renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 36.69.0 to 36.109.4
103 releases in betweenevery note read
Reading releases, release notes and advisories…
- 1
- change to make
- 0
- advisories fixed
- 48
- new
- 43
- fixes
Before you upgrade
Tick each one off as you go- breaking36.96.0
Security
4 advisories still affect 36.109.4
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
Release by release
- fixed
kustomize: validate name is a string
- fixed
36.109.2 – 36.109.32 releases, nothing new or fixed in the notes
- new
presets: added @types/testing-library__ to jsUnitTest preset
- new
- new
Improve xunit monorepo
- new
- fixed
mix: don’t stop parsing if a package contains “end”
- fixed
- new
manager/npm: extract currentValue from Yarn 'npm:' prefixed alias
- new
36.107.3nothing new or fixed in the note
- fixed
docker: suppress gcr.io error
- fixed
2 other lines we could not sort, mostly version bumps
- 36.104.0
Remove gradle wrapper binaries for openssf score
- 36.83.0
Revert "feat(manager/poetry): extract python as a dependency from
pyproject.toml"
146 internal lines (docs, tests, tooling) left out.