renovate

Breaking changes for 38

General:

• breaking

  Require Node.js 20

• breaking

  The Renovate Docker images no longer have -slim tags. You must stop using the -slim prefix. Renovate now defaults to the -slim tag type behavior.

Specific:

• breaking

  bitbucket-server: autodetect gitAuthor, if possible

• breaking

  config: change from boolean to enum for onboardingNoDeps. Renovate now onboards repositories with no dependencies, with one exception: if you run Renovate in autodiscover mode then you must manually onboard Renovate for repos with no dependencies

• security

  config: sanitize special characters from branch names for vulnerability type PRs. This may cause Renovate to autoclose/replace existing PRs

• breaking

  config: change the order of globalExtends resolution, it is applied first and remaining global config takes precedence

• breaking

  datasource/docker: Docker Hub lookups prefers hub.docker.com over index.docker.io. To revert to the old behavior: set RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true in your env

• breaking

  git: check all commits on the branch to decide if the branch was modified

• breaking

  gitea: use "bearer auth" instead of "token auth" to authenticate to the Gitea platform

• breaking

  gomod: the value of GOSUMDB was previously set to off, meaning the Go toolchain would not validate signatures for modules. This has now been corrected, which may result in errors updating Go modules. In particular, if you are using Renovate with private Go modules, you will need to set GOPRIVATE. For more details, see Go's official documentation for working with private Go modules.

• breaking

  http: remove dnsCache

• breaking

  logging: you must set file logging via env, not in config.js

• breaking

  manager/pep621: change depName for pep621 dependencies. This causes the branch name for pep621 updates to change, which in turn means Renovate may autoclose and re-open some pep621 PRs. Also, Renovate may start grouping dependencies into a single PR.

• security

  npm: for npm versions lower than 7, drop support for remediating vulnerabilities in transitive dependencies

• breaking

  npm: remove RENOVATE_CACHE_NPM_MINUTES

• breaking

  packageRules: matchPackageNames (and related functions) no longer fall back to checking depName

• breaking

  packageRules: matchPackageNames exact matches are now case-insensitive

Commentary for 38

Our Docker images are slim by default

If you self-host using Renovate's Docker -slim images: drop the -slim suffix, and switch to the default tags.
Renovate's default tags like 38.0.0 are "slim" by default.
There's no change if you're using the -full images.

Renovate needs Node.js 20

Renovate now needs Node.js ^20.15.1 to run.
Our Docker images already use the correct version of Node.js.

But if you self-host without using our Docker image, then you must update the version of Node.js.
You must update manually, if for example: you build your own image, or run the renovate npm package.

Why we picked Node 20

We dropped Node.js 18, and do not yet support Node.js 22 as it's non-LTS and not recommended for production.

Why we picked a non-vulnerable version of Node

We decided to require the current non-vulnerable version of Node.js (20.15.1 or newer).
If we ever need to bump the minimum version of Node.js v20, we will release a new major version of Renovate.

If you self-host: we recommend you always run a secure version of Node.js v20.
This is because security vulnerabilities in Node.js can affect Renovate too.

If you use Mend's Renovate GitHub app

We recommend that all users running Renovate as a GitHub App use platformCommit.
Renovate now defaults to platformCommit is enabled, when Renovate detects a GitHub App token.
For PATs, we still recommend regular commits.

Log file configuration requires env settings

File-based logging must be configured using environment variables (e.g. LOG_FILE).
Do not set logging in files or CLI (such as logFile).

This ensures that logging begins right when Renovate starts a run.
It also means Renovates logs how it parses the config.

Changes to package matching

Finally, we merged the matchPackage* and excludePackage* options into matchPackageNames.
We also enabled patterns for the matchPackageNames config option.

This means you can now use regex or glob patterns:

• "matchPackageNames": "/^com.renovatebot/" (regex)

• "matchPackageNames": "@renovate/*" (glob)

And of course, you can still use exact name matching.

Breaking changes

• breaking

  bitbucket-server: autodetect gitAuthor if possible

• breaking

  Require node v20

• breaking

  http: dnsCache is now removed

• breaking

  npm: remove RENOVATE_CACHE_NPM_MINUTES

• breaking

  git: determine branch modification based on all branch commits

• breaking

  packageRules: matchPackageNames exact matches are now case-insensitive

• breaking

  datasource/docker: Docker Hub lookups prefer hub.docker.com over index.docker.io. Set RENOVATE_X_DOCKER_HUB_TAGS_DISABLE=true in env to revert behavior.

• breaking

  package-rules: matchPackageNames and related functions no longer fall back to checking depName.

• breaking

  logging: File logging must now be set via env and not in config.js

• breaking

  config: onboardingNoDeps changes from boolean to enum. Repositories with no dependencies will be onboarded unless in autodiscover mode.

• breaking

  npm: Transitive remediation for npm <7 is no longer supported.

• breaking

  config: Branch names for remediation will be sanitized to exclude special characters, potentially resulting in some autoclosing/replacing of existing PRs.

• breaking

  Renovate docker images no longer have -slim tags. Drop the -slim prefix as this is now the default behavior.

• breaking

  gitea: Gitea platfor authentication will now be done using Bearer auth instead of token auth.

• breaking

  manager/pep621: depName for pep621 dependencies changes, which will lead to branch name changes, which will lead to some autoclosing and reopening of PRs.

• breaking

  config: order of globalExtends resolution is changed so that it is applied first and remaining global config takes precedence.

Features

• bitbucket-server: autodetect gitAuthor if possible

• config: * pattern matches everything

• config: change onboardingNoDeps from boolean to enum (#28133) (0c500f5), closes #28101

• datasource/docker: prefer hub.docker.com over index.docker.io for tag lookups (#28400) (adcffd2), closes #24666

• deps: update ghcr.io/renovatebot/base-image docker tag to v7

• git: determine branch modification based on all branch commits

• gitea: use Bearer instead of token for auth

• removed

  http: remove dnsCache option

• logging: drop logFile and logFileLevel

• logging: initialize file logging via env (#28104) (c6c4572), closes #14705

• manager/pep621: remove group name from depName (#28193) (2ad12cc), closes #28131

• removed

  npm: drop transitiveRemediation option

• npm: remove RENOVATE_CACHE_NPM_MINUTES

• package-rules: remove depName fallback

• packageRules: migrate matchers and excludes

• packageRules: support glob/regex patterns for matchPackageNames

• packageRules: support regex or glob matching for all

• Prepare for containerbase changes

• Stop publishing slim docker tags

Bug Fixes

• config: globalExtends merge order (#28145) (e3175a3), closes #28131

• security

  config: Use depNameSanitized in branch name for vulnerability alerts

• deps: update ghcr.io/containerbase/sidecar docker tag to v11

• Normalize Python depName in every manager

• presets: replace matchPackagePrefix/Patterns with matchPackageNames

Code Refactoring

• security

  vulnerability-alerts: move to REST API