove
BUILDPACKenv support - breaking
package-rules:
matchPackageNamesnow matches bothdepName(existing) andpackageName(new) and warns if onlydepNamematches - breaking
release-notes: Release notes won't be fetched early for
commitBodyinsertion unless explicitly configured withfetchReleaseNotes=branch - breaking
dockerImagePrefixis now replaced bydockerSidecarImage - breaking
matchPathsandmatchFilesare now combined intomatchFileNames, supporting exact match and glob-only. The "any string match" functionality ofmatchPathsis now removed - breaking
presets: v25 compatibility for language-based branch prefixes is removed
- breaking
npm: Rollback PRs will no longer be enabled by default for npm (they are now disabled by default for all managers)
- breaking
post-upgrade-tasks: dot files will now be included by default for all minimatch results
- breaking
platform/gitlab: GitLab
gitAuthorwill change from the account's "email" to "commit_email" if they are different. - breaking
automerge: Platform automerge will now be chosen by default whenever automerge is enabled.
- breaking
Post upgrade templating is now allowed by default, as long as the post upgrade task command is itself already allowed.
- breaking
Official Renovate Docker images now use the "slim" approach with
binarySource=installby default. e.g.renovate/renovate:latestis the slim image, not full - breaking
The "full" image is now available via the tag
full, e.g.renovate/renovate:36-full, and defaults tobinarySource=global(no dynamic installs) - breaking
Third party tools in the full image have been updated to latest/LTS major version
Features
Allow post upgrade templating by default (#21326) (6a95024), closes #21320
automerge: default to platformAutomerge=true (#21327) (61a7813), closes #21319
Commit all files in postUpgradeTasks by default
datasource: default to the central default versioning
- removed
Drop node v19 support
Merge matchPaths and matchFiles into matchFileNames (#22406) (e3d5f7d), closes #22395
npm: disable rollbackPrs for npm by default
npm: support constraintsFiltering=strict (#22447) (ad0479a), closes #4826
package-rules: match packageName for matchPackageNames (#22703) (e4dead2), closes #20926
package-rules: remove fuzzy matchPaths matching
platform/gitlab: prefer
commit_email(#21122) (08bbf81), closes #12532presets: rename
config:basetoconfig:recommended(#21136) (f9e3e80), closes #12024release-notes: support configurable fetching stage (#22781) (c2d3ca8), closes #20476
Remove BUILDPACK env support
Replace
dockerImagePrefixwithdockerSidecarImage(#22708) (aa14b77), closes #21217
Bug Fixes