Allowlisting required for "unsafe commands" #40684
[!NOTE]
This should only affect you if you work with repositories that have a Gradle Wrapper.
Prior to Renovate 43, when performing updates in a repository that used Gradle, Renovate would execute the Gradle Wrapper (./gradlew or gradlew.bat).
This is a well-documented "insider attack" risk that could lead to remote code execution in the context of the Renovate process, as execution of the Gradle buildscript:
is controlled by the anyone with write access to the repository being processed
can look for specific tasks to execute specific code
As of Renovate 43, this long-standing risk is disabled by default to make Renovate more "secure by default".
Self-hosted administrators can re-enable this using the global self-hosted configuration allowedUnsafeExecutions.
postUpgradeTasks will no longer run with shell mode by default #40230
As noted in #40403 and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.
The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover postUpgradeTasks, which are allowlisted by a self-hosted administrator.
To provide a safer default, commands that run through postUpgradeTasks will no longer run inside a shell.
binarySource=docker is officially deprecated #40735
As noted in #40747, we have now officially deprecated the binarySource=docker option.
There is no timeline decided on the removal of the functionality.
For more details and/or to provide feedback on your use case and why binarySource=install does not work for you, please see #40747.
Renovate now ships as ESM (ECMAScript Modules) #9890 / #40756
This should not affect users, only cases where Renovate is imported as a library. Given our previous support of Node 22, ESM can still be imported from Common JS (CJS) files.
Out of caution and for visibility, this is part of the major release.
config:best-practices will now perform weekly lockfile maintenance #40735
As part of the Renovate maintainers' opinionated "best practices" configuration, Renovate will now perform a weekly lockfile maintenance task, keeping your lockfiles updated.
This is due to an increase in package managers using lock files, but users not necessarily being aware of the need to enable this explicitly.
If this is not applicable to you, you can use ignorePresets, i.e.
JSON Schema split for repo or global configuration #38619
Renovate now has separate JSON Schemas for repository configuration, repository configuration (and inherit config) for writing org-inherited-config.json, and global self-hosted configuration:
Replacements cannot be grouped with other updates #40758
To prevent replacements being grouped in with other updates, which can sometimes lead to them failing to correctly replace a package, they will no longer be grouped.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
Lock file maintenance cannot be grouped with other updates #40781
To prevent lock file maintenance being grouped in with other updates, which can sometimes lead to them failing to perform the lock file maintenance.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
To improve performance for encryption/decryption of secrets, as well as supporting AEAD, we have moved the default Bouncy Castle build to use wasm-java.
Renovate now requires a minimum of Node 24 #40675
The existing requirements of Node 24.11.0 has not changed.
This only drops support for Node 22.x.
Package name for Node.JS in Mise has changed to node#40466
To be more consistent with other package managers, the Node.JS package has been renamed to node.
This ensures that updates to NodeJS (when using Mise) are grouped with other package updates.
For users of the upstream Renovate container images, the following tools have been updated to new major versions:
Tool
Version
Bundler
4.0.4
Dotnet
10.0.102
Helm
v4.1.0
PHP
8.5.2
Pipenv
2026.0.3
Ruby
4.0.1
Commentary for 43
There aren't any big changes as part of this release to call out - this is a fairly "routine" major version, where we're doing a little cleanup, making some improvements to be "secure by default", and updating our default tool versions.
Deprecations
As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 44:
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [ghcr.io/renovatebot/renovate](https://renovatebot.com) ([source](https://github.com/renovatebot/renovate)) | container | major | `42.99.0` → `43.15.0` |
---
> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
---
### Release Notes
<details>
<summary>renovatebot/renovate (ghcr.io/renovatebot/renovate)</summary>
### [`v43.15.0`](https://github.com/renovatebot/renovate/releases/tag/43.15.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.14.2...43.15.0)
##### Features
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.7.0 (main) ([#​41186](https://github.com/renovatebot/renovate/issues/41186)) ([fec5012](https://github.com/renovatebot/renovate/commit/fec5012cf06dba3a8cd9407aa06dc962682610bc))
### [`v43.14.2`](https://github.com/renovatebot/renovate/releases/tag/43.14.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.14.1...43.14.2)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.6.2 (main) ([#​41184](https://github.com/renovatebot/renovate/issues/41184)) ([6162f32](https://github.com/renovatebot/renovate/commit/6162f3217733fa094db597203213222266c00a42))
##### Miscellaneous Chores
- **deps:** update dependency pnpm to v10.29.1 (main) ([#​41185](https://github.com/renovatebot/renovate/issues/41185)) ([6c8cc20](https://github.com/renovatebot/renovate/commit/6c8cc20a4cac1fa6bcd0e545ac885f850e88daaa))
- **deps:** update dependency vite-tsconfig-paths to v6.1.0 (main) ([#​41182](https://github.com/renovatebot/renovate/issues/41182)) ([6756792](https://github.com/renovatebot/renovate/commit/6756792c4fadf2201f81ba181cb2f8c8d2805a6d))
- **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.1.2 (main) ([#​41183](https://github.com/renovatebot/renovate/issues/41183)) ([ebff5a7](https://github.com/renovatebot/renovate/commit/ebff5a72d3ef59c816fcf21fd9e022c907b70b27))
- enforce `lockFileNames` when `supportsLockFileMaintenance=true` ([#​41175](https://github.com/renovatebot/renovate/issues/41175)) ([91015a7](https://github.com/renovatebot/renovate/commit/91015a7a30d03e5f129e61d813fe864f09fe3b15))
### [`v43.14.1`](https://github.com/renovatebot/renovate/releases/tag/43.14.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.14.0...43.14.1)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.6.1 (main) ([#​41176](https://github.com/renovatebot/renovate/issues/41176)) ([57c074f](https://github.com/renovatebot/renovate/commit/57c074fe7eee95f3907b75f775d1d96bffeeae01))
### [`v43.14.0`](https://github.com/renovatebot/renovate/releases/tag/43.14.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.13.0...43.14.0)
##### Features
- **mise:** add support for github backend ([#​40706](https://github.com/renovatebot/renovate/issues/40706)) ([4b56523](https://github.com/renovatebot/renovate/commit/4b56523d148451dedc6e42f3720a38e1bffee87e))
### [`v43.13.0`](https://github.com/renovatebot/renovate/releases/tag/43.13.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.12.1...43.13.0)
##### Features
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.6.0 (main) ([#​41172](https://github.com/renovatebot/renovate/issues/41172)) ([52f53ab](https://github.com/renovatebot/renovate/commit/52f53aba0003a2dc87e739fb88722ff3773397eb))
- **presets/monorepos:** add k8s.io repos ([#​41171](https://github.com/renovatebot/renovate/issues/41171)) ([03020a2](https://github.com/renovatebot/renovate/commit/03020a29992c91b393295fa29c9cfe283d10c7f4))
##### Miscellaneous Chores
- **deps:** update containerbase/internal-tools action to v4.1.4 (main) ([#​41173](https://github.com/renovatebot/renovate/issues/41173)) ([85203eb](https://github.com/renovatebot/renovate/commit/85203eba0e716c033dcd25dd8a038573bde44051))
### [`v43.12.1`](https://github.com/renovatebot/renovate/releases/tag/43.12.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.12.0...43.12.1)
##### Documentation
- mirror the helm-charts/index.yaml to the built docs site ([#​41160](https://github.com/renovatebot/renovate/issues/41160)) ([16aa695](https://github.com/renovatebot/renovate/commit/16aa695f449b8d43c6bbdeb18c278482350a6a03)), closes [#​39878](https://github.com/renovatebot/renovate/issues/39878)
##### Build System
- **deps:** update dependency markdown-it to v14.1.1 \[security] (main) ([#​41169](https://github.com/renovatebot/renovate/issues/41169)) ([aeab855](https://github.com/renovatebot/renovate/commit/aeab85564c53f87b26d8ab3ba193f2956a08655c))
### [`v43.12.0`](https://github.com/renovatebot/renovate/releases/tag/43.12.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.11.1...43.12.0)
##### Features
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.5.1 (main) ([#​41166](https://github.com/renovatebot/renovate/issues/41166)) ([9a3fdf7](https://github.com/renovatebot/renovate/commit/9a3fdf70a39665f749ea262628758d11475bbfcc))
##### Miscellaneous Chores
- **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.1.1 (main) ([#​41163](https://github.com/renovatebot/renovate/issues/41163)) ([92749a7](https://github.com/renovatebot/renovate/commit/92749a7d0d973498aaf93bc4f108cc63584e7e9c))
### [`v43.11.1`](https://github.com/renovatebot/renovate/releases/tag/43.11.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.11.0...43.11.1)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.4.6 (main) ([#​41154](https://github.com/renovatebot/renovate/issues/41154)) ([26db162](https://github.com/renovatebot/renovate/commit/26db16251495becd099a8dbc27cf466bd192f26f))
##### Miscellaneous Chores
- **deps:** update github/codeql-action action to v4.32.3 (main) ([#​41153](https://github.com/renovatebot/renovate/issues/41153)) ([440e3f3](https://github.com/renovatebot/renovate/commit/440e3f3882124b2e274e81c6f8caf96bc4ec0dcc))
