renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 37.440.7 to 38.0.0
1 release in betweenevery note read
- 29
- changes to make
- 0
- advisories fixed
- 14
- new
- 3
- fixes
Before you upgrade
Tick each one off as you go- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
- breaking38.0.0
Security
4 advisories still affect 38.0.0
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
- 38.0.0
config: sanitize special characters from branch names for vulnerability type PRs. This may cause Renovate to autoclose/replace existing PRs
- 38.0.0
npm: for npm versions lower than 7, drop support for remediating vulnerabilities in transitive dependencies
- 38.0.0
This is because security vulnerabilities in Node.js can affect Renovate too.
- 38.0.0
config: Use
depNameSanitizedin branch name for vulnerability alerts - 38.0.0
vulnerability-alerts: move to REST API
Release by release
- new
config: * pattern matches everything
- new
- new
- new
deps: update ghcr.io/renovatebot/base-image docker tag to v7
- new
2 other lines we could not sort, mostly version bumps
- 38.0.0
"matchPackageNames": "/^com.renovatebot/"(regex) - 38.0.0
"matchPackageNames": "@renovate/*"(glob)
10 internal lines (docs, tests, tooling) left out.