Packages

renovate

44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate from 32.88.1 to 40.33.0

3,819 releases in betweennotes for 3,816

Reading releases, release notes and advisories…

Other targets from 32.88.1Newest 32.x32.241.11Latest44.198.3
112+
changes to make
1
advisory fixed
1688+
new
1971+
fixes

Counted from 3816 of 3819 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking40.0.0
  • breaking40.0.0
  • breaking40.0.0
  • breaking40.0.0
  • breaking40.0.0
  • breaking40.0.0
  • breaking39.238.2
  • breaking39.118.5
  • breaking39.0.0
  • breaking39.0.0

Security

1 advisory still affects 40.33.0

Upgrading to 42.68.5 clears it.

Fixes 1 advisory affecting 32.88.1

  • CVSS4.0 vector parse exception - vulnerability severity fallback

    39.215.1

  • vulnerabilities: Add Hackage support

    39.87.0

  • vulnerabilities: correct range syntax for nuget

    38.96.1

  • vulnerabilities: set matchCurrentVersion for github alerts

    38.95.3

  • vulnerability-alerts: fix handling of first_patched_version: null

    38.85.2

  • vulnerabilities: do not force exact patch version for NuGet datasource

    38.59.2

  • config: sanitize special characters from branch names for vulnerability type PRs. This may cause Renovate to autoclose/replace existing PRs

    38.0.0

  • npm: for npm versions lower than 7, drop support for remediating vulnerabilities in transitive dependencies

    38.0.0

  • This is because security vulnerabilities in Node.js can affect Renovate too.

    38.0.0

  • config: Use depNameSanitized in branch name for vulnerability alerts

    38.0.0

Release by release

  1. 40.33.0

    27 May 20251 new · 1 fix
    • new

      presets: add react-spring monorepo

    • fixed

      managers: quote more manager commands

  2. 40.32.7

    27 May 20251 fix
    • fixed

      Static repo config order and merge extends

  3. 40.32.2 – 40.32.65 releases, nothing new or fixed in the notes

  4. 40.32.1

    26 May 20251 fix
    • fixed

      git: use custom name for upstream

  5. 40.32.0

    26 May 20251 new · 1 fix
    • new

      manager/asdf: support clusterctl

    • fixed

      dashboard: don't show undefined being displayed

  6. 40.31.1

    26 May 20253 fixes
    • fixed

      deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.7 (main)

    • fixed

      exec: pass CI env to child processes

    • fixed

      helmv3: helm charts with lockfiles never gets automerged

  7. 40.31.0

    25 May 20251 new
    • new

      Display abandoned packages

  8. 40.30.2

    25 May 20251 fix
    • fixed

      versioning/pep440: apply prerelease markers

86 other lines we could not sort, mostly version bumps

  • Explicit permissions

    40.4.0

  • Remove unused permissions

    39.191.3

  • Extract build-docker job

    39.191.1

  • Do dry-run

    39.181.1

  • Run on next and maint/** branches

    39.177.0

  • Disable Windows tests

    39.31.4

  • Revert "fix(bitbucket): source link root path"

    39.26.3

  • Revert "feat(manager/asdf): add support for java semeru and semeru-jre"

    39.25.2

  • prettier: show diff if prettier made changes

    38.41.0

  • "matchPackageNames": "/^com.renovatebot/" (regex)

    38.0.0

5317 internal lines (docs, tests, tooling) left out.