##### Tests
- **util/exec:** add additional test coverage for GHSA-8wc6-vgrq-x6cf ([#​41150](https://github.com/renovatebot/renovate/issues/41150)) ([01d2772](https://github.com/renovatebot/renovate/commit/01d2772b9c769c463654a5331aaba4fece64522a))
### [`v43.11.0`](https://github.com/renovatebot/renovate/releases/tag/43.11.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.10.4...43.11.0)
##### Features
- **presets/tsconfigNodeVersions:** support `jsconfig.json` files ([#​41148](https://github.com/renovatebot/renovate/issues/41148)) ([b826167](https://github.com/renovatebot/renovate/commit/b826167964002fe7375a88a249d222842d0344f0))
### [`v43.10.4`](https://github.com/renovatebot/renovate/releases/tag/43.10.4)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.10.3...43.10.4)
##### Bug Fixes
- **deps:** update qs to v6.14.2 ([#​41146](https://github.com/renovatebot/renovate/issues/41146)) ([aa4b635](https://github.com/renovatebot/renovate/commit/aa4b635ffa3889ea1f25b68eba2c2574ee23f3c8))
##### Miscellaneous Chores
- **deps:** lock file maintenance (main) ([#​41145](https://github.com/renovatebot/renovate/issues/41145)) ([20b5280](https://github.com/renovatebot/renovate/commit/20b5280bc16d1bd88670c3176904953976c97e5b))
- **deps:** update containerbase/internal-tools action to v4.1.3 (main) ([#​41147](https://github.com/renovatebot/renovate/issues/41147)) ([30a4526](https://github.com/renovatebot/renovate/commit/30a4526748a066f19cf8ba07c277f63d577ed1e6))
- **deps:** update dependency vite to v8.0.0-beta.13 (main) ([#​41144](https://github.com/renovatebot/renovate/issues/41144)) ([9dd615f](https://github.com/renovatebot/renovate/commit/9dd615f3aadb899dd111d761e12c38a19d103733))
### [`v43.10.3`](https://github.com/renovatebot/renovate/releases/tag/43.10.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.10.2...43.10.3)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.4.5 (main) ([#​41142](https://github.com/renovatebot/renovate/issues/41142)) ([26fefcb](https://github.com/renovatebot/renovate/commit/26fefcb344c21ec41565cbb084019d7b8eed9e02))
##### Documentation
- **nuget:** add `supportsLockFileMaintenance` flag ([#​41134](https://github.com/renovatebot/renovate/issues/41134)) ([5c38220](https://github.com/renovatebot/renovate/commit/5c38220087d6fbba256a70f70df12d4cbcf8fcd0))
##### Miscellaneous Chores
- **deps:** update aquasecurity/trivy-action action to v0.34.0 (main) ([#​41138](https://github.com/renovatebot/renovate/issues/41138)) ([fe65732](https://github.com/renovatebot/renovate/commit/fe65732ef0557598955e2eeb989de8bfb3b32155))
- **deps:** update dependency esbuild to v0.27.3 (main) ([#​41140](https://github.com/renovatebot/renovate/issues/41140)) ([e6f2c78](https://github.com/renovatebot/renovate/commit/e6f2c7880febbea9e625b357126afdd68db5c843))
##### Code Refactoring
- add lock file names to manager api ([#​41133](https://github.com/renovatebot/renovate/issues/41133)) ([d024075](https://github.com/renovatebot/renovate/commit/d024075d008e1b2ba2faa951df91dd1471d308ee))
### [`v43.10.2`](https://github.com/renovatebot/renovate/releases/tag/43.10.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.10.1...43.10.2)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.4.4 (main) ([#​41136](https://github.com/renovatebot/renovate/issues/41136)) ([e621a93](https://github.com/renovatebot/renovate/commit/e621a933ec3241da79dd70684b111297f105269e))
##### Miscellaneous Chores
- **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.0.13 (main) ([#​41132](https://github.com/renovatebot/renovate/issues/41132)) ([a0e193d](https://github.com/renovatebot/renovate/commit/a0e193d109ea68f292ae9edfc0731c73a6f2695f))
- **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.1.0 (main) ([#​41137](https://github.com/renovatebot/renovate/issues/41137)) ([11f19c2](https://github.com/renovatebot/renovate/commit/11f19c228331a67761ea537fb02e1f83a5f9c641))
### [`v43.10.1`](https://github.com/renovatebot/renovate/releases/tag/43.10.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.10.0...43.10.1)
##### Build System
- **deps:** update dependency semver to v7.7.4 (main) ([#​41131](https://github.com/renovatebot/renovate/issues/41131)) ([9ee25e9](https://github.com/renovatebot/renovate/commit/9ee25e9d3a4ed8b472616928f7f52c3a12417aea))
### [`v43.10.0`](https://github.com/renovatebot/renovate/releases/tag/43.10.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.9.0...43.10.0)
##### Features
- **presets/monorepos:** Add additional dotnet resources ([#​41123](https://github.com/renovatebot/renovate/issues/41123)) ([d0ff582](https://github.com/renovatebot/renovate/commit/d0ff582908bac95532fbd92eb01ef2004a05387f))
##### Miscellaneous Chores
- **deps:** update dependency [@​types/node](https://github.com/types/node) to v24.10.11 (main) ([#​41125](https://github.com/renovatebot/renovate/issues/41125)) ([103a765](https://github.com/renovatebot/renovate/commit/103a76546fc1dc5a6fd353c843378025b5998ad0))
### [`v43.9.0`](https://github.com/renovatebot/renovate/releases/tag/43.9.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.8.5...43.9.0)
##### Features
- **presets/monorepos:** add middleapi/orpc ([#​41115](https://github.com/renovatebot/renovate/issues/41115)) ([17bb3a9](https://github.com/renovatebot/renovate/commit/17bb3a9c80a5ad8c1192cb3d072501ed69af2d40))
##### Miscellaneous Chores
- **deps:** update dependency tsdown to v0.20.3 (main) ([#​41117](https://github.com/renovatebot/renovate/issues/41117)) ([b2c4124](https://github.com/renovatebot/renovate/commit/b2c41246059df04bee75925d7445f903fcdb356c))
- **github:** warn when using default Git author on GitHub.com ([#​41055](https://github.com/renovatebot/renovate/issues/41055)) ([bad0211](https://github.com/renovatebot/renovate/commit/bad0211f3003976f71a0047ee37c1987ca51cf22)), closes [#​39309](https://github.com/renovatebot/renovate/issues/39309)
- post 43.x release updates ([#​41124](https://github.com/renovatebot/renovate/issues/41124)) ([4137682](https://github.com/renovatebot/renovate/commit/41376822ebb1105976518a9fb5447c0a74c3c0cc))
### [`v43.8.5`](https://github.com/renovatebot/renovate/releases/tag/43.8.5)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.8.4...43.8.5)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.4.3 (main) ([#​41111](https://github.com/renovatebot/renovate/issues/41111)) ([5adc60d](https://github.com/renovatebot/renovate/commit/5adc60d2f6f53199ff0809d4ffbbc27b5f4827d8))
##### Build System
- **deps:** update dependency [@​renovatebot/pgp](https://github.com/renovatebot/pgp) to v1.3.1 (main) ([#​41110](https://github.com/renovatebot/renovate/issues/41110)) ([5ab310b](https://github.com/renovatebot/renovate/commit/5ab310b26aad2298226ea3b816df914d4b3c5e4f))
### [`v43.8.4`](https://github.com/renovatebot/renovate/releases/tag/43.8.4)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.8.3...43.8.4)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.4.2 (main) ([#​41109](https://github.com/renovatebot/renovate/issues/41109)) ([7257a54](https://github.com/renovatebot/renovate/commit/7257a541c900ae38bcb0b645f3d69c9f8f83efc2))
##### Documentation
- clarify pypi simple registry release timestamp behaviour ([#​40916](https://github.com/renovatebot/renovate/issues/40916)) ([dc4d997](https://github.com/renovatebot/renovate/commit/dc4d997aa2cbce725e966c9ec77c19ce5b3dd8fe))
##### Miscellaneous Chores
- **biome:** ignore worktrees ([#​41107](https://github.com/renovatebot/renovate/issues/41107)) ([9fb7bf6](https://github.com/renovatebot/renovate/commit/9fb7bf6aca7b0f21eb5982e606f48d98043569ff))
- **deps:** update dependency tsdown to v0.20.2 (main) ([#​41108](https://github.com/renovatebot/renovate/issues/41108)) ([2799ef1](https://github.com/renovatebot/renovate/commit/2799ef14382c71c9ab368e9beba0dac91cf793c8))
### [`v43.8.3`](https://github.com/renovatebot/renovate/releases/tag/43.8.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.8.2...43.8.3)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.4.1 (main) ([#​41105](https://github.com/renovatebot/renovate/issues/41105)) ([5cd7893](https://github.com/renovatebot/renovate/commit/5cd78933ff06d2e9b25469bd7cc49b87de85254d))
##### Documentation
- add additional linebreak in the announcement ([#​41090](https://github.com/renovatebot/renovate/issues/41090)) ([902146a](https://github.com/renovatebot/renovate/commit/902146a6b7efafe8d71c88a193d16cfcd1b140de))
- **allowedUnsafeExecutions:** correctly reference `postUpdateOption` ([#​39946](https://github.com/renovatebot/renovate/issues/39946)) ([8a9b805](https://github.com/renovatebot/renovate/commit/8a9b80571a4a64818a94cd151b265ff1fe3bddbb))
- pre-announce release of 43.x to Mend-hosted apps ([#​41087](https://github.com/renovatebot/renovate/issues/41087)) ([cffe1be](https://github.com/renovatebot/renovate/commit/cffe1bed465253b2ec8d4975f651648eb6dcb83f))
- update documentation for the new docs site publishing ([#​41091](https://github.com/renovatebot/renovate/issues/41091)) ([192b634](https://github.com/renovatebot/renovate/commit/192b63412134a517ce08958315dd5314967aeb31))
##### Miscellaneous Chores
- **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.0.12 (main) ([#​41103](https://github.com/renovatebot/renovate/issues/41103)) ([41a5791](https://github.com/renovatebot/renovate/commit/41a5791c1b347e57f45b6c767973df031e398425))
- make it clearer that CE/EE issues should go to the Mend repo ([#​41085](https://github.com/renovatebot/renovate/issues/41085)) ([092345a](https://github.com/renovatebot/renovate/commit/092345a0d340bcf042634987ff8d95d767c2ab2d))
##### Continuous Integration
- build docs from this repo ([#​40982](https://github.com/renovatebot/renovate/issues/40982)) ([4bc2969](https://github.com/renovatebot/renovate/commit/4bc29697e8b2da2ac56e05f6b27af0e9e4b23259)), closes [#​39878](https://github.com/renovatebot/renovate/issues/39878)
