Packages

renovate

44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate from 42.99.0 to 43.4.4

33 releases in betweenevery note read

Reading releases, release notes and advisories…

Other targets from 42.99.0Latest44.190.0
23
changes to make
0
advisories fixed
6
new
22
fixes

Start here

Before you upgrade

Tick each one off as you go

Security

  • As noted in #40403 and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.

    43.0.0

  • The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover postUpgradeTasks, which are allowlisted by a self-hosted administrator.

    43.0.0

Release by release

  1. 43.4.4

    9 Feb 20261 fix
    • fixed

      exec: don't extend env

  2. 43.4.3

    8 Feb 20261 fix
    • fixed

      bitbucket-server: when adding reviewers use name instead of slug

  3. 43.4.1 – 43.4.22 releases, nothing new or fixed in the notes

  4. 43.4.0

    5 Feb 20261 new
    • new

      deps: update ghcr.io/renovatebot/base-image docker tag to v13.2.0 (main)

  5. 43.3.6nothing new or fixed in the note

  6. 43.3.5

    5 Feb 20261 fix
    • fixed

      deps: update ghcr.io/renovatebot/base-image docker tag to v13.1.18 (main)

  7. 43.3.4nothing new or fixed in the note

  8. 43.3.3

    5 Feb 20261 fix
    • fixed

      deps: update ghcr.io/renovatebot/base-image docker tag to v13.1.17 (main)

72 internal lines (docs, tests, tooling) left out.