renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 32.241.11 to 33.0.0
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 12
- changes to make
- 0
- advisories fixed
- 9
- new
- 3
- fixes
Before you upgrade
Tick each one off as you go- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
- breaking33.0.0
Security
3 advisories still affect 33.0.0
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
Release by release
6 other lines we could not sort, mostly version bumps
- 33.0.0
internalChecksFilterwill now default tostrict, meaning that updates will be withheld by default when internal status checks are pending. This should reduce the number of "non-actionable" Pull Requests you get. - 33.0.0
azure-pipelinesmanager is disabled by default, because its primary datasource can unfortunately suggest updates which aren't yet installable. Users should opt into this manager once they know the risks. - 33.0.0
binarySource=installwill now be used instead ofglobalwhenever Renovate is run within a "containerbase" image. This means dynamic installation of most package managers and languages - 33.0.0
Dependencies will no longer be pinned by default if
rangeStrategy=auto. While we recommend pinning dependencies, we decided users should opt into this more explicitly. - 33.0.0
AWS CodeCommit platform support
- 33.0.0
OpenTelemetry support
2 internal lines (docs, tests, tooling) left out.