Update ghcr.io/renovatebot/renovate Docker tag to v42 #299
Reference in New Issue
Block a user
Delete Branch "renovate/ghcr.io-renovatebot-renovate-42.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
41.173.1->42.26.11Release Notes
renovatebot/renovate (ghcr.io/renovatebot/renovate)
v42.26.11Compare Source
Bug Fixes
v42.26.10Compare Source
Bug Fixes
Continuous Integration
v42.26.9Compare Source
Bug Fixes
v42.26.8Compare Source
Bug Fixes
extractandlookup(#39611) (c1a8da0)Miscellaneous Chores
extractphase (#39614) (55a447e)v42.26.7Compare Source
Bug Fixes
v42.26.6Compare Source
Bug Fixes
Miscellaneous Chores
Code Refactoring
v42.26.5Compare Source
Bug Fixes
Continuous Integration
v42.26.4Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v42.26.3Compare Source
Build System
v42.26.2Compare Source
Bug Fixes
v42.26.1Compare Source
Bug Fixes
Documentation
binarySource=globalignores them (#39561) (70c1075)v42.26.0Compare Source
Features
Documentation
RENOVATE_GITHUB_COM_TOKENrequirement more clear (#39406) (6058acd), closes #37685 #39399Miscellaneous Chores
v42.25.3Compare Source
Bug Fixes
endpointis a global only option (#39579) (ad710ec)v42.25.2Compare Source
Bug Fixes
ignorePrAuthoris a global repo config (#39578) (0af7709)v42.25.1Compare Source
Bug Fixes
v42.25.0Compare Source
Features
Tests
v42.24.1Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
--version(#39564) (591c578), closes #38796generateSchema(#39563) (b78764c)v42.24.0Compare Source
Features
markdownlint-cli2(#39569) (b061408), closes #39540Miscellaneous Chores
Code Refactoring
v42.23.0Compare Source
Features
tasksnotbugs(#39565) (d226777)Bug Fixes
v42.22.1Compare Source
Miscellaneous Chores
Build System
v42.22.0Compare Source
Features
prBodyHeadingDefinitons(#39460) (61c943c)v42.21.4Compare Source
Build System
v42.21.3Compare Source
Bug Fixes
v42.21.2Compare Source
Bug Fixes
Miscellaneous Chores
v42.21.1Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v42.21.0Compare Source
Features
v42.20.1Compare Source
Bug Fixes
Miscellaneous Chores
v42.20.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
v42.19.10Compare Source
Bug Fixes
v42.19.9Compare Source
Bug Fixes
prCreationonsecurity:minimumReleaseAgeNpm(#39536) (58612b9), closes #39525 #39477 #39066 #39066 #39116 #38873 #39066v42.19.8Compare Source
Build System
v42.19.7Compare Source
Bug Fixes
poetry-corebuild dependency (#39482) (0d40c5a)Documentation
0 daysis treated asnull(#39495) (a216ed1), closes #39494Build System
v42.19.6Compare Source
Documentation
Miscellaneous Chores
gotmajor updates to incrementally upgrade (#39508) (5d2f3fd)Build System
v42.19.5Compare Source
Bug Fixes
minimumReleaseAge=0 daysas disabled (#39494) (bbc27b2)Miscellaneous Chores
v42.19.4Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
edf6433(main) (#39486) (35252e2)Tests
v42.19.3Compare Source
Bug Fixes
v42.19.2Compare Source
Bug Fixes
v42.19.1Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
Continuous Integration
v42.19.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
v42.18.0Compare Source
Features
Continuous Integration
v42.17.1Compare Source
Bug Fixes
Miscellaneous Chores
v42.17.0Compare Source
Features
Miscellaneous Chores
Continuous Integration
v42.16.1Compare Source
Bug Fixes
lockFileMaintenanceandreplacement(#39409) (02ea30e)Miscellaneous Chores
v42.16.0Compare Source
Features
v42.15.1Compare Source
Bug Fixes
replacements to not be governed byminimumReleaseAge(#39401) (90e2e79), closes #39400 #39400Documentation
replacementandlockFileMaintenancesupport (#39402) (0d158e1), closes #39354v42.15.0Compare Source