### [`v43.8.2`](https://github.com/renovatebot/renovate/releases/tag/43.8.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.8.1...43.8.2)
##### Build System
- **deps:** update dependency minimatch to v10.1.2 (main) ([#​41075](https://github.com/renovatebot/renovate/issues/41075)) ([42ffaa9](https://github.com/renovatebot/renovate/commit/42ffaa9c1e05ff207c4db59ef9e9c732d510c6a3))
- **deps:** update dependency semver to v7.7.3 (main) ([#​38624](https://github.com/renovatebot/renovate/issues/38624)) ([498f8f3](https://github.com/renovatebot/renovate/commit/498f8f30d111d37135dd3e1812ea2fd1ad2c3c73)), closes [#​41082](https://github.com/renovatebot/renovate/issues/41082)
### [`v43.8.1`](https://github.com/renovatebot/renovate/releases/tag/43.8.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.8.0...43.8.1)
##### Bug Fixes
- **pep440:** handle v-prefixed versions gracefully ([#​40989](https://github.com/renovatebot/renovate/issues/40989)) ([f5f32bd](https://github.com/renovatebot/renovate/commit/f5f32bdcb4661d03aeddf7631d024c001c7aef7b))
### [`v43.8.0`](https://github.com/renovatebot/renovate/releases/tag/43.8.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.7.0...43.8.0)
##### Features
- **presets/workarounds:** support bellsoft/hardened-liberica-runtime-container Image ([#​41058](https://github.com/renovatebot/renovate/issues/41058)) ([ad26a3a](https://github.com/renovatebot/renovate/commit/ad26a3a94eb946c3a289e6fc0b0532e98eb013b1))
### [`v43.7.0`](https://github.com/renovatebot/renovate/releases/tag/43.7.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.6.3...43.7.0)
##### Features
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.4.0 (main) ([#​41079](https://github.com/renovatebot/renovate/issues/41079)) ([a4a235e](https://github.com/renovatebot/renovate/commit/a4a235e1870b6fdcee30f9996f2c1c5d592ed785))
### [`v43.6.3`](https://github.com/renovatebot/renovate/releases/tag/43.6.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.6.2...43.6.3)
##### Miscellaneous Chores
- **deps:** update dependency [@​biomejs/biome](https://github.com/biomejs/biome) to v2.3.14 (main) ([#​41069](https://github.com/renovatebot/renovate/issues/41069)) ([03c995c](https://github.com/renovatebot/renovate/commit/03c995c09c050c3fb235ee2e21e3fccaf8e15e24))
##### Build System
- **deps:** update dependency glob to v13.0.1 (main) ([#​41074](https://github.com/renovatebot/renovate/issues/41074)) ([c0b8782](https://github.com/renovatebot/renovate/commit/c0b8782840ad6f7c7a47a1a41aad73e42f98bd3e))
### [`v43.6.2`](https://github.com/renovatebot/renovate/releases/tag/43.6.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.6.1...43.6.2)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.3.4 (main) ([#​41070](https://github.com/renovatebot/renovate/issues/41070)) ([bc01fc7](https://github.com/renovatebot/renovate/commit/bc01fc71bc192946d7fbff1b6217d776d2fc101f))
### [`v43.6.1`](https://github.com/renovatebot/renovate/releases/tag/43.6.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.6.0...43.6.1)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.3.3 (main) ([#​41067](https://github.com/renovatebot/renovate/issues/41067)) ([fe51aac](https://github.com/renovatebot/renovate/commit/fe51aac667c0fe806ed989c0f7a176dcca55ca52))
##### Miscellaneous Chores
- **deps:** update dependency node to v24.13.1 (main) ([#​41066](https://github.com/renovatebot/renovate/issues/41066)) ([c758ce3](https://github.com/renovatebot/renovate/commit/c758ce30f79c873abcba1553ad69560391e1a2f9))
### [`v43.6.0`](https://github.com/renovatebot/renovate/releases/tag/43.6.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.5.6...43.6.0)
##### Features
- **preset:** update :semanticPrefixFixDepsChoreOthers preset with missing poetry manager ([#​41049](https://github.com/renovatebot/renovate/issues/41049)) ([574e40f](https://github.com/renovatebot/renovate/commit/574e40f745b735a028b003ae7a9a5f4f41f00b4b)), closes [#​33509](https://github.com/renovatebot/renovate/issues/33509)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.3.2 (main) ([#​41061](https://github.com/renovatebot/renovate/issues/41061)) ([fda3fab](https://github.com/renovatebot/renovate/commit/fda3fab06365ec468fc53383d8c0b77eb1d68c6f))
- **versioning/redhat:** allow optional .GA inside version ([#​41059](https://github.com/renovatebot/renovate/issues/41059)) ([0f50d67](https://github.com/renovatebot/renovate/commit/0f50d67439041e072fbda12c33d4738260b2a78b))
##### Miscellaneous Chores
- **tools/mkdocs:** ensure `RENOVATE_VERSION` is passed to `mkdocs` ([#​40988](https://github.com/renovatebot/renovate/issues/40988)) ([7e073d7](https://github.com/renovatebot/renovate/commit/7e073d7b8a3d2db4e3202d503e296c2e9f4c478c))
##### Build System
- **deps:** update node.js to v24.13.1 (main) ([#​41060](https://github.com/renovatebot/renovate/issues/41060)) ([e53a1f6](https://github.com/renovatebot/renovate/commit/e53a1f67a69a164d3f424e0930308873b3cfa5d9))
### [`v43.5.6`](https://github.com/renovatebot/renovate/releases/tag/43.5.6)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.5.5...43.5.6)
##### Bug Fixes
- **types:** RenovateRepository not inheriting RenovateConfig ([#​40897](https://github.com/renovatebot/renovate/issues/40897)) ([c273266](https://github.com/renovatebot/renovate/commit/c273266c80147cb00c0d80959b07e733b56d6c39))
### [`v43.5.5`](https://github.com/renovatebot/renovate/releases/tag/43.5.5)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.5.4...43.5.5)
##### Bug Fixes
- **types:** don't use `infer` from Zod ([#​41054](https://github.com/renovatebot/renovate/issues/41054)) ([acc1d3d](https://github.com/renovatebot/renovate/commit/acc1d3dfbde8a7f706236ca81bacbb74ebd54369))
##### Miscellaneous Chores
- **deps:** update dependency [@​types/node](https://github.com/types/node) to v24.10.10 (main) ([#​41050](https://github.com/renovatebot/renovate/issues/41050)) ([be2c66d](https://github.com/renovatebot/renovate/commit/be2c66d311c364b689cc86612f23ff0788442cbb))
### [`v43.5.4`](https://github.com/renovatebot/renovate/releases/tag/43.5.4)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.5.3...43.5.4)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.3.1 (main) ([#​41048](https://github.com/renovatebot/renovate/issues/41048)) ([79f2f41](https://github.com/renovatebot/renovate/commit/79f2f4197ba685ded1937df029859601e1008def))
### [`v43.5.3`](https://github.com/renovatebot/renovate/releases/tag/43.5.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.5.2...43.5.3)
##### Bug Fixes
- **vendir:** remove registryUrls from git-refs dependencies ([#​40938](https://github.com/renovatebot/renovate/issues/40938)) ([fe18306](https://github.com/renovatebot/renovate/commit/fe183062323ecf53836aa9dc05228207235528f3))
##### Miscellaneous Chores
- **deps:** update dependency [@​smithy/util-stream](https://github.com/smithy/util-stream) to v4.5.11 (main) ([#​41046](https://github.com/renovatebot/renovate/issues/41046)) ([f4d78ac](https://github.com/renovatebot/renovate/commit/f4d78ac35f38a170289cf107ea3f54e8aa8f51a7))
### [`v43.5.2`](https://github.com/renovatebot/renovate/releases/tag/43.5.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.5.1...43.5.2)
##### Miscellaneous Chores
- **deps:** lock file maintenance (main) ([#​41043](https://github.com/renovatebot/renovate/issues/41043)) ([cc5b2bc](https://github.com/renovatebot/renovate/commit/cc5b2bc56abed983ed383affabf0c6e7099e8faa))
##### Build System
- **deps:** update dependency [@​renovatebot/pgp](https://github.com/renovatebot/pgp) to v1.3.0 (main) ([#​41028](https://github.com/renovatebot/renovate/issues/41028)) ([d87ca56](https://github.com/renovatebot/renovate/commit/d87ca56a759afce67f5463beae54b8af30485af6))
### [`v43.5.1`](https://github.com/renovatebot/renovate/releases/tag/43.5.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.5.0...43.5.1)
##### Bug Fixes
- provide more exported types ([#​41031](https://github.com/renovatebot/renovate/issues/41031)) ([dca0f1d](https://github.com/renovatebot/renovate/commit/dca0f1d455e32f9d2377f069196b9147eba91c97))
##### Miscellaneous Chores
- **deps:** update dependency eslint-plugin-oxlint to v1.43.0 (main) ([#​41032](https://github.com/renovatebot/renovate/issues/41032)) ([b415286](https://github.com/renovatebot/renovate/commit/b41528692936765e05996e5352659fdc1e127e2c))
### [`v43.5.0`](https://github.com/renovatebot/renovate/releases/tag/43.5.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.4.5...43.5.0)
##### Features
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.3.0 (main) ([#​41029](https://github.com/renovatebot/renovate/issues/41029)) ([508599c](https://github.com/renovatebot/renovate/commit/508599cb065d84df3ab6d55c1ba7aed7b9cd8e1c))
### [`v43.4.5`](https://github.com/renovatebot/renovate/releases/tag/43.4.5)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.4.4...43.4.5)
##### Miscellaneous Chores
- **deps:** update dependency oxlint to v1.43.0 (main) ([#​41027](https://github.com/renovatebot/renovate/issues/41027)) ([1a45ac1](https://github.com/renovatebot/renovate/commit/1a45ac1bcab0053c460d5417cc34f00ca3623d9e))
##### Build System
- **deps:** update dependency [@​renovatebot/pgp](https://github.com/renovatebot/pgp) to v1.2.4 (main) ([#​41026](https://github.com/renovatebot/renovate/issues/41026)) ([3cfebe6](https://github.com/renovatebot/renovate/commit/3cfebe65930aaf3ed3abae560f3fee4265c86aeb))
### [`v43.4.4`](https://github.com/renovatebot/renovate/releases/tag/43.4.4)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.4.3...43.4.4)
##### Bug Fixes
- **exec:** don't extend env ([#​41024](https://github.com/renovatebot/renovate/issues/41024)) ([a825cac](https://github.com/renovatebot/renovate/commit/a825cac81b0293832aecaa42e238e753e073f1e1))
