renovate
44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed
Upgrading renovate from 42.8.0 to 42.68.5
195 releases in betweenevery note read
Reading releases, release notes and advisories…
Before you upgrade
Tick each one off as you go- breaking42.67.0
- deprecated42.30.0
- deprecated42.30.0
Security
1 advisory still affects 42.68.5
- Child processes spawned by Renovate incorrectly have full access to environment variablesmoderate · GHSA-8wc6-vgrq-x6cf
Upgrading to 42.96.3 clears it.
Fixes 1 advisory affecting 42.8.0
- Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`moderate · GHSA-pfq2-hh62-7m96
- 42.34.1
dashboard: formatting for vulnerabilities section
Release by release
- fixed
postUpgradeTasks: always run commands with
shellmode - fixed
util/exec: don't use
shellby default
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.9 (main)
- fixed
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.8 (main)
- fixed
- fixed
deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.19 (main)
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.7 (main)
- fixed
- fixed
util/exec: migrate to
execafor command execution
- fixed
- new
Add
exactversioning
- new
- new
typst: Update datasource to use official registry API
- new
- fixed
deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.6 (main)
- fixed
15 other lines we could not sort, mostly version bumps
- 42.34.2
mend-slack: run on new Discussions
- 42.34.0
mend-slack: remove extra parenthesis
- 42.26.10
re-enable strict docs builds
- 42.19.1
release: use context instead of environment variables for URL building
- 42.18.0
Cancel stale merge queue workflows
- 42.17.0
release: refactor release failure notifications
- 42.14.3
release: notify to Slack on release pipeline failures
- 42.14.2
close-answered-discussions: log
pageNumber - 42.14.2
close-answered-discussions: reduce risk of secondary rate limits
- 42.14.2
lock-threads: correctly set inactive days for discussions
308 internal lines (docs, tests, tooling) left out.