Features
v42.14.4Compare Source
Bug Fixes
Miscellaneous Chores
v42.14.3Compare Source
Bug Fixes
Documentation
useBaseBranchConfig(#39381) (177e187)Miscellaneous Chores
183714e(main) (#39388) (3682b04)6942ebe(main) (#39392) (1b8ad31)8e46826(main) (#39386) (35bf7b1)prNotPendingHours(#39287) (2f2f2ea)Code Refactoring
Continuous Integration
v42.14.2Compare Source
Bug Fixes
Miscellaneous Chores
Tests
Continuous Integration
pageNumber(#39377) (0bcb7e3)v42.14.1Compare Source
Bug Fixes
steps:spec (#39370) (d25faf5)v42.14.0Compare Source
Features
releaseTimestamp(#39321) (d09a6ae)Documentation
Miscellaneous Chores
29f6dd6(main) (#39376) (ccc110b)v42.13.5Compare Source
Bug Fixes
v42.13.4Compare Source
Build System
v42.13.3Compare Source
Miscellaneous Chores
Build System
v42.13.2Compare Source
Bug Fixes
Documentation
Continuous Integration
v42.13.0Compare Source
Features
Bug Fixes
Documentation
Continuous Integration
v42.12.1Compare Source
Bug Fixes
Continuous Integration
v42.12.0Compare Source
Features
Bug Fixes
sponsorsin project name mixup (#39225) (7a01aa4)Documentation
Miscellaneous Chores
Build System
Continuous Integration
v42.11.0Compare Source
Features
Miscellaneous Chores
v42.10.5Compare Source
Bug Fixes
Miscellaneous Chores
v42.10.4Compare Source
Bug Fixes
v42.10.3Compare Source
Miscellaneous Chores
Build System
v42.10.2Compare Source
Bug Fixes
Documentation
Tests
v42.10.1Compare Source
Build System
v42.10.0Compare Source
Features
Miscellaneous Chores
v42.9.2Compare Source
Miscellaneous Chores
Build System
v42.9.1Compare Source
Bug Fixes
global:presets outside of global configuration (#39211) (7092644)v42.9.0Compare Source
Features
Bug Fixes
npmpreset file (#39282) (1bbc079), closes #38310v42.8.1Compare Source
Bug Fixes
updatePrandcreatePr(#39015) (84633f1)v42.8.0Compare Source
Features
v42.7.1Compare Source
Bug Fixes
Documentation
Miscellaneous Chores
v42.7.0Compare Source
Features
Bug Fixes
Miscellaneous Chores
Tests
v42.6.3Compare Source
Bug Fixes
Miscellaneous Chores
v42.6.2Compare Source
Miscellaneous Chores
e6b1f70(main) (#39247) (9344234)Build System
v42.6.1Compare Source
Build System
v42.6.0Compare Source
Features
v42.5.4Compare Source
Bug Fixes
v42.5.3Compare Source
Bug Fixes
v42.5.2Compare Source
Bug Fixes
Miscellaneous Chores
v42.5.1Compare Source
Bug Fixes
Miscellaneous Chores
v42.5.0Compare Source
Features
Miscellaneous Chores
Build System
v42.4.1Compare Source
Bug Fixes
Documentation
Code Refactoring
v42.4.0Compare Source
Features
Miscellaneous Chores
v42.3.0Compare Source
Features
Documentation
Miscellaneous Chores
97aa8cc(main) (#39192) (741b028)v42.2.0Compare Source
Features
Miscellaneous Chores
Build System
v42.1.3Compare Source
Bug Fixes
Build System
v42.1.2Compare Source
Bug Fixes
v42.1.1Compare Source
Bug Fixes
v42.1.0Compare Source
Features
uv pip compileoptions (#39167) (0b02c42)Code Refactoring
Build System
Continuous Integration
v42.0.3Compare Source
Bug Fixes
Documentation
v42.0.2Compare Source
Bug Fixes
Miscellaneous Chores
v42.0.1Compare Source
Documentation
Miscellaneous Chores
Build System
v42.0.0Compare Source
Breaking changes for 42
Using
minimumReleaseAgewill now require a release timestamp #38843When specifying
minimumReleaseAge, Renovate will look for a release timestamp to determine the age of the release, and whether it matched theminimumReleaseAgeconfiguration.Before Renovate 42, if a release timestamp was not present, Renovate would treat the dependency update as if the release timestamp was present and the dependency had passed that lifetime.
