renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 35.4.1 to 35.159.7
340 releases in betweenevery note read
Reading releases, release notes and advisories…
- 3
- changes to make
- 0
- advisories fixed
- 170
- new
- 147
- fixes
Before you upgrade
Tick each one off as you go- breaking35.8.0
- deprecated35.63.0
- deprecated35.56.0
Security
4 advisories still affect 35.159.7
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
- 35.90.0
vulnerabilities: add option to add summary to dashboard
- 35.88.0
vulnerabilities: handle medium and unknown severities
- 35.80.0
vulnerabilities: set, maintain and expose vulnerabilitySeverity for templated fields
- 35.53.0
vulnerabilities: return interface for Vulnerabilities
- 35.46.1
vulnerabilities: rename fetchVulnerabilities to appendVulnerabilityPackageRules
- 35.31.5
vulnerabilities: skip withdrawn security advisories
Release by release
- fixed
changelog/gitlab: custom endpoint and repository length validation
- fixed
- fixed
markdown: don't remove char before
#
- fixed
- fixed
platform: compare target refs before updating
- fixed
35.159.4nothing new or fixed in the note
- fixed
changelog: remove urls from md heading url
- fixed
presets: Update @aws-lambda-powertools monorepo url
- fixed
- fixed
datasource/packagist: Use serializable type for
availablePackages
- fixed
35.159.1nothing new or fixed in the note
- new
platform/bitbucket: add support for fetching release notes
- new
22 other lines we could not sort, mostly version bumps
- 35.125.0
Combine coverage from all shards
- 35.124.2
Switch to
lcovoutput format - 35.119.0
Increase
fetch-depthto 2 for codecov job - 35.119.0
Separate jobs for docs linting and building
- 35.117.4
Move website docs lint from tests to lint job
- 35.117.4
Refactor
releasejob - 35.117.2
Cache
re2dependency - 35.117.2
Simplify cache miss detection
- 35.117.0
Detect commit SHA reliably
- 35.117.0
Extract
test-e2eas separate job
518 internal lines (docs, tests, tooling) left out.