renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
39.264.1 is the newest release of 39.x.
In short
6 new8 fixed1 changed21 internal
Security
5 advisories affect 39.177.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml fileGHSA-xjr7-3c3g-m763 · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-fr4j-65pv-gjjj · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
Release note
Features
deps: update ghcr.io/renovatebot/base-image docker tag to v9.42.0
deps: update ghcr.io/renovatebot/base-image docker tag to v9.43.0
gitea/forgejo: set poster server filter for pr cache
gradle: bump strategy
pip-compile: support tool version constraints with uv
Bug Fixes
Append the static repo config to the repo config
bazel-module: Add replaceString to oci_pull PackageDependency
deps: update ghcr.io/containerbase/sidecar docker tag to v13.7.17
deps: update ghcr.io/renovatebot/base-image docker tag to v9.41.3
git: Remove obsolete cleanup for renovate temp refs
lockfilemaintenance: ensure
isLockFileMaintenanceon groupingplatform/gitlab): Revert "feat(platform/gitlab: use Notes API for automerge to support merge trains"
presets): Revert "fix(presets: actually group Node.js packages"
reconfigure: massage config prior to validation
Continuous Integration
Run on
nextandmaint/**branches