Packages

renovate

44.190.0 · 27 Oct 2026AGPL-3.0-only382.7k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate from 43.261.1 to 44.190.0

701 releases in betweenevery note read

Other targets from 43.261.1Newest 43.x43.288.0
4
changes to make
0
advisories fixed
292
new
551
fixes

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2
  • breaking43.278.4

Security

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

  • vulnerabilities: scope Go stdlib OSV remediation to the toolchain directive

    44.38.0

  • vulnerabilities: match OSV Packagist sub-ecosystems

    44.22.0

Release by release

  1. 44.190.0

    27 Oct 20261 new
    • new

      static-data: update Node.js release schedule

  2. 44.189.0nothing new or fixed in the note

  3. 44.188.4

    27 Oct 20261 fix
    • fixed

      deps: update renovate-base-image to v13.145.2 (main)

  4. 44.188.1 – 44.188.33 releases, nothing new or fixed in the notes

  5. 44.188.0

    27 Oct 20261 new
    • new

      deps: update renovate-base-image to v13.145.1 (main)

  6. 44.187.0

    27 Oct 20261 new
    • new

      deps: update renovate-base-image to v13.144.0 (main)

  7. 44.186.8

    27 Oct 20261 fix
    • fixed

      config: allow prerelease for bumpVersions.bumpType

  8. 44.186.7

    27 Oct 20261 fix
    • fixed

      deps: update renovate-base-image to v13.143.3 (main)

33 other lines we could not sort, mostly version bumps

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • tools/static-data: commit each static data update separately (#47408) (f514563), closes #47251

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • update-data: raise a stack of PRs via gh stack (#47409) (1860261), closes #47251

    44.183.0

  • update-data: run on Monday mornings (#47406) (3505937), closes #47251

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

958 internal lines (docs, tests, tooling) left out.