infrastructure/renovate-config

Fork 0

chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43 #254

Open

renovate-bot wants to merge 1 commit from renovate/ghcr.io-renovatebot-renovate-43.x into main

renovate-bot commented

2026-01-31 00:05:25 +00:00

Member

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/renovatebot/renovate (source)	container	major	`42.92.4` → `43.0.6`

Release Notes

renovatebot/renovate (ghcr.io/renovatebot/renovate)

`v43.0.6`

Compare Source

Miscellaneous Chores

deps: update actions/cache action to v5 (main) (#40820) (eb7d33c)
deps: update containerbase/internal-tools action to v4.0.4 (main) (#40819) (fb0a354)
deps: update dependency @types/node to v24 (main) (#40821) (5997152)
deps: update dependency eslint-formatter-gha to v2 (main) (#40822) (6064667)
deps: update dependency globals to v17 (main) (#40823) (ac23ffc)
deps: update dependency renovatebot/github-action to v46 (main) (#40814) (48de4a1)
deps: update renovate/renovate docker tag to v43 (main) (#40807) (b44d3d5)

Build System

trim channel for docker builds (#40818) (e004f84)

`v43.0.5`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v13.1.8 (main) (#40803) (a73b6e1)

`v43.0.4`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v13.1.7 (main) (#40801) (2b958f3)

`v43.0.3`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v13.1.6 (main) (#40795) (7394478)

Miscellaneous Chores

onboarding: capitalise the prHourlyLimit (#39443) (991fdbf)

`v43.0.2`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v13.1.5 (main) (#40793) (00a1006)

Documentation

mise: Fix invalid configuration example (#40792) (24ae070)

`v43.0.1`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v13.1.4 (main) (#40788) (1e4f4d3)

Documentation

opentelemetry: revamp documentation (#40765) (18c7915), closes #40126

`v43.0.0`

Compare Source

Breaking changes for 43

Allowlisting required for "unsafe commands" #40684

[!NOTE]
This should only affect you if you work with repositories that have a Gradle Wrapper.

Prior to Renovate 43, when performing updates in a repository that used Gradle, Renovate would execute the Gradle Wrapper (./gradlew or gradlew.bat).

This is a well-documented "insider attack" risk that could lead to remote code execution in the context of the Renovate process, as execution of the Gradle buildscript:

is controlled by the anyone with write access to the repository being processed
can look for specific tasks to execute specific code
can execute code from source-tracked scripts
can execute code from third-party libraries

This can occur during updates to the Gradle wrapper or using Gradle's Dependency Verification Metadata when updating Gradle dependencies.

As of Renovate 43, this long-standing risk is disabled by default to make Renovate more "secure by default".

Self-hosted administrators can re-enable this using the global self-hosted configuration allowedUnsafeExecutions.

`postUpgradeTasks` will no longer run with `shell` mode by default #40230

As noted in #40403 and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands.

The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover postUpgradeTasks, which are allowlisted by a self-hosted administrator.

To provide a safer default, commands that run through postUpgradeTasks will no longer run inside a shell.

Self-hosted administrators can re-enable this using the global self-hosted configuration allowShellExecutorForPostUpgradeCommands=true.

`binarySource=docker` is officially deprecated #40735

As noted in #40747, we have now officially deprecated the binarySource=docker option.

There is no timeline decided on the removal of the functionality.

For more details and/or to provide feedback on your use case and why binarySource=install does not work for you, please see #40747.

Renovate now ships as ESM (ECMAScript Modules) #9890 / #40756

This should not affect users, only cases where Renovate is imported as a library. Given our previous support of Node 22, ESM can still be imported from Common JS (CJS) files.

Out of caution and for visibility, this is part of the major release.

`config:best-practices` will now perform weekly lockfile maintenance #40735

As part of the Renovate maintainers' opinionated "best practices" configuration, Renovate will now perform a weekly lockfile maintenance task, keeping your lockfiles updated.

This is due to an increase in package managers using lock files, but users not necessarily being aware of the need to enable this explicitly.

If this is not applicable to you, you can use ignorePresets, i.e.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices"
  ],
  "ignorePresets": [
    ":maintainLockFilesWeekly"
  ]
}

JSON Schema split for repo or global configuration #38619

Renovate now has separate JSON Schemas for repository configuration, repository configuration (and inherit config) for writing org-inherited-config.json, and global self-hosted configuration:

https://docs.renovatebot.com/renovate-schema.json (repository configuration)
https://docs.renovatebot.com/renovate-global-schema.json (global self-hosted configuration)
https://docs.renovatebot.com/renovate-inherited-schema.json (repository configuration, including inherited config options)

This provides better validation for your editor/agent, as you now only see documentation for the relevant configuration type you're writing.

You can read more in the Renovate JSON Schema documentation.

This does not affect renovate-config-validator.

Replacements cannot be grouped with other updates #40758

To prevent replacements being grouped in with other updates, which can sometimes lead to them failing to correctly replace a package, they will no longer be grouped.

This may lead to some PRs being modified/created when you upgrade to this version of Renovate.

Lock file maintenance cannot be grouped with other updates #40781

To prevent lock file maintenance being grouped in with other updates, which can sometimes lead to them failing to perform the lock file maintenance.

This may lead to some PRs being modified/created when you upgrade to this version of Renovate.

Use `wasm-java` build of Bouncy Castle #40678

To improve performance for encryption/decryption of secrets, as well as supporting AEAD, we have moved the default Bouncy Castle build to use wasm-java.

Renovate now requires a minimum of Node 24 #40675

The existing requirements of Node 24.11.0 has not changed.

This only drops support for Node 22.x.

Package name for Node.JS in Mise has changed to `node` #40466

To be more consistent with other package managers, the Node.JS package has been renamed to node.

This ensures that updates to NodeJS (when using Mise) are grouped with other package updates.

The `useCloudMetadataServices` configuration is now environment variable only #40638

As a first step towards solving #38604, we have migrated this configuration option to being environment variable configuration only.

Note that technically Renovate will still detect it if it's set in a config.js, but with changes in #38604 it will not affect the execution.

Default tool version updates #39100

For users of the upstream Renovate container images, the following tools have been updated to new major versions:

Tool	Version
Bundler	4.0.4
Dotnet	10.0.102
Helm	v4.1.0
PHP	8.5.2
Pipenv	2026.0.3
Ruby	4.0.1

Commentary for 43

There aren't any big changes as part of this release to call out - this is a fairly "routine" major version, where we're doing a little cleanup, making some improvements to be "secure by default", and updating our default tool versions.

