renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 39.264.1 to 40.0.0
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 6
- changes to make
- 0
- advisories fixed
- 4
- new
- 0
- fixes
Before you upgrade
Tick each one off as you go- breaking40.0.0
- breaking40.0.0
- breaking40.0.0
- breaking40.0.0
- breaking40.0.0
- breaking40.0.0
Security
6 advisories still affect 40.0.0
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repositorymoderate · GHSA-xv56-3wq5-9997
Upgrading to 42.68.5 clears them.
Release by release
- new
autodiscoverFilter: support combined negative matches
- new
config: create new Config Warning issues each time
- new
config: validate allowedCommands against post-compiled commands
- new
datasource/maven: use latest and release values as tags
- new
2 internal lines (docs, tests, tooling) left out.