Update ghcr.io/renovatebot/renovate Docker tag to v43 #114
Reference in New Issue
Block a user
Delete Branch "renovate/ghcr.io-renovatebot-renovate-43.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
42.99.0→43.15.0Release Notes
renovatebot/renovate (ghcr.io/renovatebot/renovate)
v43.15.0Compare Source
Features
v43.14.2Compare Source
Bug Fixes
Miscellaneous Chores
lockFileNameswhensupportsLockFileMaintenance=true(#41175) (91015a7)v43.14.1Compare Source
Bug Fixes
v43.14.0Compare Source
Features
v43.13.0Compare Source
Features
Miscellaneous Chores
v43.12.1Compare Source
Documentation
Build System
v43.12.0Compare Source
Features
Miscellaneous Chores
v43.11.1Compare Source
Bug Fixes
Miscellaneous Chores
Tests
v43.11.0Compare Source
Features
jsconfig.jsonfiles (#41148) (b826167)v43.10.4Compare Source
Bug Fixes
Miscellaneous Chores
v43.10.3Compare Source
Bug Fixes
Documentation
supportsLockFileMaintenanceflag (#41134) (5c38220)Miscellaneous Chores
Code Refactoring
v43.10.2Compare Source
Bug Fixes
Miscellaneous Chores
v43.10.1Compare Source
Build System
v43.10.0Compare Source
Features
Miscellaneous Chores
v43.9.0Compare Source
Features
Miscellaneous Chores
v43.8.5Compare Source
Bug Fixes
Build System
v43.8.4Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v43.8.3Compare Source
Bug Fixes
Documentation
postUpdateOption(#39946) (8a9b805)Miscellaneous Chores
Continuous Integration
v43.8.2Compare Source
Build System
v43.8.1Compare Source
Bug Fixes
v43.8.0Compare Source
Features
v43.7.0Compare Source
Features
v43.6.3Compare Source
Miscellaneous Chores
Build System
v43.6.2Compare Source
Bug Fixes
v43.6.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.6.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
RENOVATE_VERSIONis passed tomkdocs(#40988) (7e073d7)Build System
v43.5.6Compare Source
Bug Fixes
v43.5.5Compare Source
Bug Fixes
inferfrom Zod (#41054) (acc1d3d)Miscellaneous Chores
v43.5.4Compare Source
Bug Fixes
v43.5.3Compare Source
Bug Fixes
Miscellaneous Chores
v43.5.2Compare Source
Miscellaneous Chores
Build System
v43.5.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.5.0Compare Source
Features
v43.4.5Compare Source
Miscellaneous Chores
Build System
v43.4.4Compare Source
Bug Fixes
Documentation
4b827ab(main) (#41007) (10b2d3a)Miscellaneous Chores
--versionflag (#40986) (f71db58)v43.4.3Compare Source
Bug Fixes
Miscellaneous Chores
v43.4.2Compare Source
Build System
v43.4.1Compare Source
Code Refactoring
Build System
v43.4.0Compare Source
Features
Documentation
toolSettingsparent option (#40951) (b566f4a)Miscellaneous Chores
Tests
v43.3.6Compare Source
Build System
v43.3.5Compare Source
Bug Fixes
v43.3.4Compare Source
Build System
v43.3.3Compare Source
Bug Fixes
Miscellaneous Chores
v43.3.2Compare Source
Bug Fixes
Miscellaneous Chores
v43.3.1Compare Source
Bug Fixes
Documentation
v43.3.0Compare Source
Features
v43.2.8Compare Source
Bug Fixes
Documentation
v43.2.7Compare Source
Build System
v43.2.6Compare Source
Bug Fixes
v43.2.5Compare Source
Bug Fixes
Miscellaneous Chores
v43.2.4Compare Source
Bug Fixes
v43.2.3Compare Source
Bug Fixes
v43.2.2Compare Source
Bug Fixes
Miscellaneous Chores
Build System
v43.2.1Compare Source
Bug Fixes
Miscellaneous Chores
v43.2.0Compare Source
Features
github-digestdatasource (#40226) (c246f81)v43.1.0Compare Source
Features
--groupuv pip compile option (#40665) (2062788)v43.0.10Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v43.0.9Compare Source
Bug Fixes
v43.0.8Compare Source
Build System
v43.0.7Compare Source
Code Refactoring
Build System
v43.0.6Compare Source
Miscellaneous Chores
Build System
v43.0.5Compare Source
Bug Fixes
v43.0.4Compare Source
Bug Fixes
v43.0.3Compare Source
Bug Fixes
Miscellaneous Chores
prHourlyLimit(#39443) (991fdbf)v43.0.2Compare Source
Bug Fixes
Documentation
v43.0.1Compare Source
Bug Fixes
Documentation
v43.0.0Compare Source
Breaking changes for 43
Allowlisting required for "unsafe commands" #40684
Prior to Renovate 43, when performing updates in a repository that used Gradle, Renovate would execute the Gradle Wrapper (
./gradleworgradlew.bat).This is a well-documented "insider attack" risk that could lead to remote code execution in the context of the Renovate process, as execution of the Gradle buildscript:
This can occur during updates to the Gradle wrapper or using Gradle's Dependency Verification Metadata when updating Gradle dependencies.
