Upgrading renovate from 42.99.0 to 43.0.0

Start here

Tick each one off as you go

Is controlled by the anyone with write access to the repository being processed
breaking43.0.0
Can look for specific tasks to execute specific code
breaking43.0.0
Can execute code from source-tracked scripts
breaking43.0.0
Can execute code from third-party libraries
breaking43.0.0
docs.renovatebot.com/renovate-schema.json (repository configuration)
breaking43.0.0
docs.renovatebot.com/renovate-global-schema.json (global self-hosted configuration)
breaking43.0.0
docs.renovatebot.com/renovate-inherited-schema.… (repository configuration, including inherited config options)
breaking43.0.0
deps: Update ghcr.io/renovatebot/base-image Docker tag to v13 (main)
breaking43.0.0
Prevent grouping of lockfile maintenance updates
breaking43.0.0
Switch to ESM modules
breaking43.0.0

1 advisory still affects 43.0.0

As noted in #40403 and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.
43.0.0
The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover postUpgradeTasks, which are allowlisted by a self-hosted administrator.
43.0.0