Deprecations

As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 44:

Removal of x-access-token: prefix for GitHub

⚠ BREAKING CHANGES

deps: Update ghcr.io/renovatebot/base-image Docker tag to v13 (main) (#40730)
prevent grouping of lockfile maintenance updates (#40781)
Switch to ESM modules (#40756)
prevent grouping of replacement updates (#40758)
config: deprecate binarySource=docker (#40754)
presets: add maintainLockFilesWeekly to best-practices preset (#40735)
config: make useCloudMetadataServices environment-only (#40638)
self-hosted: don't allow any unsafe commands by default (#40684)
self-hosted: don't use shell: true for postUpgradeTasks (#40230)
json-schema: forbid global-only options in repo configuration (#38619)
presets: add hostType=github to :githubComToken (#38975)
use wasm-java build of Bouncy Castle (#40678)
mise: rename packageName from nodejs to node (#40466)
require node v24 (#40675)

Features

config: deprecate binarySource=docker (#40754) (3644ac8), closes #40747
deps: Update ghcr.io/renovatebot/base-image Docker tag to v13 (main) (#40730) (5a2107d)
presets: add hostType=github to :githubComToken (#38975) (0d912db), closes #38961
presets: add maintainLockFilesWeekly to best-practices preset (#40735) (28dccba)
require node v24 (#40675) (dcdd1c3)
Switch to ESM modules (#40756) (2b0e80b)
use wasm-java build of Bouncy Castle (#40678) (4e19e7c)

Bug Fixes

config: make useCloudMetadataServices environment-only (#40638) (a630187), closes #38604
mise: rename packageName from nodejs to node (#40466) (8dc1133)
prevent grouping of lockfile maintenance updates (#40781) (3ed1817)
prevent grouping of replacement updates (#40758) (c7222c6)
self-hosted: don't allow any unsafe commands by default (#40684) (b6ef3e1)
self-hosted: don't use shell: true for postUpgradeTasks (#40230) (cb49754)

Documentation

add announcement bar for v43 (93423cf)

Miscellaneous Chores

json-schema: forbid global-only options in repo configuration (#38619) (192ae36), closes #38728
use updateType in log message (d1e3f13)

`v42.95.2`

Compare Source

Bug Fixes

onboardingAutoCloseAge: don't allow higher inherited value than global (#40810) (ffb95ed)

Build System

trim channel for docker builds (cd27b1d)

`v42.95.1`

Compare Source

Bug Fixes

pnpm: don't update workspace when no pnpm-lock.yaml found (#40780) (0c49124), closes #40774

Miscellaneous Chores

deps: update containerbase/internal-tools action to v4.0.3 (main) (#40783) (b2e1382)

Continuous Integration

add auto reviewer (#40782) (e55ad44)

`v42.95.0`

Compare Source

Features

sidecar: use renovatebot/base-image instead of containerbase/sidecar (#40772) (cd0426b)

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.2 (main) (#40776) (dbe0cf7)

Build System

deps: update opentelemetry-js-contrib monorepo (main) (#40775) (a94398b)

`v42.94.7`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.2 (main) (#40773) (f1790af)

`v42.94.6`

Compare Source

Bug Fixes

gerrit: not cloning submodules (#40089) (5db0218)

`v42.94.5`

Compare Source

Bug Fixes

presets: dockerfile globs (#40770) (ca446fb)

`v42.94.4`

Compare Source

Build System

deps: update opentelemetry-js monorepo (main) (#40769) (e95089a)
deps: update opentelemetry-js monorepo to v2.5.0 (main) (#40768) (7c43e8f)

`v42.94.3`

Compare Source

Bug Fixes

override tar (#40766) (ce12e9f)

Miscellaneous Chores

add proper imports from azure-devops-node-api (#40762) (e36d080)
deps: update containerbase/internal-tools action to v4.0.2 (main) (#40767) (5ad49c3)
deps: update dependency tar to v7.5.7 [security] (main) (#40764) (cd2b768)
fix type import (#40760) (eaed53a)

Code Refactoring

use named simpleGit imports (#40759) (17a1bba)

`v42.94.2`

Compare Source

Bug Fixes

config/validation: show deprecationMsg as a warning if present (#40753) (e049e56)

Miscellaneous Chores

deps: update containerbase/internal-tools action to v4 (main) (#40750) (60d733a)

Code Refactoring

Remove decorators for ESM compatibility (#40736) (c07814c)

Tests

validation: add tests for custom deprecation messages (#40752) (0daf184)

`v42.94.1`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.1 (main) (#40749) (fa7e075)

Code Refactoring

tools: reduce noise in generate-imports script (#40186) (69fedef)

`v42.94.0`

Compare Source

Features

deps: update ghcr.io/renovatebot/base-image docker tag to v12.31.0 (main) (#40746) (ebfbcfd)

Bug Fixes

deps: update ghcr.io/containerbase/sidecar docker tag to v13.26.7 (main) (#40745) (592bf20)

Documentation

correct references to binarySource=install for Mend-hosted (#40740) (783002c)

Miscellaneous Chores

deps: update containerbase/internal-tools action to v3.15.0 (main) (#40732) (b0f4ec3)
deps: update dependency tar to v7.5.6 (main) (#40739) (f29e971)
deps: update ghcr.io/containerbase/devcontainer docker tag to v14.0.1 (main) (#40741) (67964c8)

`v42.93.1`

Compare Source

Bug Fixes

datasource/docker: treat empty string as no architecture (#40715) (1db6be0)

`v42.93.0`

Compare Source

Features

inherit support for onboardingAutoCloseAge (#40086) (c58c16f)

Documentation

json-schema: add separate documentation page (#40722) (1edb6c3), closes #40716

Miscellaneous Chores

deps: update containerbase/internal-tools action to v3.14.57 (main) (#40727) (95958c6)
replace URL.parse (#40703) (e958373)

`v42.92.14`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v12.30.4 (main) (#40721) (33b0fcd)

Code Refactoring

Extract decorator logic into standalone functions (#40710) (ad47fd2)
Remove constructor parameter properties (#40712) (c5b0a74)

`v42.92.13`

Compare Source

Bug Fixes

gradle-wrapper: don't execute when allowedUnsafeExecutions (#40719) (3e70904)

`v42.92.12`

Compare Source

Bug Fixes

workingDirTemplate must be relative to the repo root (#40068) (bde55d5)

`v42.92.11`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v12.30.3 (main) (#40711) (c72d818)

Miscellaneous Chores

deps: update dependency eslint-plugin-oxlint to v1.41.0 (main) (#40707) (4d8e18a)

Code Refactoring

Rewrite imports with .ts extensions (#40700) (930cf66)

`v42.92.10`

Compare Source

Bug Fixes

config/validation: handle platform-prefixed onboardingConfigFileName (#40619) (1b6c63a)
reconfigure: migrate before validating (#40647) (7eb1ee9)

Documentation

config-validation: note the behaviour of --no-global (#40584) (30b7421)

Miscellaneous Chores

deps: update dependency oxlint to v1.41.0 (main) (#40704) (dff788f)
deps: update github/codeql-action action to v4.32.0 (main) (#40705) (e73c6aa)
extract KubernetesResource schema for future broader usage (#40264) (a7ddfcc)
replace URL.resolve (#40702) (18bd321)

`v42.92.9`

Compare Source

Bug Fixes

sbt: consider html hrefs in absolute and root-relative format (#39464) (e5c2caa)

`v42.92.8`

Compare Source

Miscellaneous Chores

deps: update dependency typescript-eslint to v8.53.1 (main) (#40698) (3106c46)

Code Refactoring

replace nanoid with crypto.randomUUID (#40695) (5c796e1)

Build System

Switch to tsdown for .d.ts generation (#40696) (98d0b0f)

`v42.92.7`

Compare Source

Bug Fixes

json-schema: add a separate schema for Inherit Config (#40683) (0b42055)

`v42.92.6`

Compare Source

Bug Fixes

config: ensure that config options are immutable (#40682) (13869dd)
manager/bun: run bun from lock file directory (#40274) (cd044ee)

Miscellaneous Chores

deps: update linters to v1.40.0 (main) (#40688) (e52ee4f)

Build System

Switch to rolldown (#40686) (42103c5)

`v42.92.5`

Compare Source

Bug Fixes

deps: update ghcr.io/renovatebot/base-image docker tag to v12.30.2 (main) (#40687) (dfa3798)

Documentation

update references to renovate/renovate (main) (#40661) (3fe8d2c)

