renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 44.190.0 | No known advisory | |
| 43.288.0 | Safe from 43.102.11 | |
| 42.99.0 | Safe from 42.96.3 | |
| 41.173.1 | 1 open advisory, worst moderate | |
| 40.62.1 | 43 open advisories, worst moderate · last release Jun 2025, no longer updated |
- ModerateRenovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenanceGHSA-5vjq-5jmg-39xq · 16 Apr 2026fixed in 43.102.11
- ModerateChild processes spawned by Renovate incorrectly have full access to environment variablesGHSA-8wc6-vgrq-x6cf · 13 Feb 2026fixed in 43.4.4, 42.96.3
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-3f44-xw83-3pmg · 13 Jan 2026fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml fileGHSA-xjr7-3c3g-m763 · 13 Jan 2026fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-36j9-mx87-2cff · 13 Jan 2026fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-fr4j-65pv-gjjj · 13 Jan 2026fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repositoryGHSA-xv56-3wq5-9997 · 13 Jan 2026fixed in 40.33.0
- ModerateRenovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`GHSA-pfq2-hh62-7m96 · 13 Jan 2026fixed in 42.68.5
- ModerateRenovate vulnerable to arbitrary command injection via helmv3 manager and registryAliasesGHSA-rqgv-292v-5qgr · 23 Apr 2024fixed in 37.199.0
- ModerateRenovate vulnerable to Azure DevOps token leakage in logsGHSA-36rh-ggpr-j3gj · 14 Sep 2020fixed in 23.25.1
- ModerateRenovate vulnerable to leakage of temporary repository tokens into Pull Request commentsGHSA-v7x3-7hw7-pcjg · 21 Oct 2019fixed in 19.38.7
Registry facts last checked 28 Oct 2026. Releases and advisories last read 28 Oct 2026.