renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 39.248.4 to 42.68.5
1,095 releases in betweennotes for 1,094
Reading releases, release notes and advisories…
Counted from 1094 of 1095 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking42.67.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
- breaking42.0.0
Security
1 advisory still affects 42.68.5
- Child processes spawned by Renovate incorrectly have full access to environment variablesmoderate · GHSA-8wc6-vgrq-x6cf
Upgrading to 42.96.3 clears it.
Fixes 6 advisories affecting 39.248.4
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repositorymoderate · GHSA-xv56-3wq5-9997
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
- Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml filemoderate · GHSA-xjr7-3c3g-m763
- 42.34.1
dashboard: formatting for vulnerabilities section
- 41.107.0
vulnerabilities: add support for CVSS 4.0 in OSV alerts
Release by release
- fixed
postUpgradeTasks: always run commands with
shellmode - fixed
util/exec: don't use
shellby default
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.9 (main)
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.8 (main)
- fixed
- fixed
deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.19 (main)
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.7 (main)
- fixed
- fixed
util/exec: migrate to
execafor command execution
- fixed
- new
Add
exactversioning
- new
- new
typst: Update datasource to use official registry API
- new
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.6 (main)
- fixed
28 other lines we could not sort, mostly version bumps
- 42.34.2
mend-slack: run on new Discussions
- 42.34.0
mend-slack: remove extra parenthesis
- 42.26.10
re-enable strict docs builds
- 42.19.1
release: use context instead of environment variables for URL building
- 42.18.0
Cancel stale merge queue workflows
- 42.17.0
release: refactor release failure notifications
- 42.14.3
release: notify to Slack on release pipeline failures
- 42.14.2
close-answered-discussions: log
pageNumber - 42.14.2
close-answered-discussions: reduce risk of secondary rate limits
- 42.14.2
lock-threads: correctly set inactive days for discussions
1637 internal lines (docs, tests, tooling) left out.