renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 37.362.0 to 42.96.3
2,502 releases in betweennotes for 2,499
Counted from 2499 of 2502 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking42.67.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
Security
Fixes 4 advisories affecting 37.362.0
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
- 42.34.1
dashboard: formatting for vulnerabilities section
- 41.107.0
vulnerabilities: add support for CVSS 4.0 in OSV alerts
- 39.215.1
CVSS4.0 vector parse exception - vulnerability severity fallback
- 39.87.0
vulnerabilities: Add Hackage support
- 38.96.1
vulnerabilities: correct range syntax for nuget
- 38.95.3
vulnerabilities: set matchCurrentVersion for github alerts
- 38.85.2
vulnerability-alerts: fix handling of first_patched_version: null
- 38.59.2
vulnerabilities: do not force exact patch version for NuGet datasource
- 38.0.0
config: sanitize special characters from branch names for vulnerability type PRs. This may cause Renovate to autoclose/replace existing PRs
- 38.0.0
npm: for npm versions lower than 7, drop support for remediating vulnerabilities in transitive dependencies
Release by release
- fixed
exec: don't extend env
- fixed
42.96.1 – 42.96.22 releases, nothing new or fixed in the notes
- new
deps: update ghcr.io/renovatebot/base-image docker tag to v12.32.0 (maint/42.x)
- new
42.95.11nothing new or fixed in the note
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.17 (maint/42.x)
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.16 (maint/42.x)
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.15 (maint/42.x)
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.14 (maint/42.x)
- fixed
43 other lines we could not sort, mostly version bumps
- 42.92.2
Use GitHub Actions annotations to log released version
- 42.92.0
Never cancel in-progress release jobs
- 42.91.0
Adjust coverage thresholds
- 42.34.2
mend-slack: run on new Discussions
- 42.34.0
mend-slack: remove extra parenthesis
- 42.26.10
re-enable strict docs builds
- 42.19.1
release: use context instead of environment variables for URL building
- 42.18.0
Cancel stale merge queue workflows
- 42.17.0
release: refactor release failure notifications
- 42.14.3
release: notify to Slack on release pipeline failures
3632 internal lines (docs, tests, tooling) left out.