renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
Your version
40.62.1 is the newest release of 40.x.
In short
1 new1 fixed2 internal
Security
Fixes 5 advisories that affected 40.32.7
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml fileGHSA-xjr7-3c3g-m763 · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-fr4j-65pv-gjjj · 13 Jan 2026Fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repositoryGHSA-xv56-3wq5-9997 · 13 Jan 2026Fixed in 40.33.0
1 advisory affects 40.33.0; 42.68.5 fixes them
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026Fixed in 42.68.5
Release note
Features
presets: add
react-springmonorepo
Bug Fixes
managers: quote more manager commands