renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 37.370.0 to 37.440.7
225 releases in betweenevery note read
- 1
- change to make
- 0
- advisories fixed
- 84
- new
- 130
- fixes
Before you upgrade
Tick each one off as you go- deprecated37.391.0
Security
4 advisories still affect 37.440.7
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
- 37.422.1
Log release filtering caused by vulnerability alert
- 37.409.1
vulnerabilities: do not force exact patch version in GitHub alerts
- 37.408.3
vulnerabilities: strip equals for nuget in Github alerts
- 37.408.2
vulnerabilities: do not force exact patch version in OSV alerts
- 37.401.5
vulnerabilities: do not force exact patch version for PyPI datasource in GitHub alerts
Release by release
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v2.28.1
- fixed
37.440.4 – 37.440.63 releases, nothing new or fixed in the notes
- fixed
bitbucket-server: replace multiline html comments
- fixed
37.440.1 – 37.440.22 releases, nothing new or fixed in the notes
- new
deps: update ghcr.io/renovatebot/base-image docker tag to v2.28.0
- new
- new
http: Force default rate limits for some known hosts
- fixed
deps: update ghcr.io/containerbase/sidecar docker tag to v10.16.0
- new
- fixed
bitbucket-server: Clarify error when both BB password and access token are set
- fixed
nuget: always coalesce sourceUrl and homepage if homepage available
- fixed
37.438.3 – 37.438.42 releases, nothing new or fixed in the notes
2 other lines we could not sort, mostly version bumps
- 37.421.6
Use node v20 for most jobs
- 37.377.0
Extend timeout for docker builds
299 internal lines (docs, tests, tooling) left out.