This means that users with artifact proxies, or in cases that the release timestamp wasn't consistently present could lead to dependencies "slipping through", and being updated before Renovate's policy enforced it to.
As of Renovate 42, the configuration
minimumReleaseAgeBehaviour(added in 41.150.0) requires the release timestamp to be present.If the release timestamp isn't present, Renovate will mark it as "awaiting schedule", and will output a debug log message to explain why.
You can revert to the existing behaviour by setting
minimumReleaseAgeBehaviour=timestamp-optional.Note that not all datasources support this functionality, nor do custom registries (such as Artifactory, etc).
For more details on how to verify support for your repository, check out the Minimum Release Age documentation
minimumReleaseAge: 3 dayswill now be set by default for npm inconfig:best-practices#37967For users of
config:best-practices, the Minimum Release Age functionality will now apply by default for the npm ecosystem.This will introduce a delay of 3 days between package publishing and Renovate suggesting an update for the release, so:
This will be enforced by default for packages using the
npmdatasource via thesecurity:minimumReleaseAgeNpmpreset.For more details on this functionality, check out the Minimum Release Age documentation.
Renovate now defaults to using Node.JS 24 #38939
With Node 24 now in Long Term Support (LTS) release status, we have moved to target Node.JS 24 (
^24.11.0) as our default engine for Node, and retain support for Node 22.The pre-built Docker containers have been updated to use Node 24.
If you self-host without using our Docker image, you should be able to continue running Renovate with Node 22, for instance if you build your own image, or run the
renovatenpm package.Redis clusters now authenticate to all nodes in the cluster with the provided credentials
When running Renovate against a Redis cluster with authentication, it was possible that a
NOAUTH Authentication requirederror may appear:Renovate will now use the same authentication for all nodes in a cluster.
Support Yarn Catalogs #38215
We now support the official Yarn Catalog functionality.
As part of this, we have removed support for the yarn-plugin-catalogs community plugin.
If you are using the yarn-plugin-catalogs community plugin, you will need to migrate your catalogs to the official Yarn Catalog functionality before Renovate 42 will update your dependencies.
Remove versioning modules needing to implement
rangeStrategy=pin#36261This is an internal refactor to make it easier for creating and maintaining versioning modules.
This should not be a non-breaking change, as the versioning modules will have defaults available.
However, we're releasing it as part of this major release, and highlighting it, in case it does lead to breaking changes.
PGP encryption is now performed using Bouncy Castle #39032
GPG encryption is no longer performed using
kbpgpKeybase's PGP for JavaScript), and has been replaced with a Bouncy Castle version.Some users have found license compliance issues with the
kbpgppackage, so this will now resolve them.Legacy RSA encryption has been removed #39111
Deprecated since 37.315.0 (2024-04-21), the legacy RSA encryption is now no longer available.
Change to the default User Agent #37535
The
user-agentheader for Renovate's outgoing HTTP calls has changed the default toRenovate/${version}.Default tool version updates #39100
For users of the upstream Renovate container images, the following tools have been updated to new major versions:
Commentary for 42
Focus on
minimumReleaseAgeYou'll notice that there are a number of big features here - and in recent minor releases - that focus on Minimum Release Age.
With recent supply chain attacks, the Renovate team have been hard at work improving the support we've had in Renovate (since 2019!) for this functionality, and making it as predictable as possible, so we can then enable it by default for users of
config:best-practices.You can read more about this focus in a blog post we've written on the Mend blog.
We're starting with the enabling of the
npmdatasource, but will look to extend this functionality in future major releases, based on community feedback, and ecosystem support.Deprecations
As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 43:
renovate-schema.jsonwill only support repository configuration, and a separaterenovate-admin-schema.jsonwill be needed for global/self-hosted configuration42.0.0 (2025-11-06)
⚠ BREAKING CHANGES
minimumReleaseAgefor npm (#37967)Features
minimumReleaseAgefor npm (#37967) (e371de1), closes #37952kbpgpwithbcpgp(#39032) (6de0097)Bug Fixes
Code Refactoring
Build System
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.