Miscellaneous Chores

deps: lock file maintenance (main) (#40662) (3f74931)
deps: switch to @renovatebot/good-enough-parser (#40623) (ae49b7a)
deps: update containerbase/internal-tools action to v3.14.56 (main) (#40663) (9c6abec)
deps: update dependency @containerbase/eslint-plugin to v1.1.28 (main) (#40664) (a8ccae6)
deps: update dependency @containerbase/eslint-plugin to v1.1.29 (main) (#40668) (8fd01c9)
deps: update dependency @containerbase/istanbul-reports-html to v1.1.27 (main) (#40666) (6ed83ca)
deps: update dependency @containerbase/semantic-release-pnpm to v1.3.16 (main) (#40667) (36fa3ea)
deps: update dependency memfs to v4.53.0 (main) (#40655) (22c7e88)
deps: update dependency memfs to v4.54.0 (main) (#40658) (fa2a2b9)
deps: update dependency memfs to v4.55.0 (main) (#40680) (acd533e)
deps: update dependency pnpm to v10.28.1 (main) (#40685) (d3e9ada)
deps: update dependency renovatebot/github-action to v44.2.6 (main) (#40671) (b5ef5ed)
deps: update vitest monorepo to v4.0.18 (main) (#40654) (c3c30bf)

Configuration

📅 Schedule: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ghcr.io/renovatebot/renovate](https://renovatebot.com) ([source](https://github.com/renovatebot/renovate)) | container | major | `42.92.4` → `43.0.6` | --- ### Release Notes <details> <summary>renovatebot/renovate (ghcr.io/renovatebot/renovate)</summary> ### [`v43.0.6`](https://github.com/renovatebot/renovate/releases/tag/43.0.6) [Compare Source](https://github.com/renovatebot/renovate/compare/43.0.5...43.0.6) ##### Miscellaneous Chores - **deps:** update actions/cache action to v5 (main) ([#40820](https://github.com/renovatebot/renovate/issues/40820)) ([eb7d33c](https://github.com/renovatebot/renovate/commit/eb7d33ce6fec532be4e61e31d3869bb657f09343)) - **deps:** update containerbase/internal-tools action to v4.0.4 (main) ([#40819](https://github.com/renovatebot/renovate/issues/40819)) ([fb0a354](https://github.com/renovatebot/renovate/commit/fb0a35494b57bc63226198ef74f6a8a77e7c5575)) - **deps:** update dependency [@types/node](https://github.com/types/node) to v24 (main) ([#40821](https://github.com/renovatebot/renovate/issues/40821)) ([5997152](https://github.com/renovatebot/renovate/commit/5997152f9d5d3c7b00ac7a191c58c27f61275687)) - **deps:** update dependency eslint-formatter-gha to v2 (main) ([#40822](https://github.com/renovatebot/renovate/issues/40822)) ([6064667](https://github.com/renovatebot/renovate/commit/60646676dd85caad3bc3eeb19bc734dbe92d9e15)) - **deps:** update dependency globals to v17 (main) ([#40823](https://github.com/renovatebot/renovate/issues/40823)) ([ac23ffc](https://github.com/renovatebot/renovate/commit/ac23ffcb964268f094e2dca28bda1de2bec4d05d)) - **deps:** update dependency renovatebot/github-action to v46 (main) ([#40814](https://github.com/renovatebot/renovate/issues/40814)) ([48de4a1](https://github.com/renovatebot/renovate/commit/48de4a122ae5f994ff876e2467a251744295abc6)) - **deps:** update renovate/renovate docker tag to v43 (main) ([#40807](https://github.com/renovatebot/renovate/issues/40807)) ([b44d3d5](https://github.com/renovatebot/renovate/commit/b44d3d5c6daeb130ae682fcb05dc7ad0de497df6)) ##### Build System - trim channel for docker builds ([#40818](https://github.com/renovatebot/renovate/issues/40818)) ([e004f84](https://github.com/renovatebot/renovate/commit/e004f84c58740610220e242299bbbbf044e89241)) ### [`v43.0.5`](https://github.com/renovatebot/renovate/releases/tag/43.0.5) [Compare Source](https://github.com/renovatebot/renovate/compare/43.0.4...43.0.5) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.8 (main) ([#40803](https://github.com/renovatebot/renovate/issues/40803)) ([a73b6e1](https://github.com/renovatebot/renovate/commit/a73b6e194f4a27aac6bdb105c3d00f4bbc4c9918)) ### [`v43.0.4`](https://github.com/renovatebot/renovate/releases/tag/43.0.4) [Compare Source](https://github.com/renovatebot/renovate/compare/43.0.3...43.0.4) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.7 (main) ([#40801](https://github.com/renovatebot/renovate/issues/40801)) ([2b958f3](https://github.com/renovatebot/renovate/commit/2b958f3ea626a3fdba61adf36e254c50e331ee74)) ### [`v43.0.3`](https://github.com/renovatebot/renovate/releases/tag/43.0.3) [Compare Source](https://github.com/renovatebot/renovate/compare/43.0.2...43.0.3) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.6 (main) ([#40795](https://github.com/renovatebot/renovate/issues/40795)) ([7394478](https://github.com/renovatebot/renovate/commit/73944783c256b1a1d838683499f7fefd6f7c5a4d)) ##### Miscellaneous Chores - **onboarding:** capitalise the `prHourlyLimit` ([#39443](https://github.com/renovatebot/renovate/issues/39443)) ([991fdbf](https://github.com/renovatebot/renovate/commit/991fdbfd6bc27b7f2fa20d572cf7e99aa2368d84)) ### [`v43.0.2`](https://github.com/renovatebot/renovate/releases/tag/43.0.2) [Compare Source](https://github.com/renovatebot/renovate/compare/43.0.1...43.0.2) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.5 (main) ([#40793](https://github.com/renovatebot/renovate/issues/40793)) ([00a1006](https://github.com/renovatebot/renovate/commit/00a100629934d8deebd5680f6b7189d76ccf022a)) ##### Documentation - **mise:** Fix invalid configuration example ([#40792](https://github.com/renovatebot/renovate/issues/40792)) ([24ae070](https://github.com/renovatebot/renovate/commit/24ae07037ce7835f9a49b07b546f8ae98e37a990)) ### [`v43.0.1`](https://github.com/renovatebot/renovate/releases/tag/43.0.1) [Compare Source](https://github.com/renovatebot/renovate/compare/43.0.0...43.0.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v13.1.4 (main) ([#40788](https://github.com/renovatebot/renovate/issues/40788)) ([1e4f4d3](https://github.com/renovatebot/renovate/commit/1e4f4d35af25e43b5690d727d2b5d3481a7a4d44)) ##### Documentation - **opentelemetry:** revamp documentation ([#40765](https://github.com/renovatebot/renovate/issues/40765)) ([18c7915](https://github.com/renovatebot/renovate/commit/18c7915000dda60d8a93bf8083197750b8a4f9db)), closes [#40126](https://github.com/renovatebot/renovate/issues/40126) ### [`v43.0.0`](https://github.com/renovatebot/renovate/releases/tag/43.0.0) [Compare Source](https://github.com/renovatebot/renovate/compare/42.95.2...43.0.0) #### Breaking changes for 43 ##### Allowlisting required for "unsafe commands" [#40684](https://github.com/renovatebot/renovate/issues/40684) > \[!NOTE] > This should only affect you if you work with repositories that have a Gradle Wrapper. Prior to Renovate 43, when performing updates in a repository that used Gradle, Renovate would execute the Gradle Wrapper (`./gradlew` or `gradlew.bat`). This is [a well-documented "insider attack" risk](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) that could lead to remote code execution in the context of the Renovate process, as execution of the Gradle buildscript: - is controlled by the anyone with write access to the repository being processed - can look for specific tasks to execute specific code - can