renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 34.76.0 to 34.160.0
207 releases in betweenevery note read
Reading releases, release notes and advisories…
- 3
- changes to make
- 0
- advisories fixed
- 93
- new
- 105
- fixes
Before you upgrade
Tick each one off as you go- breaking34.149.0
- breaking34.132.1
- deprecated34.117.0
Security
3 advisories still affect 34.160.0
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
- 34.146.2
vulnerabilities: prevent exception due to invalid OSV event version
- 34.136.0
vulnerabilities: add additional severity indicators and improve layout
- 34.129.0
vulnerabilities: add feature-flagged support for OSV
Release by release
- new
manager/dockerfile: match Containerfile
- new
- fixed
datasource/npm: cache public modules
- fixed
- new
datasource: add warning when unable to find datasource
- new
- new
manager/gradle: add support for AndroidX Compose plugin
- new
manager/gradle: add support for map notation deps in Groovy maps
- new
34.158.1 – 34.158.22 releases, nothing new or fixed in the notes
- new
manager/asdf: support dart and flutter
- new
manager/gradle: add support for jmh plugin
- new
- fixed
auto-replace pinning
- fixed
datasource/docker: Artifactory next link is broken for tags api
- fixed
- new
datasource/nuget: support password only registry auth
- new
5 other lines we could not sort, mostly version bumps
- 34.157.1
Wrong node version
- 34.139.1
Build on merge groups
- 34.128.1
Remove obsolete npm settings
- 34.117.1
node: drop v14 and default to v18
- 34.97.5
Revert "feat(git): allow to install git-hook functions to local repositories"
296 internal lines (docs, tests, tooling) left out.