renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 35.159.7 to 36.0.0
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 21
- changes to make
- 0
- advisories fixed
- 14
- new
- 2
- fixes
Before you upgrade
Tick each one off as you go- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
- breaking36.0.0
Security
4 advisories still affect 36.0.0
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
Release by release
4 other lines we could not sort, mostly version bumps
- 36.0.0
Do you want to run the full, or slim versions of the image? We have switched the defaults (latest is now slim, not full)
- 36.0.0
Have you configured
dockerImagePrefix? If so then you need to usedockerSidecarImageinstead - 36.0.0
If you're using
config:basein youronboardingConfigthen switch toconfig:recommended - 36.0.0
gitAuthormay change if you're on GitLab and have a different commit email for your bot account. If so then configuregitIgnoredAuthorswith the old email
5 internal lines (docs, tests, tooling) left out.