execute code from source-tracked scripts - can execute code from third-party libraries This can occur during updates to [the Gradle wrapper](https://docs.renovatebot.com/modules/manager/gradle-wrapper/) or using [Gradle's Dependency Verification Metadata](https://docs.renovatebot.com/modules/manager/gradle/#dependency-verification) when updating Gradle dependencies. As of Renovate 43, this long-standing risk is disabled by default to make Renovate more "secure by default". Self-hosted administrators can re-enable this using the global self-hosted configuration [`allowedUnsafeExecutions`](https://docs.renovatebot.com/self-hosted-configuration/#allowedunsafeexecutions). ##### `postUpgradeTasks` will no longer run with `shell` mode by default [#40230](https://github.com/renovatebot/renovate/issues/40230) As noted in [#40403](https://github.com/renovatebot/renovate/issues/40403) and GHSA-pfq2-hh62-7m96, existing access to a repository could lead to remote code execution due to incorrectly quoted shell commands. The fix for GHSA-pfq2-hh62-7m96 applied to commands invoked by Renovate, but did not cover `postUpgradeTasks`, which are allowlisted by a self-hosted administrator. To provide a safer default, commands that run through `postUpgradeTasks` will no longer run inside a shell. Self-hosted administrators can re-enable this using the global self-hosted configuration [`allowShellExecutorForPostUpgradeCommands=true`](https://docs.renovatebot.com/self-hosted-configuration/#allowshellexecutorforpostupgradecommands). ##### `binarySource=docker` is officially deprecated [#40735](https://github.com/renovatebot/renovate/issues/40735) As noted in [#40747](https://github.com/renovatebot/renovate/issues/40747), we have now officially deprecated the `binarySource=docker` option. There is no timeline decided on the removal of the functionality. For more details and/or to provide feedback on your use case and why `binarySource=install` does not work for you, please see [#40747](https://github.com/renovatebot/renovate/issues/40747). ##### Renovate now ships as ESM (ECMAScript Modules) [#9890](https://github.com/renovatebot/renovate/issues/9890) / [#40756](https://github.com/renovatebot/renovate/issues/40756) This should not affect users, only cases where Renovate is imported as a library. Given our previous support of Node 22, ESM can still be imported from Common JS (CJS) files. Out of caution and for visibility, this is part of the major release. ##### `config:best-practices` will now perform weekly lockfile maintenance [#40735](https://github.com/renovatebot/renovate/issues/40735) As part of the Renovate maintainers' opinionated "best practices" configuration, Renovate will now perform a weekly lockfile maintenance task, keeping your lockfiles updated. This is due to an increase in package managers using lock files, but users not necessarily being aware of the need to enable this explicitly. If this is not applicable to you, you can use [`ignorePresets`](https://docs.renovatebot.com/configuration-options/#ignorepresets), i.e. ```json { "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:best-practices" ], "ignorePresets": [ ":maintainLockFilesWeekly" ] } ``` ##### JSON Schema split for repo or global configuration [#38619](https://github.com/renovatebot/renovate/issues/38619) Renovate now has separate JSON Schemas for repository configuration, repository configuration (and inherit config) for writing `org-inherited-config.json`, and global self-hosted configuration: - <https://docs.renovatebot.com/renovate-schema.json> ([repository configuration](https://docs.renovatebot.com/configuration-options/)) - <https://docs.renovatebot.com/renovate-global-schema.json> ([global self-hosted configuration](https://docs.renovatebot.com/self-hosted-configuration/)) - <https://docs.renovatebot.com/renovate-inherited-schema.json> (repository configuration, including [inherited config options](https://docs.renovatebot.com/config-overview/#inherited-config)) This provides better validation for your editor/agent, as you now only see documentation for the relevant configuration type you're writing. You can read more [in the Renovate JSON Schema documentation](https://docs.renovatebot.com/json-schema/). This does not affect `renovate-config-validator`. ##### Replacements cannot be grouped with other updates [#40758](https://github.com/renovatebot/renovate/issues/40758) To prevent replacements being grouped in with other updates, which can sometimes lead to them failing to correctly replace a package, they will no longer be grouped. This may lead to some PRs being modified/created when you upgrade to this version of Renovate. ##### Lock file maintenance cannot be grouped with other updates [#40781](https://github.com/renovatebot/renovate/issues/40781) To prevent [lock file maintenance](https://docs.renovatebot.com/configuration-options/#lockfilemaintenance) being grouped in with other updates, which can sometimes lead to them failing to perform the lock file maintenance. This may lead to some PRs being modified/created when you upgrade to this version of Renovate. ##### Use `wasm-java` build of Bouncy Castle [#40678](https://github.com/renovatebot/renovate/issues/40678) To improve performance for encryption/decryption of secrets, as well as [supporting AEAD](https://github.com/renovatebot/renovate/discussions/28934), we have moved the default Bouncy Castle build to use `wasm-java`. ##### Renovate now requires a minimum of Node 24 [#40675](https://github.com/renovatebot/renovate/issues/40675) The existing requirements of Node 24.11.0 has not changed. This only drops support for Node 22.x. ##### Package name for Node.JS in Mise has changed to `node` [#40466](https://github.com/renovatebot/renovate/issues/40466) To be more consistent with other package managers, the Node.JS package has been renamed to `node`. This ensures that updates to NodeJS (when using [Mise](https://docs.renovatebot.com/modules/manager/mise/)) are grouped with other package updates. ##### The [`useCloudMetadataServices`](https://docs.renovatebot.com/self-hosted-configuration/#usecloudmetadataservices) configuration is now environment variable only [#40638](https://github.com/renovatebot/renovate/issues/40638) As a first step towards solving [#38604](https://github.com/renovatebot/renovate/issues/38604), we have migrated this configuration option to being environment variable configuration only. Note that *technically* Renovate will still detect it if it's set in a `config.js`, but with changes in [#38604](https://github.com/renovatebot/renovate/issues/38604) it will not affect the execution. ##### Default tool version updates [#39100](https://github.com/renovatebot/renovate/issues/39100) For users of the upstream Renovate container images, the following tools have been updated to new major versions: | Tool | Version | | ------- | -------- | | Bundler | 4.0.4 | | Dotnet | 10.0.102 | | Helm | v4.1.0 | | PHP | 8.5.2 | | Pipenv | 2026.0.3 | | Ruby | 4.0.1 | #### Commentary for 43 There aren't any big changes as part of this release to call out - this is a fairly "routine" major version, where we're doing a little cleanup, making some improvements to be "secure by default", and updating our default tool versions. #### Deprecations As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 44: - [Removal of `x-access-token:` prefix for GitHub](https://github.com/renovatebot/renovate/issues/38952) ##### ⚠ BREAKING CHANGES - **deps:** Update ghcr.io/renovatebot/base-image Docker tag to v13 (main) ([#40730](https://github.com/renovatebot/renovate/issues/40730)) - prevent grouping of lockfile maintenance updates ([#40781](https://github.com/renovatebot/renovate/issues/40781)) - Switch to ESM modules ([#40756](https://github.com/renovatebot/renovate/issues/40756)) - prevent grouping of replacement updates ([#40758](https://github.com/renovatebot/renovate/issues/40758)) - **config:** deprecate `binarySource=docker` ([#40754](https://github.com/renovatebot/renovate/issues/40754)) - **presets:** add `maintainLockFilesWeekly` to `best-practices` preset ([#40735](https://github.com/renovatebot/renovate/issues/40735)) - **config:** make `useCloudMetadataServices` environment-only ([#40638](https://github.com/renovatebot/renovate/issues/40638)) - **self-hosted:** don't allow any unsafe commands by default ([#40684](https://github.com/renovatebot/renovate/issues/40684)) - **self-hosted:** don't use `shell: true` for `postUpgradeTasks` ([#40230](https://github.com/renovatebot/renovate/issues/40230)) - **json-schema:** forbid global-only options in repo configuration ([#38619](https://github.com/renovatebot/renovate/issues/38619)) - **presets:** add `hostType=github` to `:githubComToken` ([#38975](https://github.com/renovatebot/renovate/issues/38975)) - use `wasm-java` build of Bouncy Castle ([#40678](https://github.com/renovatebot/renovate/issues/40678)) - **mise:** rename packageName from `nodejs` to `node` ([#40466](https://github.com/renovatebot/renovate/issues/40466)) - require node v24 ([#40675](https://github.com/renovatebot/renovate/issues/40675)) ##### Features - **config:** deprecate `binarySource=docker` ([#40754](https://github.com/renovatebot/renovate/issues/40754)) ([3644ac8](https://github.com/renovatebot/renovate/commit/3644ac89d0e255cf008a61693696fc93d1040d75)), closes [#40747](https://github.com/renovatebot/renovate/issues/40747) - **deps:** Update ghcr.io/renovatebot/base-image Docker tag to v13 (main) ([#40730](https://github.com/renovatebot/renovate/issues/40730)) ([5a2107d](https://github.com/renovatebot/renovate/commit/5a2107d5c77081879551b97970b21b7ccaf29ef4)) - **presets:** add `hostType=github` to `:githubComToken` ([#38975](https://github.com/renovatebot/renovate/issues/38975)) ([0d912db](https://github.com/renovatebot/renovate/commit/0d912db883142ae365a97d95fce02f660aebbe05)), closes [#38961](https://github.com/renovatebot/renovate/issues/38961) - **presets:** add `maintainLockFilesWeekly` to `best-practices` preset ([#40735](https://github.com/renovatebot/renovate/issues/40735)) ([28dccba](https://github.com/renovatebot/renovate/commit/28dccbaf9f4f3aecd562ba09dcfe9470a0c0e6d5)) - require node v24 ([#40675](https://github.com/renovatebot/renovate/issues/40675)) ([dcdd1c3](https://github.com/renovatebot/renovate/commit/dcdd1c3bce2ed451db7b6d2806c3064d2d5bfcbd)) - Switch to ESM modules ([#40756](https://github.com/renovatebot/renovate/issues/40756)) ([2b0e80b](https://github.com/renovatebot/renovate/commit/2b0e80b884543cf2bdfb96ca49b1b51adec068ad)) - use `wasm-java` build of Bouncy Castle ([#40678](https://github.com/renovatebot/renovate/issues/40678)) ([4e19e7c](https://github.com/renovatebot/renovate/commit/4e19e7c122f04baf017ef48cc06317eaa3812c5d)) ##### Bug Fixes - **config:** make `useCloudMetadataServices` environment-only ([#40638](https://github.com/renovatebot/renovate/issues/40638)) ([a630187](https://github.com/renovatebot/renovate/commit/a6301877c6abb58370a087367905a7c3afa82564)), closes [#38604](https://github.com/renovatebot/renovate/issues/38604) - **mise:** rename packageName from `nodejs` to `node` ([#40466](https://github.com/renovatebot/renovate/issues/40466)) ([8dc1133](https://github.com/renovatebot/renovate/commit/8dc1133ebeab592d5fda7f5c9fef5222ca8543f5)) - prevent grouping of lockfile maintenance updates ([#40781](https://github.com/renovatebot/renovate/issues/40781)) ([3ed1817](https://github.com/renovatebot/renovate/commit/3ed1817e2b454f2d0a93b478004404a06a5ec1a2)) - prevent grouping of replacement updates ([#40758](https://github.com/renovatebot/renovate/issues/40758)) ([c7222c6](https://github.com/renovatebot/renovate/commit/c7222c643d4963f27db2d370557a666ea44d17b7)) - **self-hosted:** don't allow any unsafe commands by default ([#40684](https://github.com/renovatebot/renovate/issues/40684)) ([b6ef3e1](https://github.com/renovatebot/renovate/commit/b6ef3e129034592659335064a0c986de2ce8e1a6)) - **self-hosted:** don't use `shell: true` for `postUpgradeTasks` ([#40230](https://github.com/renovatebot/renovate/issues/40230)) ([cb49754](https://github.com/renovatebot/renovate/commit/cb4975439112166f1ddef8ba4f972516b90fa14e)) ##### Documentation - add announcement bar for v43 ([93423cf](https://github.com/renovatebot/renovate/commit/93423cfafe8914883cc1a9b0040b1e9d9da18dcc)) ##### Miscellaneous Chores - **json-schema:** forbid global-only options in repo configuration ([#38619](https://github.com/renovatebot/renovate/issues/38619)) ([192ae36](https://github.com/renovatebot/renovate/commit/192ae368fae5b27812dd6289696b928bf9049af9)), closes [#38728](https://github.com/renovatebot/renovate/issues/38728) - use `updateType` in log message ([d1e3f13](https://github.com/renovatebot/renovate/commit/d1e3f13874a4505a2926eb76f25b74529509c0b8)) ### [`v42.95.2`](https://github.com/renovatebot/renovate/releases/tag/42.95.2) [Compare Source](https://github.com/renovatebot/renovate/compare/42.95.1...42.95.2) ##### Bug Fixes - **onboardingAutoCloseAge:** don't allow higher inherited value than global ([#40810](https://github.com/renovatebot/renovate/issues/40810)) ([ffb95ed](https://github.com/renovatebot/renovate/commit/ffb95ed848ded2ee8124d3e44956403df5a22fde)) ##### Build System - trim channel for docker builds ([cd27b1d](https://github.com/renovatebot/renovate/commit/cd27b1ddbfae5cac7085096cdc70f8ba22ea12e8)) ### [`v42.95.1`](https://github.com/renovatebot/renovate/releases/tag/42.95.1) [Compare Source](https://github.com/renovatebot/renovate/compare/42.95.0...42.95.1) ##### Bug Fixes - **pnpm:** don't update workspace when no `pnpm-lock.yaml` found ([#40780](https://github.com/renovatebot/renovate/issues/40780)) ([0c49124](https://github.com/renovatebot/renovate/commit/0c4912456e6e77a0e9c1408cf777f26e212d6775)), closes [#40774](https://github.com/renovatebot/renovate/issues/40774) ##### Miscellaneous Chores - **deps:** update containerbase/internal-tools action to v4.0.3 (main) ([#40783](https://github.com/renovatebot/renovate/issues/40783)) ([b2e1382](https://github.com/renovatebot/renovate/commit/b2e13824e194b7a656e7f874a31b3a59954d2022)) ##### Continuous Integration - add auto reviewer ([#40782](https://github.com/renovatebot/renovate/issues/40782)) ([e55ad44](https://github.com/renovatebot/renovate/commit/e55ad441bdf34b15de2c6c880decd15682c71783)) ### [`v42.95.0`](https://github.com/renovatebot/renovate/releases/tag/42.95.0) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.7...42.95.0) ##### Features - **sidecar:** use `renovatebot/base-image` instead of `containerbase/sidecar` ([#40772](https://github.com/renovatebot/renovate/issues/40772)) ([cd0426b](https://github.com/renovatebot/renovate/commit/cd0426babddc437388a03ed3098a1745761eb2e0)) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v12.31.2 (main) ([#40776](https://github.com/renovatebot/renovate/issues/40776)) ([dbe0cf7](https://github.com/renovatebot/renovate/commit/dbe0cf7339742a8ca4961aa92d5ef23fed304c0d)) ##### Build System - **deps:** update opentelemetry-js-contrib monorepo (main) ([#40775](https://github.com/renovatebot/renovate/issues/40775)) ([a94398b](https://github.com/renovatebot/renovate/commit/a94398bd176b9ebe1a77c9a07e18fd7b64983ff5)) ### [`v42.94.7`](https://github.com/renovatebot/renovate/releases/tag/42.94.7) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.6...42.94.7) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v12.31.2 (main) ([#40773](https://github.com/renovatebot/renovate/issues/40773)) ([f1790af](https://github.com/renovatebot/renovate/commit/f1790afc7e7ab3568385111b8253bce10690fdb7)) ### [`v42.94.6`](https://github.com/renovatebot/renovate/releases/tag/42.94.6) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.5...42.94.6) ##### Bug Fixes - **gerrit:** not cloning submodules ([#40089](https://github.com/renovatebot/renovate/issues/40089)) ([5db0218](https://github.com/renovatebot/renovate/commit/5db0218ec103f5cbdebd4519441d2c3f8270a9c5)) ### [`v42.94.5`](https://github.com/renovatebot/renovate/releases/tag/42.94.5) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.4...42.94.5) ##### Bug Fixes - **presets:** dockerfile globs ([#40770](https://github.com/renovatebot/renovate/issues/40770)) ([ca446fb](https://github.com/renovatebot/renovate/commit/ca446fbe134f2d810b0b8ba807f703bd35fb9e9e)) ### [`v42.94.4`](https://github.com/renovatebot/renovate/releases/tag/42.94.4) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.3...42.94.4) ##### Build System - **deps:** update opentelemetry-js monorepo (main) ([#40769](https://github.com/renovatebot/renovate/issues/40769)) ([e95089a](https://github.com/renovatebot/renovate/commit/e95089ab1485c27bb94ef9505fcd6391290e606a)) - **deps:** update opentelemetry-js monorepo to v2.5.0 (main) ([#40768](https://github.com/renovatebot/renovate/issues/40768)) ([7c43e8f](https://github.com/renovatebot/renovate/commit/7c43e8f423b39b743715ec51c8ef0fdc7b90836d)) ### [`v42.94.3`](https://github.com/renovatebot/renovate/releases/tag/42.94.3) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.2...42.94.3) ##### Bug Fixes - override tar ([#40766](https://github.com/renovatebot/renovate/issues/40766)) ([ce12e9f](https://github.com/renovatebot/renovate/commit/ce12e9ffca5abbd9f8d137121f07802c7e352528)) ##### Miscellaneous Chores - add proper imports from `azure-devops-node-api` ([#40762](https://github.com/renovatebot/renovate/issues/40762)) ([e36d080](https://github.com/renovatebot/renovate/commit/e36d080d22d6aacad9422040dda35c123379501d)) - **deps:** update containerbase/internal-tools action to v4.0.2 (main) ([#40767](https://github.com/renovatebot/renovate/issues/40767)) ([5ad49c3](https://github.com/renovatebot/renovate/commit/5ad49c31f0f66442af858bb8d8e9f6077b544d86)) - **deps:** update dependency tar to v7.5.7 \[security] (main) ([#40764](https://github.com/renovatebot/renovate/issues/40764)) ([cd2b768](https://github.com/renovatebot/renovate/commit/cd2b76827b338053c723b8db3317f6561ec132d1)) - fix type import ([#40760](https://github.com/renovatebot/renovate/issues/40760)) ([eaed53a](https://github.com/renovatebot/renovate/commit/eaed53a2bfae03f66c36ae95cf62e1cdbaadfd3f)) ##### Code Refactoring - use named `simpleGit` imports ([#40759](https://github.com/renovatebot/renovate/issues/40759)) ([17a1bba](https://github.com/renovatebot/renovate/commit/17a1bbad961b07dc92d7f28ccff98e3b8f095213)) ### [`v42.94.2`](https://github.com/renovatebot/renovate/releases/tag/42.94.2) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.1...42.94.2) ##### Bug Fixes - **config/validation:** show `deprecationMsg` as a warning if present ([#40753](https://github.com/renovatebot/renovate/issues/40753)) ([e049e56](https://github.com/renovatebot/renovate/commit/e049e56d5b7202b2a00d39b7a394bbc472aba487)) ##### Miscellaneous Chores - **deps:** update containerbase/internal-tools action to v4 (main) ([#40750](https://github.com/renovatebot/renovate/issues/40750)) ([60d733a](https://github.com/renovatebot/renovate/commit/60d733ae44dec8042a38dc1167274a00c3bedd14)) ##### Code Refactoring - Remove decorators for ESM compatibility ([#40736](https://github.com/renovatebot/renovate/issues/40736)) ([c07814c](https://github.com/renovatebot/renovate/commit/c07814ca4de4ff33823fa5324282970af1c75479)) ##### Tests - **validation:** add tests for custom deprecation messages ([#40752](https://github.com/renovatebot/renovate/issues/40752)) ([0daf184](https://github.com/renovatebot/renovate/commit/0daf184f41c2a892af167eb26372e6cb52142bb4)) ### [`v42.94.1`](https://github.com/renovatebot/renovate/releases/tag/42.94.1) [Compare Source](https://github.com/renovatebot/renovate/compare/42.94.0...42.94.1) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v12.31.1 (main) ([#40749](https://github.com/renovatebot/renovate/issues/40749)) ([fa7e075](https://github.com/renovatebot/renovate/commit/fa7e0753bd9bbb996f11a1def97d71a18b8d865f)) ##### Code Refactoring - **tools:** reduce noise in generate-imports script ([#40186](https://github.com/renovatebot/renovate/issues/40186)) ([69fedef](https://github.com/renovatebot/renovate/commit/69fedefeeda3f9b73b40d6f24ea7a9fbd8edf217)) ### [`v42.94.0`](https://github.com/renovatebot/renovate/releases/tag/42.94.0) [Compare Source](https://github.com/renovatebot/renovate/compare/42.93.1...42.94.0) ##### Features - **deps:** update ghcr.io/renovatebot/base-image docker tag to v12.31.0 (main) ([#40746](https://github.com/renovatebot/renovate/issues/40746)) ([ebfbcfd](https://github.com/renovatebot/renovate/commit/ebfbcfdc970fa27484f26029524b5ee6beefe876)) ##### Bug Fixes - **deps:** update ghcr.io/containerbase/sidecar docker tag to v13.26.7 (main) ([#40745](https://github.com/renovatebot/renovate/issues/40745)) ([592bf20](https://github.com/renovatebot/renovate/commit/592bf204aae72048457f36ada65585c71770cab8)) ##### Documentation - correct references to `binarySource=install` for Mend-hosted ([#40740](https://github.com/renovatebot/renovate/issues/40740)) ([783002c](https://github.com/renovatebot/renovate/commit/783002c7de0cb3b277659027d0b7ca6eb70496d3)) ##### Miscellaneous