##### Documentation
- update references to python to [`4b827ab`](https://github.com/renovatebot/renovate/commit/4b827ab) (main) ([#​41007](https://github.com/renovatebot/renovate/issues/41007)) ([10b2d3a](https://github.com/renovatebot/renovate/commit/10b2d3ae6ad993b438318e5aa1679046aeb01706))
- update references to renovatebot/github-action to v46.0.2 (main) ([#​41014](https://github.com/renovatebot/renovate/issues/41014)) ([cb9a342](https://github.com/renovatebot/renovate/commit/cb9a342d7dcd4cd08bd803abc6c05131091b299f))
##### Miscellaneous Chores
- **deps:** update containerbase/internal-tools action to v4.0.11 (main) ([#​41009](https://github.com/renovatebot/renovate/issues/41009)) ([cf56014](https://github.com/renovatebot/renovate/commit/cf56014734cd5151ecafb7c12315d1532bd0425b))
- **deps:** update containerbase/internal-tools action to v4.0.12 (main) ([#​41011](https://github.com/renovatebot/renovate/issues/41011)) ([9c22bf8](https://github.com/renovatebot/renovate/commit/9c22bf89ff166c94329f428c160219861466c4b1))
- **deps:** update containerbase/internal-tools action to v4.0.8 (main) ([#​41003](https://github.com/renovatebot/renovate/issues/41003)) ([150454a](https://github.com/renovatebot/renovate/commit/150454a31a51b9e2216d80ede6da1f1242144ee7))
- **deps:** update containerbase/internal-tools action to v4.0.9 (main) ([#​41005](https://github.com/renovatebot/renovate/issues/41005)) ([ad26f94](https://github.com/renovatebot/renovate/commit/ad26f949a9289a23e54a1fd6943224231525077b))
- **deps:** update dependency [@​containerbase/eslint-plugin](https://github.com/containerbase/eslint-plugin) to v1.1.31 (main) ([#​41010](https://github.com/renovatebot/renovate/issues/41010)) ([a4eaae7](https://github.com/renovatebot/renovate/commit/a4eaae7c5182152b0e35c1ce706638a63b545d51))
- **deps:** update dependency [@​containerbase/istanbul-reports-html](https://github.com/containerbase/istanbul-reports-html) to v1.1.29 (main) ([#​41006](https://github.com/renovatebot/renovate/issues/41006)) ([b13e5d8](https://github.com/renovatebot/renovate/commit/b13e5d845c628b8202d4e7109cafa5a0a8da8a59))
- **deps:** update dependency [@​containerbase/istanbul-reports-html](https://github.com/containerbase/istanbul-reports-html) to v1.1.30 (main) ([#​41012](https://github.com/renovatebot/renovate/issues/41012)) ([f3efeb5](https://github.com/renovatebot/renovate/commit/f3efeb551e65c0f59d90068e586409888634ab44))
- **deps:** update dependency [@​containerbase/semantic-release-pnpm](https://github.com/containerbase/semantic-release-pnpm) to v1.3.19 (main) ([#​41008](https://github.com/renovatebot/renovate/issues/41008)) ([bfbf119](https://github.com/renovatebot/renovate/commit/bfbf1194e5dfd52341bf447c16c83eaaf252e941))
- **deps:** update dependency [@​containerbase/semantic-release-pnpm](https://github.com/containerbase/semantic-release-pnpm) to v1.3.20 (main) ([#​41013](https://github.com/renovatebot/renovate/issues/41013)) ([908d7a0](https://github.com/renovatebot/renovate/commit/908d7a0c263647c4e88f76cfdce6a00ab172787f))
- **tools/mkdocs:** add `--version` flag ([#​40986](https://github.com/renovatebot/renovate/issues/40986)) ([f71db58](https://github.com/renovatebot/renovate/commit/f71db58fd55288b624313935b7618ee3b77b9171))
### [`v43.4.3`](https://github.com/renovatebot/renovate/releases/tag/43.4.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.4.2...43.4.3)
##### Bug Fixes
- **bitbucket-server:** when adding reviewers use name instead of slug ([#​41002](https://github.com/renovatebot/renovate/issues/41002)) ([d976f56](https://github.com/renovatebot/renovate/commit/d976f56e787bb5983ba03d93523c18e1c521e168))
##### Miscellaneous Chores
- **deps:** update dependency globals to v17.3.0 (main) ([#​41001](https://github.com/renovatebot/renovate/issues/41001)) ([3b18374](https://github.com/renovatebot/renovate/commit/3b18374119a9dab201b2edf8a840325ab1af4240))
- **deps:** update dependency type-fest to v5.4.3 (main) ([#​40996](https://github.com/renovatebot/renovate/issues/40996)) ([ac197b2](https://github.com/renovatebot/renovate/commit/ac197b21ce7fc1aaf64701cbcff3667268dd682e))
### [`v43.4.2`](https://github.com/renovatebot/renovate/releases/tag/43.4.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.4.1...43.4.2)
##### Build System
- **deps:** update dependency commander to v14.0.3 (main) ([#​40994](https://github.com/renovatebot/renovate/issues/40994)) ([b2f2955](https://github.com/renovatebot/renovate/commit/b2f2955695a37a88c249342c8fc884ce4494429c))
### [`v43.4.1`](https://github.com/renovatebot/renovate/releases/tag/43.4.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.4.0...43.4.1)
##### Code Refactoring
- **lint:** Fix lint violations ([#​40965](https://github.com/renovatebot/renovate/issues/40965)) ([b02897f](https://github.com/renovatebot/renovate/commit/b02897fab10ca0cca24b891e7f2e5d418dc0f3dd))
- **lint:** Organize imports with biome ([#​40966](https://github.com/renovatebot/renovate/issues/40966)) ([9d857c1](https://github.com/renovatebot/renovate/commit/9d857c1f68fe664e5a1f298c2963762bcee31c36))
- **presets:** Rename to \*.preset.ts and enforce sort-keys via oxlint ([#​40976](https://github.com/renovatebot/renovate/issues/40976)) ([c531748](https://github.com/renovatebot/renovate/commit/c531748f09f5508bf4122e16ade75d7ac5ad98db))
##### Build System
- **deps:** update dependency semantic-release to v25.0.3 (main) ([#​40990](https://github.com/renovatebot/renovate/issues/40990)) ([5509bc5](https://github.com/renovatebot/renovate/commit/5509bc5da38eeea52193dd31f0ebefe30ee02e45))
### [`v43.4.0`](https://github.com/renovatebot/renovate/releases/tag/43.4.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.3.6...43.4.0)
##### Features
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.2.0 (main) ([#​40962](https://github.com/renovatebot/renovate/issues/40962)) ([0993b1e](https://github.com/renovatebot/renovate/commit/0993b1ee8cf07f3e27b3c45206040d6bc946751e))
##### Documentation
- **toolSettings:** correct reference to `toolSettings` parent option ([#​40951](https://github.com/renovatebot/renovate/issues/40951)) ([b566f4a](https://github.com/renovatebot/renovate/commit/b566f4a193f315bb4ee4ba71fae27a7029303ad0))
- **toolSettings:** document the supported managers ([#​40950](https://github.com/renovatebot/renovate/issues/40950)) ([fa6ba4e](https://github.com/renovatebot/renovate/commit/fa6ba4e68dce60af5c5e4343ef8521d027d345cf))
##### Miscellaneous Chores
- **deps:** update github/codeql-action action to v4.32.2 (main) ([#​40958](https://github.com/renovatebot/renovate/issues/40958)) ([ff5a3f5](https://github.com/renovatebot/renovate/commit/ff5a3f51a12a997f9043cba79654500416b95e9a))
- **util/exec:** remove unnecessary optional operator ([#​40956](https://github.com/renovatebot/renovate/issues/40956)) ([87b324d](https://github.com/renovatebot/renovate/commit/87b324dafafb359d6fb9019ec1097f30f169811b))
##### Tests
- **lib/util/exec:** refactor ahead of new tests ([#​40954](https://github.com/renovatebot/renovate/issues/40954)) ([5ec2f17](https://github.com/renovatebot/renovate/commit/5ec2f17b22ccc9d44ef99fdaa905399d48d4a147))
- **lib/util/exec:** use clearer example for global config ([#​40952](https://github.com/renovatebot/renovate/issues/40952)) ([698d7df](https://github.com/renovatebot/renovate/commit/698d7df92dc62196b351bd765f522d7ad98a177e))
- **util/exec:** correct test naming ([#​40955](https://github.com/renovatebot/renovate/issues/40955)) ([6eaa786](https://github.com/renovatebot/renovate/commit/6eaa7869b54dfd2bd33de2591a2dd290ff313c23))
### [`v43.3.6`](https://github.com/renovatebot/renovate/releases/tag/43.3.6)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.3.5...43.3.6)
##### Build System
- **deps:** update dependency cronstrue to v3.11.0 (main) ([#​40948](https://github.com/renovatebot/renovate/issues/40948)) ([c2aa3ba](https://github.com/renovatebot/renovate/commit/c2aa3ba43b26e8d717dc57a6bc5a4bc06e7329b6))
### [`v43.3.5`](https://github.com/renovatebot/renovate/releases/tag/43.3.5)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.3.4...43.3.5)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.18 (main) ([#​40944](https://github.com/renovatebot/renovate/issues/40944)) ([6e08e65](https://github.com/renovatebot/renovate/commit/6e08e65397ddb77563affe8727de5d728527e184))
### [`v43.3.4`](https://github.com/renovatebot/renovate/releases/tag/43.3.4)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.3.3...43.3.4)
##### Build System
- **deps:** update dependency find-up to v8 (main) ([#​39501](https://github.com/renovatebot/renovate/issues/39501)) ([aa22189](https://github.com/renovatebot/renovate/commit/aa221892e833bf883b06fce454d271a4e233ea11))
### [`v43.3.3`](https://github.com/renovatebot/renovate/releases/tag/43.3.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.3.2...43.3.3)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.17 (main) ([#​40937](https://github.com/renovatebot/renovate/issues/40937)) ([72ab45a](https://github.com/renovatebot/renovate/commit/72ab45a10be720b9ca2ae7b04b89e54cb2c1725f))
##### Miscellaneous Chores
- **deps:** update dependency vite to v8.0.0-beta.11 (main) ([#​40653](https://github.com/renovatebot/renovate/issues/40653)) ([483b142](https://github.com/renovatebot/renovate/commit/483b142c43de57ea9e2d3c526340874136c3eb1e))
### [`v43.3.2`](https://github.com/renovatebot/renovate/releases/tag/43.3.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.3.1...43.3.2)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.16 (main) ([#​40934](https://github.com/renovatebot/renovate/issues/40934)) ([e93b258](https://github.com/renovatebot/renovate/commit/e93b2587bbcaa2b82c68ffa9089250ff4acf5242))
##### Miscellaneous Chores
- **deps:** update python docker tag to v3.14.3 (main) ([#​40933](https://github.com/renovatebot/renovate/issues/40933)) ([07de074](https://github.com/renovatebot/renovate/commit/07de07479b58ef6f06ab45e98d54e7e2576965b2))
