Packages

renovate

44.221.4 · 6 Nov 2026AGPL-3.0-only562.9k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate From 42.99.0 to 44.221.4

1,413 releases in betweenevery note read

  1. 42.99.0yours
  2. 43.0.0security
  3. 58 releases
  4. 43.11.1security
  5. 68 releases
  6. 43.34.0security
  7. 11 releases
  8. 43.40.0security
  9. 20 releases
  10. 43.46.7security
  11. 190 releases
  12. 43.109.4security
  13. 43.109.5security
  14. 3 releases
  15. 43.110.3security
  16. 6 releases
  17. 43.110.10security
  18. 25 releases
  19. 43.120.0security
  20. 1 release
  21. 43.120.2security
  22. 20 releases
  23. 43.128.0security
  24. 12 releases
  25. 43.134.1security
  26. 66 releases
  27. 43.209.3security
  28. 250 releases
  29. 44.0.0major
  30. 73 releases
  31. 44.22.0security
  32. 47 releases
  33. 44.38.0security
  34. 211 releases
  35. 44.107.1security
  36. 90 releases
  37. 44.134.3security
  38. 110 releases
  39. 44.171.8security
  40. 62 releases
  41. 44.188.3security
  42. 1 release
  43. 44.189.0security
  44. 7 releases
  45. 44.193.0security
  46. 3 releases
  47. 44.195.1security
  48. 12 releases
  49. 44.200.1security
  50. 8 releases
  51. 44.205.1security
  52. 7 releases
  53. 44.209.0security
  54. 24 releases
  55. 44.221.4target
29
changes to make
0
advisories fixed
576
new
962
fixes

Start here

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2
  • breaking43.278.4
  • breaking43.213.1
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0
  • breaking43.0.0

Security

  • vulnerabilities: store the osv-offline database in cacheDir

    44.209.0

  • vulnerabilities: dispose the OSV databases when finishing

    44.205.1

  • vulnerability: keep the dependency's versioning when building OSV rules (#46868) (9eaae58), closes #43308

    44.200.1

  • vulnerabilities: use default import for ae-cvss-calculator

    44.195.1

  • types: add a type for Vulnerability Alerts' sources (#47504) (6bdc798), closes #44153 #45486 #46378

    44.193.0

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

Release by release

  1. 44.221.4

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.9 (main)

  2. 44.221.3

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.8 (main)

  3. 44.221.2

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.7 (main)

  4. 44.221.1

    5 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.6 (main)

  5. 44.221.0

    5 Nov 20262 new · 1 fix
    • new

      manager/pep621: surface uv.lock transitive deps for security updates (#47482) (11a4409), closes #47505

    • new

      manager: add julia manager

    • fixed

      workers: keep group branches unchanged after failed lookups

  6. 44.220.0

    5 Nov 20261 new · 3 fixes
    • new

      config: add useBaseBranchConfig=merge-if-present when missing config on base branches

    • fixed

      dashboard: name the dependency and file in repository problems

    • fixed

      datasource/maven: fail only the dependency on temporary Maven Central errors

    • fixed

      deps: update renovate-base-image to v13.160.5 (main)

  7. 44.219.0

    5 Nov 20261 new
    • new

      Support Node.js 26

  8. 44.218.0

    5 Nov 20262 new · 2 fixes
    • new

      manager/mise: use tool versions as constraints for other managers

    • new

      manager/rust-toolchain: share the pinned Rust version with cargo

    • fixed

      pr: link to "how to add a GitHub.com token for changelogs"

    • fixed

      workers/repository: report parse errors in base branch config file

55 other lines we could not sort, mostly version bumps

  • Test the secondary Node version on Linux

    44.219.0

  • setup-docker: free disk space when less than 40 GB are available

    44.214.0

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

  • undesirable-code: print added lines on failure

    44.112.2

2115 internal lines (docs, tests, tooling) left out.