Chores - **deps:** update containerbase/internal-tools action to v3.15.0 (main) ([#40732](https://github.com/renovatebot/renovate/issues/40732)) ([b0f4ec3](https://github.com/renovatebot/renovate/commit/b0f4ec3f2c373da868c8a3ede7c237e045504896)) - **deps:** update dependency tar to v7.5.6 (main) ([#40739](https://github.com/renovatebot/renovate/issues/40739)) ([f29e971](https://github.com/renovatebot/renovate/commit/f29e9719f1a157aa37e428580b2bb6bf43f30a59)) - **deps:** update ghcr.io/containerbase/devcontainer docker tag to v14.0.1 (main) ([#40741](https://github.com/renovatebot/renovate/issues/40741)) ([67964c8](https://github.com/renovatebot/renovate/commit/67964c84a47dac23badc3831efa53f7a0c2f8730)) ### [`v42.93.1`](https://github.com/renovatebot/renovate/releases/tag/42.93.1) [Compare Source](https://github.com/renovatebot/renovate/compare/42.93.0...42.93.1) ##### Bug Fixes - **datasource/docker:** treat empty string as no architecture ([#40715](https://github.com/renovatebot/renovate/issues/40715)) ([1db6be0](https://github.com/renovatebot/renovate/commit/1db6be0d9e375a2d11ff557916b411e90422f3ed)) ### [`v42.93.0`](https://github.com/renovatebot/renovate/releases/tag/42.93.0) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.14...42.93.0) ##### Features - inherit support for `onboardingAutoCloseAge` ([#40086](https://github.com/renovatebot/renovate/issues/40086)) ([c58c16f](https://github.com/renovatebot/renovate/commit/c58c16f82d9ceb62914c4a33b2aca2ee016ece77)) ##### Documentation - **json-schema:** add separate documentation page ([#40722](https://github.com/renovatebot/renovate/issues/40722)) ([1edb6c3](https://github.com/renovatebot/renovate/commit/1edb6c337fb6af69c64584936c3f26bfdc97443b)), closes [#40716](https://github.com/renovatebot/renovate/issues/40716) ##### Miscellaneous Chores - **deps:** update containerbase/internal-tools action to v3.14.57 (main) ([#40727](https://github.com/renovatebot/renovate/issues/40727)) ([95958c6](https://github.com/renovatebot/renovate/commit/95958c66991542c942f1df8298b4053c92d31164)) - replace `URL.parse` ([#40703](https://github.com/renovatebot/renovate/issues/40703)) ([e958373](https://github.com/renovatebot/renovate/commit/e958373dbf984a2bc34e5073085928253dbc80dd)) ### [`v42.92.14`](https://github.com/renovatebot/renovate/releases/tag/42.92.14) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.13...42.92.14) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v12.30.4 (main) ([#40721](https://github.com/renovatebot/renovate/issues/40721)) ([33b0fcd](https://github.com/renovatebot/renovate/commit/33b0fcd989e51e60cc55a27f2b8a14e622a6f27a)) ##### Code Refactoring - Extract decorator logic into standalone functions ([#40710](https://github.com/renovatebot/renovate/issues/40710)) ([ad47fd2](https://github.com/renovatebot/renovate/commit/ad47fd2981ef148742ad31e755e14fddf171c44c)) - Remove constructor parameter properties ([#40712](https://github.com/renovatebot/renovate/issues/40712)) ([c5b0a74](https://github.com/renovatebot/renovate/commit/c5b0a74f8237bbf7cacce44f7a4b4b207f37cf20)) ### [`v42.92.13`](https://github.com/renovatebot/renovate/releases/tag/42.92.13) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.12...42.92.13) ##### Bug Fixes - **gradle-wrapper:** don't execute when `allowedUnsafeExecutions` ([#40719](https://github.com/renovatebot/renovate/issues/40719)) ([3e70904](https://github.com/renovatebot/renovate/commit/3e70904fddb6cd213161bb223474df799a0e9128)) ### [`v42.92.12`](https://github.com/renovatebot/renovate/releases/tag/42.92.12) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.11...42.92.12) ##### Bug Fixes - `workingDirTemplate` must be relative to the repo root ([#40068](https://github.com/renovatebot/renovate/issues/40068)) ([bde55d5](https://github.com/renovatebot/renovate/commit/bde55d5462e1f7ab1811653e6def3fdb08391957)) ### [`v42.92.11`](https://github.com/renovatebot/renovate/releases/tag/42.92.11) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.10...42.92.11) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v12.30.3 (main) ([#40711](https://github.com/renovatebot/renovate/issues/40711)) ([c72d818](https://github.com/renovatebot/renovate/commit/c72d818f12da946489d55e1466131784677de14e)) ##### Miscellaneous Chores - **deps:** update dependency eslint-plugin-oxlint to v1.41.0 (main) ([#40707](https://github.com/renovatebot/renovate/issues/40707)) ([4d8e18a](https://github.com/renovatebot/renovate/commit/4d8e18a13e5148e0633c8efb4845f810107f5716)) ##### Code Refactoring - Rewrite imports with `.ts` extensions ([#40700](https://github.com/renovatebot/renovate/issues/40700)) ([930cf66](https://github.com/renovatebot/renovate/commit/930cf6633ccf38f3578cb112c7ad42c7f99e1cdb)) ### [`v42.92.10`](https://github.com/renovatebot/renovate/releases/tag/42.92.10) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.9...42.92.10) ##### Bug Fixes - **config/validation:** handle platform-prefixed `onboardingConfigFileName` ([#40619](https://github.com/renovatebot/renovate/issues/40619)) ([1b6c63a](https://github.com/renovatebot/renovate/commit/1b6c63a20eab3341f93e3494307a7ae87fab53a2)) - **reconfigure:** migrate before validating ([#40647](https://github.com/renovatebot/renovate/issues/40647)) ([7eb1ee9](https://github.com/renovatebot/renovate/commit/7eb1ee9ed7ac0b5479f2a1fb2036fd5c70dc87bc)) ##### Documentation - **config-validation:** note the behaviour of `--no-global` ([#40584](https://github.com/renovatebot/renovate/issues/40584)) ([30b7421](https://github.com/renovatebot/renovate/commit/30b74215cbcc1ee8164c90f6272e4dd816d2114b)) ##### Miscellaneous Chores - **deps:** update dependency oxlint to v1.41.0 (main) ([#40704](https://github.com/renovatebot/renovate/issues/40704)) ([dff788f](https://github.com/renovatebot/renovate/commit/dff788f302d97f8d2ccf7cbd603d7fdd0c27a8cd)) - **deps:** update github/codeql-action action to v4.32.0 (main) ([#40705](https://github.com/renovatebot/renovate/issues/40705)) ([e73c6aa](https://github.com/renovatebot/renovate/commit/e73c6aa4cf6d69d4fda04421b383b0f5af8b9fba)) - extract KubernetesResource schema for future broader usage ([#40264](https://github.com/renovatebot/renovate/issues/40264)) ([a7ddfcc](https://github.com/renovatebot/renovate/commit/a7ddfcc893c471560e650411d507e23a14a7fd1c)) - replace `URL.resolve` ([#40702](https://github.com/renovatebot/renovate/issues/40702)) ([18bd321](https://github.com/renovatebot/renovate/commit/18bd32166bfc1715f9cac2ad6d5651b043d22f4e)) ### [`v42.92.9`](https://github.com/renovatebot/renovate/releases/tag/42.92.9) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.8...42.92.9) ##### Bug Fixes - **sbt:** consider html hrefs in absolute and root-relative format ([#39464](https://github.com/renovatebot/renovate/issues/39464)) ([e5c2caa](https://github.com/renovatebot/renovate/commit/e5c2caac6540e0d05fd13bd6006c89f2f7229da5)) ### [`v42.92.8`](https://github.com/renovatebot/renovate/releases/tag/42.92.8) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.7...42.92.8) ##### Miscellaneous