### [`v43.3.1`](https://github.com/renovatebot/renovate/releases/tag/43.3.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.3.0...43.3.1)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.15 (main) ([#​40929](https://github.com/renovatebot/renovate/issues/40929)) ([42bc997](https://github.com/renovatebot/renovate/commit/42bc997c370a23d0392ab572551d4b698ca05dd3))
##### Documentation
- **terraform:** clarify release timestamp and limitation ([#​40923](https://github.com/renovatebot/renovate/issues/40923)) ([4a527ae](https://github.com/renovatebot/renovate/commit/4a527aeae89f65bf7e9f4d19d351245526c06537))
### [`v43.3.0`](https://github.com/renovatebot/renovate/releases/tag/43.3.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.8...43.3.0)
##### Features
- **gradle:** allow specifying Gradle daemon heap size ([#​40090](https://github.com/renovatebot/renovate/issues/40090)) ([c08656f](https://github.com/renovatebot/renovate/commit/c08656f4b76a739fc34861087c62c87eeac974d7))
### [`v43.2.8`](https://github.com/renovatebot/renovate/releases/tag/43.2.8)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.7...43.2.8)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.14 (main) ([#​40911](https://github.com/renovatebot/renovate/issues/40911)) ([e8925a9](https://github.com/renovatebot/renovate/commit/e8925a98cbfa62e8977d81fe82d9329b984948e8))
##### Documentation
- **minimum-release-age:** clarify lack of support for non-Docker Hub ([#​40910](https://github.com/renovatebot/renovate/issues/40910)) ([3b10d8e](https://github.com/renovatebot/renovate/commit/3b10d8ef0661b64f18565a64433dd8dfc5fafc9a))
### [`v43.2.7`](https://github.com/renovatebot/renovate/releases/tag/43.2.7)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.6...43.2.7)
##### Build System
- **deps:** update dependency re2 to v1.23.2 (main) ([#​40906](https://github.com/renovatebot/renovate/issues/40906)) ([b120461](https://github.com/renovatebot/renovate/commit/b120461316602a650258272c90aa28159ddb472a))
### [`v43.2.6`](https://github.com/renovatebot/renovate/releases/tag/43.2.6)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.5...43.2.6)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.13 (main) ([#​40899](https://github.com/renovatebot/renovate/issues/40899)) ([6545c08](https://github.com/renovatebot/renovate/commit/6545c080bf6f2474213858921f864fe894a9f9a8))
### [`v43.2.5`](https://github.com/renovatebot/renovate/releases/tag/43.2.5)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.4...43.2.5)
##### Bug Fixes
- **gitlab:** skip automerge retry when merge\_when\_pipeline\_succeeds already set ([#​39979](https://github.com/renovatebot/renovate/issues/39979)) ([0f54593](https://github.com/renovatebot/renovate/commit/0f54593f44fd1308b2f9c31a21ebafcec11edce9))
##### Miscellaneous Chores
- **deps:** update dependency globals to v17.2.0 (main) ([#​40883](https://github.com/renovatebot/renovate/issues/40883)) ([127af7b](https://github.com/renovatebot/renovate/commit/127af7b8fd5f528ed8f4900a9a18fffb3587c68b))
- **deps:** update dependency type-fest to v5.4.2 (main) ([#​40882](https://github.com/renovatebot/renovate/issues/40882)) ([50ada6e](https://github.com/renovatebot/renovate/commit/50ada6e160b88710e32f34169c2a01c54f7c2a32))
- **renovate:** enable maintenance branch ([#​40871](https://github.com/renovatebot/renovate/issues/40871)) ([75274a4](https://github.com/renovatebot/renovate/commit/75274a407c694ee82613032ab18f2c39699345c6))
### [`v43.2.4`](https://github.com/renovatebot/renovate/releases/tag/43.2.4)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.3...43.2.4)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.12 (main) ([#​40880](https://github.com/renovatebot/renovate/issues/40880)) ([e0d383c](https://github.com/renovatebot/renovate/commit/e0d383cc694e5c2f04d4733176b8f6ebd1ca407c))
### [`v43.2.3`](https://github.com/renovatebot/renovate/releases/tag/43.2.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.2...43.2.3)
##### Bug Fixes
- **workers:** re-attempt platform automerge only in case of new commits ([#​40028](https://github.com/renovatebot/renovate/issues/40028)) ([c396b58](https://github.com/renovatebot/renovate/commit/c396b58e35b0d2b39649114d7fa0959897713059))
### [`v43.2.2`](https://github.com/renovatebot/renovate/releases/tag/43.2.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.1...43.2.2)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.11 (main) ([#​40870](https://github.com/renovatebot/renovate/issues/40870)) ([9945be3](https://github.com/renovatebot/renovate/commit/9945be30bd841dbcc337d2e5d8bedb5416f83e2b))
- set defaul docker user for sidecar ([#​40869](https://github.com/renovatebot/renovate/issues/40869)) ([054cf2c](https://github.com/renovatebot/renovate/commit/054cf2c7b0faef5eba429dfab8b3230ea194d4a9))
##### Miscellaneous Chores
- **deps:** update dependency [@​containerbase/semantic-release-pnpm](https://github.com/containerbase/semantic-release-pnpm) to v1.3.18 (main) ([#​40669](https://github.com/renovatebot/renovate/issues/40669)) ([4310d07](https://github.com/renovatebot/renovate/commit/4310d070ac0beb3f7b18d99d6e7b576e08bf4e3f))
- **deps:** update dependency typescript-eslint to v8.54.0 (main) ([#​40864](https://github.com/renovatebot/renovate/issues/40864)) ([956a3cd](https://github.com/renovatebot/renovate/commit/956a3cdca7aee8d0277fb65f41dc6172c7700452))
- **deps:** update dependency vite-tsconfig-paths to v6 (main) ([#​40872](https://github.com/renovatebot/renovate/issues/40872)) ([9e32fde](https://github.com/renovatebot/renovate/commit/9e32fdeddf06392c1cb84d29205755c1d15506aa))
- **deps:** update dessant/label-actions action to v5 (main) ([#​40873](https://github.com/renovatebot/renovate/issues/40873)) ([f038065](https://github.com/renovatebot/renovate/commit/f0380658b42f266ff5ddb0ce1436a8bb03ebc3a4))
- **deps:** update dessant/lock-threads action to v6 (main) ([#​40874](https://github.com/renovatebot/renovate/issues/40874)) ([38107a0](https://github.com/renovatebot/renovate/commit/38107a0d62a6be916f8a0c30d27c4000346d1103))
- **deps:** update github artifact actions (main) (major) ([#​40876](https://github.com/renovatebot/renovate/issues/40876)) ([87436ba](https://github.com/renovatebot/renovate/commit/87436badf1652eee34ce6da9ef9525e6bcf13ec8))
- **deps:** update peter-evans/create-pull-request action to v8 (main) ([#​40877](https://github.com/renovatebot/renovate/issues/40877)) ([5b70890](https://github.com/renovatebot/renovate/commit/5b7089036f8188fb34c53cfbaf5412f6239377ee))
##### Build System
- **deps:** update dependency protobufjs to v8 (main) ([#​40878](https://github.com/renovatebot/renovate/issues/40878)) ([d24e7ac](https://github.com/renovatebot/renovate/commit/d24e7ac275ca97313c41e93da6ea6a6ea7c86504))
### [`v43.2.1`](https://github.com/renovatebot/renovate/releases/tag/43.2.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.2.0...43.2.1)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.10 (main) ([#​40863](https://github.com/renovatebot/renovate/issues/40863)) ([179abe4](https://github.com/renovatebot/renovate/commit/179abe488afe8030b213130578e62791af35efcd))
##### Miscellaneous Chores
- **deps:** update dependency pnpm to v10.28.2 (main) ([#​40860](https://github.com/renovatebot/renovate/issues/40860)) ([9293099](https://github.com/renovatebot/renovate/commit/9293099604dd534481b49be577782066dfa3b01c))
- **deps:** update github/codeql-action action to v4.32.1 (main) ([#​40862](https://github.com/renovatebot/renovate/issues/40862)) ([c4a2919](https://github.com/renovatebot/renovate/commit/c4a291953d235f2bdb053fe25ac9f401ca5dcdc9))
- **deps:** update linters to v1.42.0 (main) ([#​40861](https://github.com/renovatebot/renovate/issues/40861)) ([d9e7a28](https://github.com/renovatebot/renovate/commit/d9e7a28d3dc8e477cab011b4a28159a6c0053e0c))
### [`v43.2.0`](https://github.com/renovatebot/renovate/releases/tag/43.2.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.1.0...43.2.0)
##### Features
- Add `github-digest` datasource ([#​40226](https://github.com/renovatebot/renovate/issues/40226)) ([c246f81](https://github.com/renovatebot/renovate/commit/c246f814d545b845c7dba6b6a9b24f812c704ffc))
### [`v43.1.0`](https://github.com/renovatebot/renovate/releases/tag/43.1.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.10...43.1.0)
##### Features
- **bitbucket-server:** add support for platformAutomerge ([#​39885](https://github.com/renovatebot/renovate/issues/39885)) ([2254178](https://github.com/renovatebot/renovate/commit/2254178a7bd9a3425cd12d6b45c4b6457a79a1df))
- **pip-compile:** Support the `--group` uv pip compile option ([#​40665](https://github.com/renovatebot/renovate/issues/40665)) ([2062788](https://github.com/renovatebot/renovate/commit/2062788d8293d42908a7ce03075d221aba7c710a))
### [`v43.0.10`](https://github.com/renovatebot/renovate/releases/tag/43.0.10)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.9...43.0.10)
##### Bug Fixes
- **onboardingAutoCloseAge:** don't allow higher inherited value than global ([#​40810](https://github.com/renovatebot/renovate/issues/40810)) ([#​40817](https://github.com/renovatebot/renovate/issues/40817)) ([dc9f868](https://github.com/renovatebot/renovate/commit/dc9f86873dfeb115cfe808ed71a83b0ccf2e6337))
##### Documentation
- update references to renovate/renovate to v43.0.9 (main) ([#​40836](https://github.com/renovatebot/renovate/issues/40836)) ([38ab16b](https://github.com/renovatebot/renovate/commit/38ab16b39da6ba1bd6af003b9813787719834aab))
- update references to renovatebot/github-action to v46.0.1 (main) ([#​40843](https://github.com/renovatebot/renovate/issues/40843)) ([8dfe853](https://github.com/renovatebot/renovate/commit/8dfe8533ad805534b30331302a95d5eb6322d363))
