renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 40.32.6 to 40.62.1
127 releases in betweenevery note read
Reading releases, release notes and advisories…
Before you upgrade
Tick each one off as you go- deprecated40.61.3
Security
1 advisory still affects 40.62.1
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
Upgrading to 42.68.5 clears it.
Fixes 5 advisories affecting 40.32.6
- Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesmoderate · GHSA-36j9-mx87-2cff
- Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml filemoderate · GHSA-3f44-xw83-3pmg
- Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repositorymoderate · GHSA-xv56-3wq5-9997
- Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationmoderate · GHSA-fr4j-65pv-gjjj
- Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml filemoderate · GHSA-xjr7-3c3g-m763
Release by release
40.62.1nothing new or fixed in the note
- new
changelog-urls: add urls for scalar packages
- new
- fixed
changelogs: support bitbucket-server URLs in subfolder installations
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v9.72.9 (main)
- fixed
gitea: automerge of repos with only fast forward only merge
- fixed
40.61.1 – 40.61.33 releases, nothing new or fixed in the notes
- new
nuget: add deprecation message for NuGet packages
- fixed
npm: set
hasPackageManager:trueifdevEnginesdetected
- new
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v9.72.8 (main)
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v9.72.7 (main)
- fixed
40.60.1 – 40.60.33 releases, nothing new or fixed in the notes
2 other lines we could not sort, mostly version bumps
- 40.49.6
Use pnpm for e2e
- 40.49.1
Skip docker build for PRs
174 internal lines (docs, tests, tooling) left out.