Packages

renovate

44.198.3 · 30 Oct 2026AGPL-3.0-only559.3k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate from 40.28.0 to 44.198.3

2,443 releases in betweenevery note read

Other targets from 40.28.0Newest 40.x40.62.1Clears its 6 advisories42.68.5
52
changes to make
6
advisories fixed
904
new
1552
fixes

Start here

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2
  • breaking43.278.4
  • breaking43.213.1
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0

Security

Fixes 6 advisories affecting 40.28.0

  • vulnerabilities: use default import for ae-cvss-calculator

    44.195.1

  • types: add a type for Vulnerability Alerts' sources (#47504) (6bdc798), closes #44153 #45486 #46378

    44.193.0

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

  • vulnerabilities: scope Go stdlib OSV remediation to the toolchain directive

    44.38.0

  • vulnerabilities: match OSV Packagist sub-ecosystems

    44.22.0

  • workers/repository: correctly render schedule for vulnerability alerts

    43.209.3

Release by release

  1. 44.198.3

    30 Oct 20261 fix
    • fixed

      workers: share the config file commit between onboarding and config migration

  2. 44.198.2

    30 Oct 20261 fix
    • fixed

      platform/azure: refresh the auto-complete merge message on title changes

  3. 44.198.1

    30 Oct 20261 fix
    • fixed

      datasource/go: treat modules with go-proxy host rule credentials as private

  4. 44.198.0

    29 Oct 20261 new
    • new

      deps: update renovate-base-image to v13.149.0 (main)

  5. 44.197.1nothing new or fixed in the note

  6. 44.197.0

    29 Oct 20261 new
    • new

      report: surface additional repository metadata in report

  7. 44.196.1nothing new or fixed in the note

  8. 44.196.0

    29 Oct 20264 new · 1 fix
    • new

      presets/monorepos: add logtape

    • new

      presets/replacements: add replacement for de.monochromata.cucumber:reporting-plugin

    • new

      presets: add SimpleWebAuthn monorepo group

    • new

      presets/monorepo: add prisma/orm and prisma/prisma-cli to prisma

    • fixed

      manager/cargo: detect an unchanged lock file

83 other lines we could not sort, mostly version bumps

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

  • undesirable-code: print added lines on failure

    44.112.2

  • Ratchet the branch coverage threshold to 99.51

    44.93.6

  • Ratchet the branch coverage threshold

    44.91.0

3697 internal lines (docs, tests, tooling) left out.