Packages

renovate

44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed

Your version

36.0.0

major4 Jul 2023Where it was published

36.109.4 is the newest release of 36.x.

In short

20 breaking1 removed14 new2 fixed4 changed5 internal

  • breaking

    postUpgradeTasks.fileFilters is now optional and defaults to all files

  • breaking

    languages are now called categories instead. Use matchCategories in packageRules

  • breaking

    Node v19 is no longer supported

  • breaking

    datasource: semver-coerced is now the default versioning

  • breaking

    presets: Preset config:base is now called config:recommended (will be migrated automatically)

  • breaking

    Remove BUILDPACK env support

  • breaking

    package-rules: matchPackageNames now matches both depName (existing) and packageName (new) and warns if only depName matches

  • breaking

    release-notes: Release notes won't be fetched early for commitBody insertion unless explicitly configured with fetchReleaseNotes=branch

Security

Release note

Breaking changes for 36

  • breaking

    postUpgradeTasks.fileFilters is now optional and defaults to all files

  • breaking

    languages are now called categories instead. Use matchCategories in packageRules

  • breaking

    Node v19 is no longer supported

  • breaking

    datasource: semver-coerced is now the default versioning

  • breaking

    presets: Preset config:base is now called config:recommended (will be migrated automatically)

  • breaking

    Remove BUILDPACK env support

  • breaking

    package-rules: matchPackageNames now matches both depName (existing) and packageName (new) and warns if only depName matches

  • breaking

    release-notes: Release notes won't be fetched early for commitBody insertion unless explicitly configured with fetchReleaseNotes=branch

  • breaking

    dockerImagePrefix is now replaced by dockerSidecarImage

  • breaking

    matchPaths and matchFiles are now combined into matchFileNames, supporting exact match and glob-only. The "any string match" functionality of matchPaths is now removed

  • breaking

    presets: v25 compatibility for language-based branch prefixes is removed

  • breaking

    npm: Rollback PRs will no longer be enabled by default for npm (they are now disabled by default for all managers)

  • breaking

    post-upgrade-tasks: dot files will now be included by default for all minimatch results

  • breaking

    platform/gitlab: GitLab gitAuthor will change from the account's "email" to "commit_email" if they are different

  • breaking

    automerge: Platform automerge will now be chosen by default whenever automerge is enabled

  • breaking

    Post upgrade templating is now allowed by default, as long as the post upgrade task command is itself already allowed

  • breaking

    Official Renovate Docker images now use the "slim" approach with binarySource=install by default. e.g. renovate/renovate:latest is the slim image, not full

  • breaking

    The "full" image is now available via the tag full, e.g. renovate/renovate:40-full, and defaults to binarySource=global (no dynamic installs)

  • breaking

    Third party tools in the full image have been updated to latest/LTS major version

Commentary for 36

If you're self-hosting Renovate, pay particular attention to:

  • Do you want to run the full, or slim versions of the image? We have switched the defaults (latest is now slim, not full)

  • Have you configured dockerImagePrefix? If so then you need to use dockerSidecarImage instead

  • If you're using config:base in your onboardingConfig then switch to config:recommended

  • gitAuthor may change if you're on GitLab and have a different commit email for your bot account. If so then configure gitIgnoredAuthors with the old email

Breaking changes

  • breaking

    postUpgradeTasks.fileFilters is now optional and defaults to all files

  • breaking

    languages are now called categories instead. Use matchCategories in packageRules

  • breaking

    Node v19 is no longer supported

  • breaking

    datasource: semver-coerced is now the default versioning

  • breaking

    presets: Preset config:base is now called config:recommended (will be migrated automatically)

  • breaking

    Remove BUILDPACK env support

  • breaking

    package-rules: matchPackageNames now matches both depName (existing) and packageName (new) and warns if only depName matches

  • breaking

    release-notes: Release notes won't be fetched early for commitBody insertion unless explicitly configured with fetchReleaseNotes=branch

  • breaking

    dockerImagePrefix is now replaced by dockerSidecarImage

  • breaking

    matchPaths and matchFiles are now combined into matchFileNames, supporting exact match and glob-only. The "any string match" functionality of matchPaths is now removed

  • breaking

    presets: v25 compatibility for language-based branch prefixes is removed

  • breaking

    npm: Rollback PRs will no longer be enabled by default for npm (they are now disabled by default for all managers)

  • breaking

    post-upgrade-tasks: dot files will now be included by default for all minimatch results

  • breaking

    platform/gitlab: GitLab gitAuthor will change from the account's "email" to "commit_email" if they are different.

  • breaking

    automerge: Platform automerge will now be chosen by default whenever automerge is enabled.

  • breaking

    Post upgrade templating is now allowed by default, as long as the post upgrade task command is itself already allowed.

  • breaking

    Official Renovate Docker images now use the "slim" approach with binarySource=install by default. e.g. renovate/renovate:latest is the slim image, not full

  • breaking

    The "full" image is now available via the tag full, e.g. renovate/renovate:36-full, and defaults to binarySource=global (no dynamic installs)

  • breaking

    Third party tools in the full image have been updated to latest/LTS major version

Features

  • Allow post upgrade templating by default (#21326) (6a95024), closes #21320

  • automerge: default to platformAutomerge=true (#21327) (61a7813), closes #21319

  • Categories (#16534) (19259a0), closes #13953

  • Commit all files in postUpgradeTasks by default

  • datasource: default to the central default versioning

  • removed

    Drop node v19 support

  • Merge matchPaths and matchFiles into matchFileNames (#22406) (e3d5f7d), closes #22395

  • npm: disable rollbackPrs for npm by default

  • npm: support constraintsFiltering=strict (#22447) (ad0479a), closes #4826

  • package-rules: match packageName for matchPackageNames (#22703) (e4dead2), closes #20926

  • package-rules: remove fuzzy matchPaths matching

  • platform/gitlab: prefer commit_email (#21122) (08bbf81), closes #12532

  • presets: rename config:base to config:recommended (#21136) (f9e3e80), closes #12024

  • release-notes: support configurable fetching stage (#22781) (c2d3ca8), closes #20476

  • Remove BUILDPACK env support

  • Replace dockerImagePrefix with dockerSidecarImage (#22708) (aa14b77), closes #21217

Bug Fixes

  • post-upgrade-tasks: enable dot option for file filters (#21282) (bc693f2), closes #21276

  • presets: remove compatibility:additionalBranchPrefix