Packages

renovate

44.221.4 · 6 Nov 2026AGPL-3.0-only562.9k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate From 41.173.1 to 44.221.4

1,778 releases in betweenevery note read

Other targets from 41.173.1Clears its advisory42.68.5
  1. 41.173.1yours
  2. 42.0.0major
  3. 119 releases
  4. 42.34.1security
  5. 244 releases
  6. 43.0.0security
  7. 58 releases
  8. 43.11.1security
  9. 68 releases
  10. 43.34.0security
  11. 11 releases
  12. 43.40.0security
  13. 20 releases
  14. 43.46.7security
  15. 190 releases
  16. 43.109.4security
  17. 43.109.5security
  18. 3 releases
  19. 43.110.3security
  20. 6 releases
  21. 43.110.10security
  22. 25 releases
  23. 43.120.0security
  24. 1 release
  25. 43.120.2security
  26. 20 releases
  27. 43.128.0security
  28. 12 releases
  29. 43.134.1security
  30. 66 releases
  31. 43.209.3security
  32. 250 releases
  33. 44.0.0major
  34. 73 releases
  35. 44.22.0security
  36. 47 releases
  37. 44.38.0security
  38. 211 releases
  39. 44.107.1security
  40. 90 releases
  41. 44.134.3security
  42. 110 releases
  43. 44.171.8security
  44. 62 releases
  45. 44.188.3security
  46. 1 release
  47. 44.189.0security
  48. 7 releases
  49. 44.193.0security
  50. 3 releases
  51. 44.195.1security
  52. 12 releases
  53. 44.200.1security
  54. 8 releases
  55. 44.205.1security
  56. 7 releases
  57. 44.209.0security
  58. 24 releases
  59. 44.221.4target
45
changes to make
1
advisory fixed
697
new
1209
fixes

Start here

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2
  • breaking43.278.4
  • breaking43.213.1
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0

Security

Fixes 1 advisory affecting 41.173.1

  • vulnerabilities: store the osv-offline database in cacheDir

    44.209.0

  • vulnerabilities: dispose the OSV databases when finishing

    44.205.1

  • vulnerability: keep the dependency's versioning when building OSV rules (#46868) (9eaae58), closes #43308

    44.200.1

  • vulnerabilities: use default import for ae-cvss-calculator

    44.195.1

  • types: add a type for Vulnerability Alerts' sources (#47504) (6bdc798), closes #44153 #45486 #46378

    44.193.0

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

Release by release

  1. 44.221.4

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.9 (main)

  2. 44.221.3

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.8 (main)

  3. 44.221.2

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.7 (main)

  4. 44.221.1

    5 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.6 (main)

  5. 44.221.0

    5 Nov 20262 new · 1 fix
    • new

      manager/pep621: surface uv.lock transitive deps for security updates (#47482) (11a4409), closes #47505

    • new

      manager: add julia manager

    • fixed

      workers: keep group branches unchanged after failed lookups

  6. 44.220.0

    5 Nov 20261 new · 3 fixes
    • new

      config: add useBaseBranchConfig=merge-if-present when missing config on base branches

    • fixed

      dashboard: name the dependency and file in repository problems

    • fixed

      datasource/maven: fail only the dependency on temporary Maven Central errors

    • fixed

      deps: update renovate-base-image to v13.160.5 (main)

  7. 44.219.0

    5 Nov 20261 new
    • new

      Support Node.js 26

  8. 44.218.0

    5 Nov 20262 new · 2 fixes
    • new

      manager/mise: use tool versions as constraints for other managers

    • new

      manager/rust-toolchain: share the pinned Rust version with cargo

    • fixed

      pr: link to "how to add a GitHub.com token for changelogs"

    • fixed

      workers/repository: report parse errors in base branch config file

73 other lines we could not sort, mostly version bumps

  • Test the secondary Node version on Linux

    44.219.0

  • setup-docker: free disk space when less than 40 GB are available

    44.214.0

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

  • undesirable-code: print added lines on failure

    44.112.2

2690 internal lines (docs, tests, tooling) left out.