renovate

44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepository Homepage npm Atom feed

Same major only

1 release in betweenevery note read

Other targets from 38.142.7Clears its 4 advisories42.68.5 Latest44.198.3

5
changes to make: 0
advisories fixed: 10
new: 0
fixes

Before you upgrade

Tick each one off as you go

branchNameStrict: Branch names with multiple forward slashes will change if branchNameStrict=true
breaking39.0.0
deps: Renovate sidecard images will default to use Ubuntu 24.04 instead of 20.04, and use User ID 12021 instead of 1001
breaking39.0.0
deps: The Renovate full image now uses Ubuntu 24.04, Python 3.13 and Node v22
breaking39.0.0
Dockerfile: Renovate -full images will now use binarySource=global. Set RENOVATE_BINARY_SOURCE=install to revert to dynamic tool installation.
breaking39.0.0
Renovate Docker images will now be based on Node.js v22 instead of v20
breaking39.0.0

Security

4 advisories still affect 39.0.0

Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96

Upgrading to 42.68.5 clears them.

Release by release

39.0.0
4 Nov 202410 new
- new
  Node.js v22 as base, was Node.js v20
- new
  Ubuntu 24.04 as base, was 20.04
- new
  Delete your old Docker cache, or
- new
  Ensure the new user ID has write permissions to any existing cache

3 internal lines (docs, tests, tooling) left out.

Upgrade to 39.0.0

npm install renovate@39.0.0

What 39.0.0 needs

Reading 39.0.0's manifest…

Check against your package.json

Which of your other dependencies stand in the way of 39.0.0. Read once, not stored.

After upgrading

Run the type checker, the linter and the tests.
Build, and look for new deprecation warnings.
Update peer dependencies the new version asks for.
4 advisories still affect 39.0.0.