##### Miscellaneous Chores
- **deps:** lock file maintenance (main) ([#​40837](https://github.com/renovatebot/renovate/issues/40837)) ([3ad3cf2](https://github.com/renovatebot/renovate/commit/3ad3cf272a49d80e7e265a139a398657aff27790))
- **deps:** update containerbase/internal-tools action to v4.0.6 (main) ([#​40838](https://github.com/renovatebot/renovate/issues/40838)) ([d53a5ac](https://github.com/renovatebot/renovate/commit/d53a5ac824cf3cbeb53b9cdf290cab2f58f63c1a))
- **deps:** update containerbase/internal-tools action to v4.0.7 (main) ([#​40841](https://github.com/renovatebot/renovate/issues/40841)) ([2be2969](https://github.com/renovatebot/renovate/commit/2be2969010aca8412d987596627105ebe50ed92f))
- **deps:** update dependency [@​containerbase/eslint-plugin](https://github.com/containerbase/eslint-plugin) to v1.1.30 (main) ([#​40839](https://github.com/renovatebot/renovate/issues/40839)) ([f95f33b](https://github.com/renovatebot/renovate/commit/f95f33bc08902a090625ab7739ec88ded0d71d93))
- **deps:** update dependency [@​containerbase/istanbul-reports-html](https://github.com/containerbase/istanbul-reports-html) to v1.1.28 (main) ([#​40842](https://github.com/renovatebot/renovate/issues/40842)) ([f607cbe](https://github.com/renovatebot/renovate/commit/f607cbe54da55dc3a2c106f554766bca9e69ab76))
- **logging:** include PR number when detecting existing branch PR ([#​40832](https://github.com/renovatebot/renovate/issues/40832)) ([7373eae](https://github.com/renovatebot/renovate/commit/7373eae4661dfa1890f59740414dd52783a1e3fa)), closes [#​123](https://github.com/renovatebot/renovate/issues/123)
### [`v43.0.9`](https://github.com/renovatebot/renovate/releases/tag/43.0.9)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.8...43.0.9)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.9 (main) ([#​40833](https://github.com/renovatebot/renovate/issues/40833)) ([8797acc](https://github.com/renovatebot/renovate/commit/8797acc7d3693511a90c584b42b000fd3ecf7112))
### [`v43.0.8`](https://github.com/renovatebot/renovate/releases/tag/43.0.8)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.7...43.0.8)
##### Build System
- **deps:** update dependency re2 to v1.23.1 (main) ([#​40831](https://github.com/renovatebot/renovate/issues/40831)) ([39dbc07](https://github.com/renovatebot/renovate/commit/39dbc070bf43ab28254500f5c5030f683c4b7252))
### [`v43.0.7`](https://github.com/renovatebot/renovate/releases/tag/43.0.7)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.6...43.0.7)
##### Code Refactoring
- typo ([#​40825](https://github.com/renovatebot/renovate/issues/40825)) ([9327821](https://github.com/renovatebot/renovate/commit/932782147270441e005cee0028c6d0ccadc4dffe))
##### Build System
- **deps:** update aws-sdk-js-v3 monorepo to v3.980.0 (main) ([#​40828](https://github.com/renovatebot/renovate/issues/40828)) ([da2c4b9](https://github.com/renovatebot/renovate/commit/da2c4b9f36c06855fe6e3978ee7373bcda96ea32))
### [`v43.0.6`](https://github.com/renovatebot/renovate/releases/tag/43.0.6)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.5...43.0.6)
##### Miscellaneous Chores
- **deps:** update actions/cache action to v5 (main) ([#​40820](https://github.com/renovatebot/renovate/issues/40820)) ([eb7d33c](https://github.com/renovatebot/renovate/commit/eb7d33ce6fec532be4e61e31d3869bb657f09343))
- **deps:** update containerbase/internal-tools action to v4.0.4 (main) ([#​40819](https://github.com/renovatebot/renovate/issues/40819)) ([fb0a354](https://github.com/renovatebot/renovate/commit/fb0a35494b57bc63226198ef74f6a8a77e7c5575))
- **deps:** update dependency [@​types/node](https://github.com/types/node) to v24 (main) ([#​40821](https://github.com/renovatebot/renovate/issues/40821)) ([5997152](https://github.com/renovatebot/renovate/commit/5997152f9d5d3c7b00ac7a191c58c27f61275687))
- **deps:** update dependency eslint-formatter-gha to v2 (main) ([#​40822](https://github.com/renovatebot/renovate/issues/40822)) ([6064667](https://github.com/renovatebot/renovate/commit/60646676dd85caad3bc3eeb19bc734dbe92d9e15))
- **deps:** update dependency globals to v17 (main) ([#​40823](https://github.com/renovatebot/renovate/issues/40823)) ([ac23ffc](https://github.com/renovatebot/renovate/commit/ac23ffcb964268f094e2dca28bda1de2bec4d05d))
- **deps:** update dependency renovatebot/github-action to v46 (main) ([#​40814](https://github.com/renovatebot/renovate/issues/40814)) ([48de4a1](https://github.com/renovatebot/renovate/commit/48de4a122ae5f994ff876e2467a251744295abc6))
- **deps:** update renovate/renovate docker tag to v43 (main) ([#​40807](https://github.com/renovatebot/renovate/issues/40807)) ([b44d3d5](https://github.com/renovatebot/renovate/commit/b44d3d5c6daeb130ae682fcb05dc7ad0de497df6))
##### Build System
- trim channel for docker builds ([#​40818](https://github.com/renovatebot/renovate/issues/40818)) ([e004f84](https://github.com/renovatebot/renovate/commit/e004f84c58740610220e242299bbbbf044e89241))
### [`v43.0.5`](https://github.com/renovatebot/renovate/releases/tag/43.0.5)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.4...43.0.5)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.8 (main) ([#​40803](https://github.com/renovatebot/renovate/issues/40803)) ([a73b6e1](https://github.com/renovatebot/renovate/commit/a73b6e194f4a27aac6bdb105c3d00f4bbc4c9918))
### [`v43.0.4`](https://github.com/renovatebot/renovate/releases/tag/43.0.4)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.3...43.0.4)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.7 (main) ([#​40801](https://github.com/renovatebot/renovate/issues/40801)) ([2b958f3](https://github.com/renovatebot/renovate/commit/2b958f3ea626a3fdba61adf36e254c50e331ee74))
### [`v43.0.3`](https://github.com/renovatebot/renovate/releases/tag/43.0.3)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.2...43.0.3)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.6 (main) ([#​40795](https://github.com/renovatebot/renovate/issues/40795)) ([7394478](https://github.com/renovatebot/renovate/commit/73944783c256b1a1d838683499f7fefd6f7c5a4d))
##### Miscellaneous Chores
- **onboarding:** capitalise the `prHourlyLimit` ([#​39443](https://github.com/renovatebot/renovate/issues/39443)) ([991fdbf](https://github.com/renovatebot/renovate/commit/991fdbfd6bc27b7f2fa20d572cf7e99aa2368d84))
### [`v43.0.2`](https://github.com/renovatebot/renovate/releases/tag/43.0.2)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.1...43.0.2)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.5 (main) ([#​40793](https://github.com/renovatebot/renovate/issues/40793)) ([00a1006](https://github.com/renovatebot/renovate/commit/00a100629934d8deebd5680f6b7189d76ccf022a))
##### Documentation
- **mise:** Fix invalid configuration example ([#​40792](https://github.com/renovatebot/renovate/issues/40792)) ([24ae070](https://github.com/renovatebot/renovate/commit/24ae07037ce7835f9a49b07b546f8ae98e37a990))
### [`v43.0.1`](https://github.com/renovatebot/renovate/releases/tag/43.0.1)
[Compare Source](https://github.com/renovatebot/renovate/compare/43.0.0...43.0.1)
##### Bug Fixes
- **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.4 (main) ([#​40788](https://github.com/renovatebot/renovate/issues/40788)) ([1e4f4d3](https://github.com/renovatebot/renovate/commit/1e4f4d35af25e43b5690d727d2b5d3481a7a4d44))
##### Documentation
- **opentelemetry:** revamp documentation ([#​40765](https://github.com/renovatebot/renovate/issues/40765)) ([18c7915](https://github.com/renovatebot/renovate/commit/18c7915000dda60d8a93bf8083197750b8a4f9db)), closes [#​40126](https://github.com/renovatebot/renovate/issues/40126)
### [`v43.0.0`](https://github.com/renovatebot/renovate/releases/tag/43.0.0)
[Compare Source](https://github.com/renovatebot/renovate/compare/42.99.0...43.0.0)
#### Breaking changes for 43
##### Allowlisting required for "unsafe commands" [#​40684](https://github.com/renovatebot/renovate/issues/40684)
> \[!NOTE]
> This should only affect you if you work with repositories that have a Gradle Wrapper.
Prior to Renovate 43, when performing updates in a repository that used Gradle, Renovate would execute the Gradle Wrapper (`./gradlew` or `gradlew.bat`).
This is [a well-documented "insider attack" risk](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) that could lead to remote code execution in the context of the Renovate process, as execution of the Gradle buildscript:
- is controlled by the anyone with write access to the repository being processed
- can look for specific tasks to execute specific code
- can execute code from source-tracked scripts
- can execute code from third-party libraries
This can occur during updates to [the Gradle wrapper](https://docs.renovatebot.com/modules/manager/gradle-wrapper/) or using [Gradle's Dependency Verification Metadata](https://docs.renovatebot.com/modules/manager/gradle/#dependency-verification) when updating Gradle dependencies.
As of Renovate 43, this long-standing risk is disabled by default to make Renovate more "secure by default".
Self-hosted administrators can re-enable this using the global self-hosted configuration [`allowedUnsafeExecutions`](https://docs.renovatebot.com/self-hosted-configuration/#allowedunsafeexecutions).
##### `postUpgradeTasks` will no longer run with `shell` mode by default [#​40230](https://github.com/renovatebot/renovate/issues/40230)
As noted in [#​40403](https://github.com/renovatebot/renovate/issues/40403) and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.
The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover `postUpgradeTasks`, which are allowlisted by a self-hosted administrator.
To provide a safer default, commands that run through `postUpgradeTasks` will no longer run inside a shell.
