renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
40.62.1 is the newest release of 40.x.
In short
6 breaking4 new2 internal
- breaking
config:
allowedCommandsfilters need to be updated to match against the post-compiledpostUpgradeCommandsin cases where templating was in use. - breaking
config: Config Warning issues will be created fresh/new each time if no existing open warning was found, instead of reopening/reusing old warning issues.
- breaking
autodiscoverFilter: Syntax for autodiscoverFilter has been changed to allow for Glob, Regex, and negative matches.
- breaking
datasource/maven: Renovate will now enforce
latestversion for Maven upgrades - breaking
Node v20 is no longer supported, Node v22.13 is the minimum required
- breaking
Require node v22.13
Security
6 advisories affect 40.0.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml fileGHSA-xjr7-3c3g-m763 · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-fr4j-65pv-gjjj · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repositoryGHSA-xv56-3wq5-9997 · 13 Jan 2026Fixed in 40.33.0
1 more
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
Release note
Breaking changes
- breaking
config:
allowedCommandsfilters need to be updated to match against the post-compiledpostUpgradeCommandsin cases where templating was in use. - breaking
config: Config Warning issues will be created fresh/new each time if no existing open warning was found, instead of reopening/reusing old warning issues.
- breaking
autodiscoverFilter: Syntax for autodiscoverFilter has been changed to allow for Glob, Regex, and negative matches.
- breaking
datasource/maven: Renovate will now enforce
latestversion for Maven upgrades - breaking
Node v20 is no longer supported, Node v22.13 is the minimum required
Features
autodiscoverFilter: support combined negative matches
config: create new Config Warning issues each time
config: validate allowedCommands against post-compiled commands
datasource/maven: use latest and release values as tags
- breaking
Require node v22.13