renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Your version
37.440.7 is the newest release of 37.x.
In short
2 breaking2 internal
- breaking
npm: drop explicit lerna support
- breaking
maven: use hunt strategy for registries
Security
4 advisories affect 37.0.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-fr4j-65pv-gjjj · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
Release note
Breaking changes for 37
- breaking
npm: drop explicit lerna support
Commentary for 37
We switched from "merge" strategy to "hunt" strategy to match with how Maven works.
Lerna v7 does not need our explicit support anymore, so we dropped it.
If you're on a version of Lerna before v7, you should prioritize upgrading to v7.
Breaking changes
- breaking
maven: use hunt strategy for registries
- breaking
npm: drop explicit lerna support
Features
maven: use hunt strategy for registries
npm: drop explicit lerna support