As of Renovate 43, this long-standing risk is disabled by default to make Renovate more "secure by default".
Self-hosted administrators can re-enable this using the global self-hosted configuration
allowedUnsafeExecutions.postUpgradeTaskswill no longer run withshellmode by default #40230As noted in #40403 and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.
The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover
postUpgradeTasks, which are allowlisted by a self-hosted administrator.To provide a safer default, commands that run through
postUpgradeTaskswill no longer run inside a shell.Self-hosted administrators can re-enable this using the global self-hosted configuration
allowShellExecutorForPostUpgradeCommands=true.binarySource=dockeris officially deprecated #40735As noted in #40747, we have now officially deprecated the
binarySource=dockeroption.There is no timeline decided on the removal of the functionality.
For more details and/or to provide feedback on your use case and why
binarySource=installdoes not work for you, please see #40747.Renovate now ships as ESM (ECMAScript Modules) #9890 / #40756
This should not affect users, only cases where Renovate is imported as a library. Given our previous support of Node 22, ESM can still be imported from Common JS (CJS) files.
Out of caution and for visibility, this is part of the major release.
config:best-practiceswill now perform weekly lockfile maintenance #40735As part of the Renovate maintainers' opinionated "best practices" configuration, Renovate will now perform a weekly lockfile maintenance task, keeping your lockfiles updated.
This is due to an increase in package managers using lock files, but users not necessarily being aware of the need to enable this explicitly.
If this is not applicable to you, you can use
ignorePresets, i.e.JSON Schema split for repo or global configuration #38619
Renovate now has separate JSON Schemas for repository configuration, repository configuration (and inherit config) for writing
org-inherited-config.json, and global self-hosted configuration:This provides better validation for your editor/agent, as you now only see documentation for the relevant configuration type you're writing.
You can read more in the Renovate JSON Schema documentation.
This does not affect
renovate-config-validator.Replacements cannot be grouped with other updates #40758
To prevent replacements being grouped in with other updates, which can sometimes lead to them failing to correctly replace a package, they will no longer be grouped.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
Lock file maintenance cannot be grouped with other updates #40781
To prevent lock file maintenance being grouped in with other updates, which can sometimes lead to them failing to perform the lock file maintenance.
This may lead to some PRs being modified/created when you upgrade to this version of Renovate.
Use
wasm-javabuild of Bouncy Castle #40678To improve performance for encryption/decryption of secrets, as well as supporting AEAD, we have moved the default Bouncy Castle build to use
wasm-java.Renovate now requires a minimum of Node 24 #40675
The existing requirements of Node 24.11.0 has not changed.
This only drops support for Node 22.x.
Package name for Node.JS in Mise has changed to
node#40466To be more consistent with other package managers, the Node.JS package has been renamed to
node.This ensures that updates to NodeJS (when using Mise) are grouped with other package updates.
The
useCloudMetadataServicesconfiguration is now environment variable only #40638As a first step towards solving #38604, we have migrated this configuration option to being environment variable configuration only.
Note that technically Renovate will still detect it if it's set in a
config.js, but with changes in #38604 it will not affect the execution.Default tool version updates #39100
For users of the upstream Renovate container images, the following tools have been updated to new major versions:
Commentary for 43
There aren't any big changes as part of this release to call out - this is a fairly "routine" major version, where we're doing a little cleanup, making some improvements to be "secure by default", and updating our default tool versions.
Deprecations
As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 44:
x-access-token:prefix for GitHub⚠ BREAKING CHANGES
binarySource=docker(#40754)maintainLockFilesWeeklytobest-practicespreset (#40735)useCloudMetadataServicesenvironment-only (#40638)shell: trueforpostUpgradeTasks(#40230)hostType=githubto:githubComToken(#38975)wasm-javabuild of Bouncy Castle (#40678)nodejstonode(#40466)Features
binarySource=docker(#40754) (3644ac8), closes #40747hostType=githubto:githubComToken(#38975) (0d912db), closes #38961maintainLockFilesWeeklytobest-practicespreset (#40735) (28dccba)wasm-javabuild of Bouncy Castle (#40678) (4e19e7c)Bug Fixes
useCloudMetadataServicesenvironment-only (#40638) (a630187), closes #38604nodejstonode(#40466) (8dc1133)shell: trueforpostUpgradeTasks(#40230) (cb49754)Documentation
Miscellaneous Chores
updateTypein log message (d1e3f13)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.