Packages

renovate

44.221.4 · 6 Nov 2026AGPL-3.0-only562.9k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate From 39.264.1 to 44.221.4

2,605 releases in betweenevery note read

Other targets from 39.264.1Clears its 6 advisories42.68.5
  1. 39.264.1yours
  2. 40.0.0major
  3. 255 releases
  4. 41.0.0major
  5. 322 releases
  6. 41.107.0security
  7. 247 releases
  8. 42.0.0major
  9. 119 releases
  10. 42.34.1security
  11. 244 releases
  12. 43.0.0security
  13. 58 releases
  14. 43.11.1security
  15. 68 releases
  16. 43.34.0security
  17. 11 releases
  18. 43.40.0security
  19. 20 releases
  20. 43.46.7security
  21. 190 releases
  22. 43.109.4security
  23. 43.109.5security
  24. 3 releases
  25. 43.110.3security
  26. 6 releases
  27. 43.110.10security
  28. 25 releases
  29. 43.120.0security
  30. 1 release
  31. 43.120.2security
  32. 20 releases
  33. 43.128.0security
  34. 12 releases
  35. 43.134.1security
  36. 66 releases
  37. 43.209.3security
  38. 250 releases
  39. 44.0.0major
  40. 73 releases
  41. 44.22.0security
  42. 47 releases
  43. 44.38.0security
  44. 211 releases
  45. 44.107.1security
  46. 90 releases
  47. 44.134.3security
  48. 110 releases
  49. 44.171.8security
  50. 62 releases
  51. 44.188.3security
  52. 1 release
  53. 44.189.0security
  54. 7 releases
  55. 44.193.0security
  56. 3 releases
  57. 44.195.1security
  58. 12 releases
  59. 44.200.1security
  60. 8 releases
  61. 44.205.1security
  62. 7 releases
  63. 44.209.0security
  64. 24 releases
  65. 44.221.4target
58
changes to make
6
advisories fixed
978
new
1650
fixes

Start here

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2
  • breaking43.278.4
  • breaking43.213.1
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0

Security

Fixes 6 advisories affecting 39.264.1

  • vulnerabilities: store the osv-offline database in cacheDir

    44.209.0

  • vulnerabilities: dispose the OSV databases when finishing

    44.205.1

  • vulnerability: keep the dependency's versioning when building OSV rules (#46868) (9eaae58), closes #43308

    44.200.1

  • vulnerabilities: use default import for ae-cvss-calculator

    44.195.1

  • types: add a type for Vulnerability Alerts' sources (#47504) (6bdc798), closes #44153 #45486 #46378

    44.193.0

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

Release by release

  1. 44.221.4

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.9 (main)

  2. 44.221.3

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.8 (main)

  3. 44.221.2

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.7 (main)

  4. 44.221.1

    5 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.6 (main)

  5. 44.221.0

    5 Nov 20262 new · 1 fix
    • new

      manager/pep621: surface uv.lock transitive deps for security updates (#47482) (11a4409), closes #47505

    • new

      manager: add julia manager

    • fixed

      workers: keep group branches unchanged after failed lookups

  6. 44.220.0

    5 Nov 20261 new · 3 fixes
    • new

      config: add useBaseBranchConfig=merge-if-present when missing config on base branches

    • fixed

      dashboard: name the dependency and file in repository problems

    • fixed

      datasource/maven: fail only the dependency on temporary Maven Central errors

    • fixed

      deps: update renovate-base-image to v13.160.5 (main)

  7. 44.219.0

    5 Nov 20261 new
    • new

      Support Node.js 26

  8. 44.218.0

    5 Nov 20262 new · 2 fixes
    • new

      manager/mise: use tool versions as constraints for other managers

    • new

      manager/rust-toolchain: share the pinned Rust version with cargo

    • fixed

      pr: link to "how to add a GitHub.com token for changelogs"

    • fixed

      workers/repository: report parse errors in base branch config file

86 other lines we could not sort, mostly version bumps

  • Test the secondary Node version on Linux

    44.219.0

  • setup-docker: free disk space when less than 40 GB are available

    44.214.0

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

  • undesirable-code: print added lines on failure

    44.112.2

3912 internal lines (docs, tests, tooling) left out.