Self-hosted administrators can re-enable this using the global self-hosted configuration [`allowShellExecutorForPostUpgradeCommands=true`](https://docs.renovatebot.com/self-hosted-configuration/#allowshellexecutorforpostupgradecommands).
##### `binarySource=docker` is officially deprecated [#​40735](https://github.com/renovatebot/renovate/issues/40735)
As noted in [#​40747](https://github.com/renovatebot/renovate/issues/40747), we have now officially deprecated the `binarySource=docker` option.
There is no timeline decided on the removal of the functionality.
For more details and/or to provide feedback on your use case and why `binarySource=install` does not work for you, please see [#​40747](https://github.com/renovatebot/renovate/issues/40747).
##### Renovate now ships as ESM (ECMAScript Modules) [#​9890](https://github.com/renovatebot/renovate/issues/9890) / [#​40756](https://github.com/renovatebot/renovate/issues/40756)
This should not affect users, only cases where Renovate is imported as a library. Given our previous support of Node 22, ESM can still be imported from Common JS (CJS) files.
Out of caution and for visibility, this is part of the major release.
##### `config:best-practices` will now perform weekly lockfile maintenance [#​40735](https://github.com/renovatebot/renovate/issues/40735)
As part of the Renovate maintainers' opinionated "best practices" configuration, Renovate will now perform a weekly lockfile maintenance task, keeping your lockfiles updated.
This is due to an increase in package managers using lock files, but users not necessarily being aware of the need to enable this explicitly.
If this is not applicable to you, you can use [`ignorePresets`](https://docs.renovatebot.com/configuration-options/#ignorepresets), i.e.
```json
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:best-practices"
],
"ignorePresets": [
":maintainLockFilesWeekly"
]
}
```
##### JSON Schema split for repo or global configuration [#​38619](https://github.com/renovatebot/renovate/issues/38619)
Renovate now has separate JSON Schemas for repository configuration, repository configuration (and inherit config) for writing `org-inherited-config.json`, and global self-hosted configuration:
- <https://docs.renovatebot.com/renovate-schema.json> ([repository configuration](https://docs.renovatebot.com/configuration-options/))
- <https://docs.renovatebot.com/renovate-global-schema.json> ([global self-hosted configuration](https://docs.renovatebot.com/self-hosted-configuration/))
- <https://docs.renovatebot.com/renovate-inherited-schema.json> (repository configuration, including [inherited config options](https://docs.renovatebot.com/config-overview/#inherited-config))
This provides better validation for your editor/agent, as you now only see documentation for the relevant configuration type you're writing.
You can read more [in the Renovate JSON Schema documentation](https://docs.renovatebot.com/json-schema/).
This does not affect `renovate-config-validator`.
##### Replacements cannot be grouped with other updates [#​40758](https://github.com/renovatebot/renovate/issues/40758)
To prevent replacements being grouped in with other updates, which can sometimes lead to them failing to correctly replace a package, they will no longer be grouped.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
##### Lock file maintenance cannot be grouped with other updates [#​40781](https://github.com/renovatebot/renovate/issues/40781)
To prevent [lock file maintenance](https://docs.renovatebot.com/configuration-options/#lockfilemaintenance) being grouped in with other updates, which can sometimes lead to them failing to perform the lock file maintenance.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
##### Use `wasm-java` build of Bouncy Castle [#​40678](https://github.com/renovatebot/renovate/issues/40678)
To improve performance for encryption/decryption of secrets, as well as [supporting AEAD](https://github.com/renovatebot/renovate/discussions/28934), we have moved the default Bouncy Castle build to use `wasm-java`.
##### Renovate now requires a minimum of Node 24 [#​40675](https://github.com/renovatebot/renovate/issues/40675)
The existing requirements of Node 24.11.0 has not changed.
This only drops support for Node 22.x.
##### Package name for Node.JS in Mise has changed to `node` [#​40466](https://github.com/renovatebot/renovate/issues/40466)
To be more consistent with other package managers, the Node.JS package has been renamed to `node`.
This ensures that updates to NodeJS (when using [Mise](https://docs.renovatebot.com/modules/manager/mise/)) are grouped with other package updates.
##### The [`useCloudMetadataServices`](https://docs.renovatebot.com/self-hosted-configuration/#usecloudmetadataservices) configuration is now environment variable only [#​40638](https://github.com/renovatebot/renovate/issues/40638)
As a first step towards solving [#​38604](https://github.com/renovatebot/renovate/issues/38604), we have migrated this configuration option to being environment variable configuration only.
Note that *technically* Renovate will still detect it if it's set in a `config.js`, but with changes in [#​38604](https://github.com/renovatebot/renovate/issues/38604) it will not affect the execution.
##### Default tool version updates [#​39100](https://github.com/renovatebot/renovate/issues/39100)
For users of the upstream Renovate container images, the following tools have been updated to new major versions:
| Tool | Version |
| ------- | -------- |
| Bundler | 4.0.4 |
| Dotnet | 10.0.102 |
| Helm | v4.1.0 |
| PHP | 8.5.2 |
| Pipenv | 2026.0.3 |
| Ruby | 4.0.1 |
#### Commentary for 43
There aren't any big changes as part of this release to call out - this is a fairly "routine" major version, where we're doing a little cleanup, making some improvements to be "secure by default", and updating our default tool versions.
#### Deprecations
As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 44:
- [Removal of `x-access-token:` prefix for GitHub](https://github.com/renovatebot/renovate/issues/38952)
##### ⚠ BREAKING CHANGES
- **deps:** Update ghcr.io/renovatebot/base-image Docker tag to v13 (main) ([#​40730](https://github.com/renovatebot/renovate/issues/40730))
- prevent grouping of lockfile maintenance updates ([#​40781](https://github.com/renovatebot/renovate/issues/40781))
- Switch to ESM modules ([#​40756](https://github.com/renovatebot/renovate/issues/40756))
- prevent grouping of replacement updates ([#​40758](https://github.com/renovatebot/renovate/issues/40758))
- **config:** deprecate `binarySource=docker` ([#​40754](https://github.com/renovatebot/renovate/issues/40754))
- **presets:** add `maintainLockFilesWeekly` to `best-practices` preset ([#​40735](https://github.com/renovatebot/renovate/issues/40735))
- **config:** make `useCloudMetadataServices` environment-only ([#​40638](https://github.com/renovatebot/renovate/issues/40638))
- **self-hosted:** don't allow any unsafe commands by default ([#​40684](https://github.com/renovatebot/renovate/issues/40684))
- **self-hosted:** don't use `shell: true` for `postUpgradeTasks` ([#​40230](https://github.com/renovatebot/renovate/issues/40230))
- **json-schema:** forbid global-only options in repo configuration ([#​38619](https://github.com/renovatebot/renovate/issues/38619))
- **presets:** add `hostType=github` to `:githubComToken` ([#​38975](https://github.com/renovatebot/renovate/issues/38975))
- use `wasm-java` build of Bouncy Castle ([#​40678](https://github.com/renovatebot/renovate/issues/40678))
- **mise:** rename packageName from `nodejs` to `node` ([#​40466](https://github.com/renovatebot/renovate/issues/40466))
- require node v24 ([#​40675](https://github.com/renovatebot/renovate/issues/40675))
##### Features
- **config:** deprecate `binarySource=docker` ([#​40754](https://github.com/renovatebot/renovate/issues/40754)) ([3644ac8](https://github.com/renovatebot/renovate/commit/3644ac89d0e255cf008a61693696fc93d1040d75)), closes [#​40747](https://github.com/renovatebot/renovate/issues/40747)
- **deps:** Update ghcr.io/renovatebot/base-image Docker tag to v13 (main) ([#​40730](https://github.com/renovatebot/renovate/issues/40730)) ([5a2107d](https://github.com/renovatebot/renovate/commit/5a2107d5c77081879551b97970b21b7ccaf29ef4))
- **presets:** add `hostType=github` to `:githubComToken` ([#​38975](https://github.com/renovatebot/renovate/issues/38975)) ([0d912db](https://github.com/renovatebot/renovate/commit/0d912db883142ae365a97d95fce02f660aebbe05)), closes [#​38961](https://github.com/renovatebot/renovate/issues/38961)
- **presets:** add `maintainLockFilesWeekly` to `best-practices` preset ([#​40735](https://github.com/renovatebot/renovate/issues/40735)) ([28dccba](https://github.com/renovatebot/renovate/commit/28dccbaf9f4f3aecd562ba09dcfe9470a0c0e6d5))
- require node v24 ([#​40675](https://github.com/renovatebot/renovate/issues/40675)) ([dcdd1c3](https://github.com/renovatebot/renovate/commit/dcdd1c3bce2ed451db7b6d2806c3064d2d5bfcbd))
- Switch to ESM modules ([#​40756](https://github.com/renovatebot/renovate/issues/40756)) ([2b0e80b](https://github.com/renovatebot/renovate/commit/2b0e80b884543cf2bdfb96ca49b1b51adec068ad))
- use `wasm-java` build of Bouncy Castle ([#​40678](https://github.com/renovatebot/renovate/issues/40678)) ([4e19e7c](https://github.com/renovatebot/renovate/commit/4e19e7c122f04baf017ef48cc06317eaa3812c5d))
##### Bug Fixes
- **config:** make `useCloudMetadataServices` environment-only ([#​40638](https://github.com/renovatebot/renovate/issues/40638)) ([a630187](https://github.com/renovatebot/renovate/commit/a6301877c6abb58370a087367905a7c3afa82564)), closes [#​38604](https://github.com/renovatebot/renovate/issues/38604)
- **mise:** rename packageName from `nodejs` to `node` ([#​40466](https://github.com/renovatebot/renovate/issues/40466)) ([8dc1133](https://github.com/renovatebot/renovate/commit/8dc1133ebeab592d5fda7f5c9fef5222ca8543f5))
- prevent grouping of lockfile maintenance updates ([#​40781](https://github.com/renovatebot/renovate/issues/40781)) ([3ed1817](https://github.com/renovatebot/renovate/commit/3ed1817e2b454f2d0a93b478004404a06a5ec1a2))
- prevent grouping of replacement updates ([#​40758](https://github.com/renovatebot/renovate/issues/40758)) ([c7222c6](https://github.com/renovatebot/renovate/commit/c7222c643d4963f27db2d370557a666ea44d17b7))
