renovate
44.206.2 · 2 Nov 2026AGPL-3.0-only559.5k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 32.10.6 to 32.241.11
580 releases in betweenevery note read
- 5
- changes to make
- 0
- advisories fixed
- 246
- new
- 276
- fixes
Before you upgrade
Tick each one off as you go- breaking32.212.0
- breaking32.105.1
- breaking32.102.3
- deprecated32.50.3
- deprecated32.11.0
Security
3 advisories still affect 32.241.11
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
- 32.82.1
config: no stabillity days for vulnerability alerts
- 32.32.7
Crate cargo vulnerability datasource mapping
- 32.20.0
Add osv-vulnerabilities and vulnerability service
Release by release
- fixed
data: automatic update of static data
- fixed
- fixed
manager/gradle: allow dependency classifiers
- fixed
- fixed
http: use request for retryCount
- fixed
- fixed
parentSha logic
- fixed
- fixed
datasource/docker: log http mode for getManifestResponse
- fixed
http: improve error logging
- fixed
- fixed
npm: support frozen-lockfile in .yarnrc
- fixed
32.241.2 – 32.241.54 releases, nothing new or fixed in the notes
- fixed
Fix git perms
- fixed
22 other lines we could not sort, mostly version bumps
- 32.222.0
Cache jest
- 32.194.2
Revert "feat: recreate merged PRs when updates are available"
- 32.193.1
label actions: use simpler words
- 32.162.0
update-data: improve step names
- 32.153.3
Create update-data scheduled workflow
- 32.150.1
- 32.103.1
Give write permissions to release phase only
- 32.102.3
Increase build permissions
- 32.102.3
Set permissions for all workflows
- 32.99.6
964 internal lines (docs, tests, tooling) left out.