renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 33.0.2 to 33.2.4
6 releases in betweenevery note read
Reading releases, release notes and advisories…
Security
3 advisories still affect 33.2.4
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
Release by release
- fixed
autodiscover: accept simple string
- fixed
- fixed
manager/mix: ignore comments when extracting deps
- fixed
- fixed
manager/gradle: only accept known format for optional classifiers
- fixed
33.2.1nothing new or fixed in the note
- new
platform/codecommit: add token support in config_js and update docs
- new
- new
pip-compile: handle
--strip-extrasargument
- new
1 other line we could not sort, mostly version bumps
- 33.2.1
Make node v16 required
9 internal lines (docs, tests, tooling) left out.