Packages

renovate

44.221.4 · 6 Nov 2026AGPL-3.0-only562.9k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate From 40.62.1 to 44.221.4

2,349 releases in betweenevery note read

Other targets from 40.62.1Clears its advisory42.68.5
  1. 40.62.1yours
  2. 41.0.0major
  3. 322 releases
  4. 41.107.0security
  5. 247 releases
  6. 42.0.0major
  7. 119 releases
  8. 42.34.1security
  9. 244 releases
  10. 43.0.0security
  11. 58 releases
  12. 43.11.1security
  13. 68 releases
  14. 43.34.0security
  15. 11 releases
  16. 43.40.0security
  17. 20 releases
  18. 43.46.7security
  19. 190 releases
  20. 43.109.4security
  21. 43.109.5security
  22. 3 releases
  23. 43.110.3security
  24. 6 releases
  25. 43.110.10security
  26. 25 releases
  27. 43.120.0security
  28. 1 release
  29. 43.120.2security
  30. 20 releases
  31. 43.128.0security
  32. 12 releases
  33. 43.134.1security
  34. 66 releases
  35. 43.209.3security
  36. 250 releases
  37. 44.0.0major
  38. 73 releases
  39. 44.22.0security
  40. 47 releases
  41. 44.38.0security
  42. 211 releases
  43. 44.107.1security
  44. 90 releases
  45. 44.134.3security
  46. 110 releases
  47. 44.171.8security
  48. 62 releases
  49. 44.188.3security
  50. 1 release
  51. 44.189.0security
  52. 7 releases
  53. 44.193.0security
  54. 3 releases
  55. 44.195.1security
  56. 12 releases
  57. 44.200.1security
  58. 8 releases
  59. 44.205.1security
  60. 7 releases
  61. 44.209.0security
  62. 24 releases
  63. 44.221.4target
51
changes to make
1
advisory fixed
904
new
1534
fixes

Start here

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2
  • breaking43.278.4
  • breaking43.213.1
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0

Security

Fixes 1 advisory affecting 40.62.1

  • vulnerabilities: store the osv-offline database in cacheDir

    44.209.0

  • vulnerabilities: dispose the OSV databases when finishing

    44.205.1

  • vulnerability: keep the dependency's versioning when building OSV rules (#46868) (9eaae58), closes #43308

    44.200.1

  • vulnerabilities: use default import for ae-cvss-calculator

    44.195.1

  • types: add a type for Vulnerability Alerts' sources (#47504) (6bdc798), closes #44153 #45486 #46378

    44.193.0

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

Release by release

  1. 44.221.4

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.9 (main)

  2. 44.221.3

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.8 (main)

  3. 44.221.2

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.7 (main)

  4. 44.221.1

    5 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.6 (main)

  5. 44.221.0

    5 Nov 20262 new · 1 fix
    • new

      manager/pep621: surface uv.lock transitive deps for security updates (#47482) (11a4409), closes #47505

    • new

      manager: add julia manager

    • fixed

      workers: keep group branches unchanged after failed lookups

  6. 44.220.0

    5 Nov 20261 new · 3 fixes
    • new

      config: add useBaseBranchConfig=merge-if-present when missing config on base branches

    • fixed

      dashboard: name the dependency and file in repository problems

    • fixed

      datasource/maven: fail only the dependency on temporary Maven Central errors

    • fixed

      deps: update renovate-base-image to v13.160.5 (main)

  7. 44.219.0

    5 Nov 20261 new
    • new

      Support Node.js 26

  8. 44.218.0

    5 Nov 20262 new · 2 fixes
    • new

      manager/mise: use tool versions as constraints for other managers

    • new

      manager/rust-toolchain: share the pinned Rust version with cargo

    • fixed

      pr: link to "how to add a GitHub.com token for changelogs"

    • fixed

      workers/repository: report parse errors in base branch config file

83 other lines we could not sort, mostly version bumps

  • Test the secondary Node version on Linux

    44.219.0

  • setup-docker: free disk space when less than 40 GB are available

    44.214.0

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

  • undesirable-code: print added lines on failure

    44.112.2

3567 internal lines (docs, tests, tooling) left out.