renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Your version
37.440.7 is the newest release of 37.x.
In short
1 new2 fixed2 internal
Security
5 advisories affect 37.185.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-fr4j-65pv-gjjj · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and registryAliasesGHSA-rqgv-292v-5qgr · 23 Apr 2024Fixed in 37.199.0
Release note
Features
manager/pip-compile: Add support for non-default package repos to the pip-compile manager
Bug Fixes
deps: update ghcr.io/containerbase/sidecar docker tag to v9.33.9
deps: update ghcr.io/renovatebot/base-image docker tag to v1.23.5