renovate
44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 38.26.1 to 38.142.7
302 releases in betweenevery note read
- 3
- changes to make
- 0
- advisories fixed
- 133
- new
- 193
- fixes
Before you upgrade
Tick each one off as you go- breaking38.95.1
- deprecated38.124.1
- deprecated38.55.0
Security
4 advisories still affect 38.142.7
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears them.
- 38.96.1
vulnerabilities: correct range syntax for nuget
- 38.95.3
vulnerabilities: set matchCurrentVersion for github alerts
- 38.85.2
vulnerability-alerts: fix handling of first_patched_version: null
- 38.59.2
vulnerabilities: do not force exact patch version for NuGet datasource
Release by release
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v7.41.2
- fixed
- fixed
Better clarity on username/gitAuthor and modified branches
- fixed
- fixed
merge-confidence: change depname to packageName
- fixed
- fixed
data: automatic update of static data
- fixed
- fixed
nix: simplify --extra-experimental-features argument
- fixed
38.142.2nothing new or fixed in the note
- fixed
yaml: parse without strict mode
- fixed
- new
presets: add
poetrymanager support to:semanticPrefixFixDepsChoreOtherspreset
- new
1 other line we could not sort, mostly version bumps
- 38.41.0
prettier: show diff if prettier made changes
471 internal lines (docs, tests, tooling) left out.