- **self-hosted:** don't allow any unsafe commands by default ([#​40684](https://github.com/renovatebot/renovate/issues/40684)) ([b6ef3e1](https://github.com/renovatebot/renovate/commit/b6ef3e129034592659335064a0c986de2ce8e1a6))
- **self-hosted:** don't use `shell: true` for `postUpgradeTasks` ([#​40230](https://github.com/renovatebot/renovate/issues/40230)) ([cb49754](https://github.com/renovatebot/renovate/commit/cb4975439112166f1ddef8ba4f972516b90fa14e))
##### Documentation
- add announcement bar for v43 ([93423cf](https://github.com/renovatebot/renovate/commit/93423cfafe8914883cc1a9b0040b1e9d9da18dcc))
##### Miscellaneous Chores
- **json-schema:** forbid global-only options in repo configuration ([#​38619](https://github.com/renovatebot/renovate/issues/38619)) ([192ae36](https://github.com/renovatebot/renovate/commit/192ae368fae5b27812dd6289696b928bf9049af9)), closes [#​38728](https://github.com/renovatebot/renovate/issues/38728)
- use `updateType` in log message ([d1e3f13](https://github.com/renovatebot/renovate/commit/d1e3f13874a4505a2926eb76f25b74529509c0b8))
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuOTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGV2b3BzL3Jlbm92YXRlLWNvbmZpZyJdfQ==-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
42.99.0→43.15.0Release Notes
renovatebot/renovate (ghcr.io/renovatebot/renovate)
v43.15.0Compare Source
Features
v43.14.2Compare Source
Bug Fixes
Miscellaneous Chores
lockFileNameswhensupportsLockFileMaintenance=true(#41175) (91015a7)v43.14.1Compare Source
Bug Fixes
v43.14.0Compare Source
Features
v43.13.0Compare Source
Features
Miscellaneous Chores
v43.12.1Compare Source
Documentation
Build System
v43.12.0Compare Source
Features
Miscellaneous Chores
v43.11.1Compare Source
Bug Fixes
Miscellaneous Chores
Tests
v43.11.0Compare Source
Features
jsconfig.jsonfiles (#41148) (b826167)v43.10.4Compare Source
Bug Fixes
Miscellaneous Chores
v43.10.3Compare Source
Bug Fixes
Documentation
supportsLockFileMaintenanceflag (#41134) (5c38220)Miscellaneous Chores
Code Refactoring
v43.10.2Compare Source
Bug Fixes
Miscellaneous Chores
v43.10.1Compare Source
Build System
v43.10.0Compare Source
Features
Miscellaneous Chores
v43.9.0Compare Source
Features
Miscellaneous Chores
v43.8.5Compare Source
Bug Fixes
Build System
v43.8.4Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v43.8.3Compare Source
Bug Fixes
Documentation
postUpdateOption(#39946) (8a9b805)Miscellaneous Chores
Continuous Integration
v43.8.2Compare Source
Build System
v43.8.1Compare Source
Bug Fixes
v43.8.0Compare Source
Features
v43.7.0Compare Source
Features
v43.6.3Compare Source
Miscellaneous Chores
Build System
v43.6.2Compare Source
Bug Fixes
v43.6.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.6.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
RENOVATE_VERSIONis passed tomkdocs(#40988) (7e073d7)Build System
v43.5.6Compare Source
Bug Fixes
v43.5.5Compare Source
Bug Fixes
inferfrom Zod (#41054) (acc1d3d)Miscellaneous Chores
v43.5.4Compare Source
Bug Fixes
v43.5.3Compare Source
Bug Fixes
Miscellaneous Chores
v43.5.2Compare Source
Miscellaneous Chores
Build System
v43.5.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.5.0Compare Source
Features
v43.4.5Compare Source
Miscellaneous Chores
Build System
v43.4.4Compare Source
Bug Fixes
Documentation
4b827ab(main) (#41007) (10b2d3a)Miscellaneous Chores
--versionflag (#40986) (f71db58)v43.4.3Compare Source
Bug Fixes
Miscellaneous Chores
v43.4.2Compare Source
Build System
v43.4.1Compare Source
Code Refactoring
Build System
v43.4.0Compare Source
Features
Documentation
toolSettingsparent option (#40951) (b566f4a)Miscellaneous Chores
Tests
v43.3.6Compare Source
Build System
v43.3.5Compare Source
Bug Fixes
v43.3.4Compare Source
Build System
v43.3.3Compare Source
Bug Fixes
Miscellaneous Chores
v43.3.2Compare Source
Bug Fixes
Miscellaneous Chores
v43.3.1Compare Source
Bug Fixes
Documentation
v43.3.0Compare Source
Features
v43.2.8Compare Source
Bug Fixes
Documentation
v43.2.7Compare Source
Build System
v43.2.6Compare Source
Bug Fixes
v43.2.5Compare Source
Bug Fixes
Miscellaneous Chores
v43.2.4Compare Source
Bug Fixes
v43.2.3Compare Source
Bug Fixes
v43.2.2Compare Source
Bug Fixes
Miscellaneous Chores
Build System
v43.2.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.2.0Compare Source
Features
github-digestdatasource (#40226) (c246f81)v43.1.0Compare Source
Features
--groupuv pip compile option (#40665) (2062788)v43.0.10Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v43.0.9Compare Source
Bug Fixes
v43.0.8Compare Source
Build System
v43.0.7Compare Source
Code Refactoring
Build System
v43.0.6Compare Source
Miscellaneous Chores
Build System
v43.0.5Compare Source
Bug Fixes
v43.0.4Compare Source
Bug Fixes
v43.0.3Compare Source
Bug Fixes
Miscellaneous Chores
prHourlyLimit(#39443) (991fdbf)v43.0.2Compare Source
Bug Fixes
Documentation
v43.0.1Compare Source
Bug Fixes
Documentation
v43.0.0Compare Source
Breaking changes for 43
Allowlisting required for "unsafe commands" #40684
Prior to Renovate 43, when performing updates in a repository that used Gradle, Renovate would execute the Gradle Wrapper (
./gradleworgradlew.bat).This is a well-documented "insider attack" risk that could lead to remote code execution in the context of the Renovate process, as execution of the Gradle buildscript:
This can occur during updates to the Gradle wrapper or using Gradle's Dependency Verification Metadata when updating Gradle dependencies.
As of Renovate 43, this long-standing risk is disabled by default to make Renovate more "secure by default".
Self-hosted administrators can re-enable this using the global self-hosted configuration
allowedUnsafeExecutions.postUpgradeTaskswill no longer run withshellmode by default #40230As noted in #40403 and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.
The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover
postUpgradeTasks, which are allowlisted by a self-hosted administrator.To provide a safer default, commands that run through
postUpgradeTaskswill no longer run inside a shell.Self-hosted administrators can re-enable this using the global self-hosted configuration
allowShellExecutorForPostUpgradeCommands=true.binarySource=dockeris officially deprecated #40735As noted in #40747, we have now officially deprecated the
binarySource=dockeroption.There is no timeline decided on the removal of the functionality.
For more details and/or to provide feedback on your use case and why
binarySource=installdoes not work for you, please see #40747.Renovate now ships as ESM (ECMAScript Modules) #9890 / #40756
This should not affect users, only cases where Renovate is imported as a library. Given our previous support of Node 22, ESM can still be imported from Common JS (CJS) files.
Out of caution and for visibility, this is part of the major release.
config:best-practiceswill now perform weekly lockfile maintenance #40735As part of the Renovate maintainers' opinionated "best practices" configuration, Renovate will now perform a weekly lockfile maintenance task, keeping your lockfiles updated.
This is due to an increase in package managers using lock files, but users not necessarily being aware of the need to enable this explicitly.
If this is not applicable to you, you can use
ignorePresets, i.e.JSON Schema split for repo or global configuration #38619
Renovate now has separate JSON Schemas for repository configuration, repository configuration (and inherit config) for writing
org-inherited-config.json, and global self-hosted configuration:This provides better validation for your editor/agent, as you now only see documentation for the relevant configuration type you're writing.
You can read more in the Renovate JSON Schema documentation.
This does not affect
renovate-config-validator.Replacements cannot be grouped with other updates #40758
To prevent replacements being grouped in with other updates, which can sometimes lead to them failing to correctly replace a package, they will no longer be grouped.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
Lock file maintenance cannot be grouped with other updates #40781
To prevent lock file maintenance being grouped in with other updates, which can sometimes lead to them failing to perform the lock file maintenance.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
Use
wasm-javabuild of Bouncy Castle #40678To improve performance for encryption/decryption of secrets, as well as supporting AEAD, we have moved the default Bouncy Castle build to use
wasm-java.Renovate now requires a minimum of Node 24 #40675
The existing requirements of Node 24.11.0 has not changed.
This only drops support for Node 22.x.
Package name for Node.JS in Mise has changed to
node#40466To be more consistent with other package managers, the Node.JS package has been renamed to
node.This ensures that updates to NodeJS (when using Mise) are grouped with other package updates.
The
useCloudMetadataServicesconfiguration is now environment variable only #40638As a first step towards solving #38604, we have migrated this configuration option to being environment variable configuration only.
Note that technically Renovate will still detect it if it's set in a
config.js, but with changes in #38604 it will not affect the execution.Default tool version updates #39100
For users of the upstream Renovate container images, the following tools have been updated to new major versions:
Commentary for 43
There aren't any big changes as part of this release to call out - this is a fairly "routine" major version, where we're doing a little cleanup, making some improvements to be "secure by default", and updating our default tool versions.
Deprecations
As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 44:
x-access-token:prefix for GitHub⚠ BREAKING CHANGES
binarySource=docker(#40754)maintainLockFilesWeeklytobest-practicespreset (#40735)useCloudMetadataServicesenvironment-only (#40638)shell: trueforpostUpgradeTasks(#40230)hostType=githubto:githubComToken(#38975)wasm-javabuild of Bouncy Castle (#40678)nodejstonode(#40466)Features
binarySource=docker(#40754) (3644ac8), closes #40747hostType=githubto:githubComToken(#38975) (0d912db), closes #38961maintainLockFilesWeeklytobest-practicespreset (#40735) (28dccba)wasm-javabuild of Bouncy Castle (#40678) (4e19e7c)Bug Fixes
useCloudMetadataServicesenvironment-only (#40638) (a630187), closes #38604nodejstonode(#40466) (8dc1133)shell: trueforpostUpgradeTasks(#40230) (cb49754)Documentation
Miscellaneous Chores
updateTypein log message (d1e3f13)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.