renovate

44.206.2 · 2 Nov 2026AGPL-3.0-only559.5k / weekRepository Homepage npm Atom feed

Upgrading renovate From 15.17.1 to 16.0.0

Same major only

1 release in betweenevery note read

Reading releases, release notes and advisories…

Other targets from 15.17.1Clears its advisory19.38.7 Latest44.206.2

15.17.1yours
16.0.0target

2
changes to make: 0
advisories fixed: 1
new: 1
fix

Before you upgrade

Tick each one off as you go

requireConfig is now enforced, if enabled. If a repository has no config but merged PRs, it will still be skipped.
breaking16.0.0
If you run your own bot and wish to allow config-less repositories (e.g. no renovate.json) then override this value to false in your bot config.
breaking16.0.0

Security

1 advisory still affects 16.0.0

Renovate vulnerable to leakage of temporary repository tokens into Pull Request commentsmoderate · GHSA-v7x3-7hw7-pcjg

Upgrading to 19.38.7 clears it.

Release by release

16.0.0
Migration needed16 Apr 20191 new · 1 fix
- breaking
  requireConfig is now enforced, if enabled. If a repository has no config but merged PRs, it will still be skipped.
- breaking
  If you run your own bot and wish to allow config-less repositories (e.g. no renovate.json) then override this value to false in your bot config.
- new
  Default requireConfig to true (#3409) (e340fe5), closes #3337
- fixed
  Nodejs 11 support (#3549) (05a46dd), closes /github.com/nodejs/node/pull/22754#issuecomment-423452575 #3445

1 internal line (docs, tests, tooling) left out.

Upgrade to 16.0.0

npm install renovate@16.0.0

What 16.0.0 needs

Reading 16.0.0's manifest…

Check against your package.json

Which of your other dependencies stand in the way of 16.0.0. Read once, not stored.

After upgrading

Run the type checker, the linter and the tests.
Build, and look for new deprecation warnings.
Update peer dependencies the new version asks for.
1 advisory still affects 16.0.0.