Packages

renovate

44.221.4 · 6 Nov 2026AGPL-3.0-only562.9k / weekRepositoryHomepagenpmAtom feed

Upgrading renovate From 43.288.0 to 44.221.4

669 releases in betweenevery note read

  1. 43.288.0yours
  2. 44.0.0major
  3. 73 releases
  4. 44.22.0security
  5. 47 releases
  6. 44.38.0security
  7. 211 releases
  8. 44.107.1security
  9. 90 releases
  10. 44.134.3security
  11. 110 releases
  12. 44.171.8security
  13. 62 releases
  14. 44.188.3security
  15. 1 release
  16. 44.189.0security
  17. 7 releases
  18. 44.193.0security
  19. 3 releases
  20. 44.195.1security
  21. 12 releases
  22. 44.200.1security
  23. 8 releases
  24. 44.205.1security
  25. 7 releases
  26. 44.209.0security
  27. 24 releases
  28. 44.221.4target
3
changes to make
0
advisories fixed
307
new
503
fixes

Before you upgrade

Tick each one off as you go
  • breaking44.115.3
  • breaking44.44.0
  • breaking44.39.2

Security

  • vulnerabilities: store the osv-offline database in cacheDir

    44.209.0

  • vulnerabilities: dispose the OSV databases when finishing

    44.205.1

  • vulnerability: keep the dependency's versioning when building OSV rules (#46868) (9eaae58), closes #43308

    44.200.1

  • vulnerabilities: use default import for ae-cvss-calculator

    44.195.1

  • types: add a type for Vulnerability Alerts' sources (#47504) (6bdc798), closes #44153 #45486 #46378

    44.193.0

  • vulnerabilities: allow performing lockfile only transitive security updates (#46391) (4718945), closes #47478

    44.189.0

  • vulnerabilities: document that lockfile-only deps don't get vulnerability updates (#47478) (24e8b99), closes #46377

    44.188.3

  • vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts

    44.171.8

  • vulnerabilities: raise fixes for deps their manager disables by default

    44.134.3

  • workers/repository/extract: pass vulnerability alert state to managers

    44.107.1

Release by release

  1. 44.221.4

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.9 (main)

  2. 44.221.3

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.8 (main)

  3. 44.221.2

    6 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.7 (main)

  4. 44.221.1

    5 Nov 20261 fix
    • fixed

      deps: update renovate-base-image to v13.160.6 (main)

  5. 44.221.0

    5 Nov 20262 new · 1 fix
    • new

      manager/pep621: surface uv.lock transitive deps for security updates (#47482) (11a4409), closes #47505

    • new

      manager: add julia manager

    • fixed

      workers: keep group branches unchanged after failed lookups

  6. 44.220.0

    5 Nov 20261 new · 3 fixes
    • new

      config: add useBaseBranchConfig=merge-if-present when missing config on base branches

    • fixed

      dashboard: name the dependency and file in repository problems

    • fixed

      datasource/maven: fail only the dependency on temporary Maven Central errors

    • fixed

      deps: update renovate-base-image to v13.160.5 (main)

  7. 44.219.0

    5 Nov 20261 new
    • new

      Support Node.js 26

  8. 44.218.0

    5 Nov 20262 new · 2 fixes
    • new

      manager/mise: use tool versions as constraints for other managers

    • new

      manager/rust-toolchain: share the pinned Rust version with cargo

    • fixed

      pr: link to "how to add a GitHub.com token for changelogs"

    • fixed

      workers/repository: report parse errors in base branch config file

29 other lines we could not sort, mostly version bumps

  • Test the secondary Node version on Linux

    44.219.0

  • setup-docker: free disk space when less than 40 GB are available

    44.214.0

  • actions/setup-docker: remove useless use of cat

    44.189.0

  • actions/setup-node: ignore SC2016 findings

    44.189.0

  • static-data: start on a new branch

    44.183.0

  • update-data: create PRs with the commit's title and body

    44.183.0

  • Fail tests that read the repository config.js

    44.167.7

  • Label pr size for forks via workflow_run

    44.128.2

  • Use github.token for the workflow token everywhere

    44.125.0

  • undesirable-code: print added lines on failure

    44.112.2

894 internal lines (docs, tests, tooling) left out.