Packages

renovate

44.206.2 · 2 Nov 2026AGPL-3.0-only559.5k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate from 39.264.1 to 44.206.2

2,576 releases in betweenevery note read

Other targets from 39.264.1Clears its 6 advisories42.68.5
58
changes to make
6
advisories fixed
950
new
1620
fixes

Start here

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2
  • breaking43.278.4
  • breaking43.213.1
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0

Security

Fixes 6 advisories affecting 39.264.1

  • vulnerabilities: dispose the OSV databases when finishing

    44.205.1

  • vulnerability: keep the dependency's versioning when building OSV rules (#46868) (9eaae58), closes #43308

    44.200.1

  • vulnerabilities: use default import for ae-cvss-calculator

    44.195.1

  • types: add a type for Vulnerability Alerts' sources (#47504) (6bdc798), closes #44153 #45486 #46378

    44.193.0

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

  • vulnerabilities: scope Go stdlib OSV remediation to the toolchain directive

    44.38.0

Release by release

  1. 44.206.1 – 44.206.22 releases, nothing new or fixed in the notes

  2. 44.206.0

    2 Nov 20261 new
    • new

      deps: update renovate-base-image to v13.154.0 (main)

  3. 44.205.2

    2 Nov 20261 fix
    • fixed

      util/exec: reinstall child tools when the parent tool version changes

  4. 44.205.1nothing new or fixed in the note

  5. 44.205.0

    2 Nov 20262 new
    • new

      manager/github-actions: extract the flux-mirror setup action version

    • new

      preset: @primer group preset

  6. 44.204.0

    2 Nov 20261 new
    • new

      datasource/go: derive Go env from host rules

  7. 44.203.0

    2 Nov 20261 new
    • new

      presets: add rumdl to packages:linters

  8. 44.202.1nothing new or fixed in the note

84 other lines we could not sort, mostly version bumps

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

  • undesirable-code: print added lines on failure

    44.112.2

  • Ratchet the branch coverage threshold to 99.51

    44.93.6

  • Ratchet the branch coverage threshold

    44.91.0

3874 internal lines (docs, tests, tooling) left out.