Chores - **deps:** update dependency typescript-eslint to v8.53.1 (main) ([#40698](https://github.com/renovatebot/renovate/issues/40698)) ([3106c46](https://github.com/renovatebot/renovate/commit/3106c46bc7a4809e149d51e44e51340e615a6fd4)) ##### Code Refactoring - replace `nanoid` with `crypto.randomUUID` ([#40695](https://github.com/renovatebot/renovate/issues/40695)) ([5c796e1](https://github.com/renovatebot/renovate/commit/5c796e1a47e44e326c043350a4fa02638f7952e3)) ##### Build System - Switch to `tsdown` for `.d.ts` generation ([#40696](https://github.com/renovatebot/renovate/issues/40696)) ([98d0b0f](https://github.com/renovatebot/renovate/commit/98d0b0f9efcdda0d42668fbc48069db52c254011)) ### [`v42.92.7`](https://github.com/renovatebot/renovate/releases/tag/42.92.7) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.6...42.92.7) ##### Bug Fixes - **json-schema:** add a separate schema for Inherit Config ([#40683](https://github.com/renovatebot/renovate/issues/40683)) ([0b42055](https://github.com/renovatebot/renovate/commit/0b42055fbe778d201cc4d4f975265619566cd937)) ### [`v42.92.6`](https://github.com/renovatebot/renovate/releases/tag/42.92.6) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.5...42.92.6) ##### Bug Fixes - **config:** ensure that config options are immutable ([#40682](https://github.com/renovatebot/renovate/issues/40682)) ([13869dd](https://github.com/renovatebot/renovate/commit/13869dd7d1b31825c9b9f3f1220e96bfc683f2d3)) - **manager/bun:** run bun from lock file directory ([#40274](https://github.com/renovatebot/renovate/issues/40274)) ([cd044ee](https://github.com/renovatebot/renovate/commit/cd044ee0ca5c12bf7a165fd1d74754d2e13c4dc6)) ##### Miscellaneous Chores - **deps:** update linters to v1.40.0 (main) ([#40688](https://github.com/renovatebot/renovate/issues/40688)) ([e52ee4f](https://github.com/renovatebot/renovate/commit/e52ee4f9cc62ffe07b876da94f4917e8012c86bc)) ##### Build System - Switch to rolldown ([#40686](https://github.com/renovatebot/renovate/issues/40686)) ([42103c5](https://github.com/renovatebot/renovate/commit/42103c5de4f161d2dd8788c98e69ad19fe34f1bf)) ### [`v42.92.5`](https://github.com/renovatebot/renovate/releases/tag/42.92.5) [Compare Source](https://github.com/renovatebot/renovate/compare/42.92.4...42.92.5) ##### Bug Fixes - **deps:** update ghcr.io/renovatebot/base-image docker tag to v12.30.2 (main) ([#40687](https://github.com/renovatebot/renovate/issues/40687)) ([dfa3798](https://github.com/renovatebot/renovate/commit/dfa3798ca0339de65c07d9bafdbecd533dacc4a5)) ##### Documentation - update references to renovate/renovate (main) ([#40661](https://github.com/renovatebot/renovate/issues/40661)) ([3fe8d2c](https://github.com/renovatebot/renovate/commit/3fe8d2cc69c957e1f2f9287c251823238e947c70)) ##### Miscellaneous Chores - **deps:** lock file maintenance (main) ([#40662](https://github.com/renovatebot/renovate/issues/40662)) ([3f74931](https://github.com/renovatebot/renovate/commit/3f749312f1949dc541faa97cbca5487bb3159f06)) - **deps:** switch to `@renovatebot/good-enough-parser` ([#40623](https://github.com/renovatebot/renovate/issues/40623)) ([ae49b7a](https://github.com/renovatebot/renovate/commit/ae49b7af3855bcb48a9f79c1cbe86e08a23a7b1a)) - **deps:** update containerbase/internal-tools action to v3.14.56 (main) ([#40663](https://github.com/renovatebot/renovate/issues/40663)) ([9c6abec](https://github.com/renovatebot/renovate/commit/9c6abecd55be30fde20a978c034e98a5c32887b4)) - **deps:** update dependency [@containerbase/eslint-plugin](https://github.com/containerbase/eslint-plugin) to v1.1.28 (main) ([#40664](https://github.com/renovatebot/renovate/issues/40664)) ([a8ccae6](https://github.com/renovatebot/renovate/commit/a8ccae685b3b9ba6f9ce0b721a774188133972c2)) - **deps:** update dependency [@containerbase/eslint-plugin](https://github.com/containerbase/eslint-plugin) to v1.1.29 (main) ([#40668](https://github.com/renovatebot/renovate/issues/40668)) ([8fd01c9](https://github.com/renovatebot/renovate/commit/8fd01c97b831dd311c5874d9cb6703c3c3bd9f57)) - **deps:** update dependency [@containerbase/istanbul-reports-html](https://github.com/containerbase/istanbul-reports-html) to v1.1.27 (main) ([#40666](https://github.com/renovatebot/renovate/issues/40666)) ([6ed83ca](https://github.com/renovatebot/renovate/commit/6ed83cae2036cbb891e2ec7ce7e8266aacbb6148)) - **deps:** update dependency [@containerbase/semantic-release-pnpm](https://github.com/containerbase/semantic-release-pnpm) to v1.3.16 (main) ([#40667](https://github.com/renovatebot/renovate/issues/40667)) ([36fa3ea](https://github.com/renovatebot/renovate/commit/36fa3ea2e7d55f12788ae5651adb411f1a343940)) - **deps:** update dependency memfs to v4.53.0 (main) ([#40655](https://github.com/renovatebot/renovate/issues/40655)) ([22c7e88](https://github.com/renovatebot/renovate/commit/22c7e8833e5f4db6145123471f4ac88b9d5db642)) - **deps:** update dependency memfs to v4.54.0 (main) ([#40658](https://github.com/renovatebot/renovate/issues/40658)) ([fa2a2b9](https://github.com/renovatebot/renovate/commit/fa2a2b9e5f7087be124ac92d0ed5c882dbcfa01b)) - **deps:** update dependency memfs to v4.55.0 (main) ([#40680](https://github.com/renovatebot/renovate/issues/40680)) ([acd533e](https://github.com/renovatebot/renovate/commit/acd533e80d9f5b2c369afeb54dbc25d8f583e3b6)) - **deps:** update dependency pnpm to v10.28.1 (main) ([#40685](https://github.com/renovatebot/renovate/issues/40685)) ([d3e9ada](https://github.com/renovatebot/renovate/commit/d3e9ada318674823728d55fddbd88035ddb6905f)) - **deps:** update dependency renovatebot/github-action to v44.2.6 (main) ([#40671](https://github.com/renovatebot/renovate/issues/40671)) ([b5ef5ed](https://github.com/renovatebot/renovate/commit/b5ef5ed804cec5584f9a4ddddab0ee23f06919f0)) - **deps:** update vitest monorepo to v4.0.18 (main) ([#40654](https://github.com/renovatebot/renovate/issues/40654)) ([c3c30bf](https://github.com/renovatebot/renovate/commit/c3c30bf4a80f720306545a89bb22e092c6a23daa)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-01-31 00:05:25 +00:00

chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43 5fde25b8ac

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/ghcr.io-renovatebot-renovate-43.x:renovate/ghcr.io-renovatebot-renovate-43.x

git switch renovate/ghcr.io-renovatebot-renovate-43.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/ghcr.io-renovatebot-renovate-43.x

git switch renovate/ghcr.io-renovatebot-renovate-43.x

git rebase main

git switch main

git merge --ff-only renovate/ghcr.io-renovatebot-renovate-43.x

git switch renovate/ghcr.io-renovatebot-renovate-43.x

git rebase main

git switch main

git merge --no-ff renovate/ghcr.io-renovatebot-renovate-43.x

git switch main

git merge --squash renovate/ghcr.io-renovatebot-renovate-43.x

git switch main

git merge --ff-only renovate/ghcr.io-renovatebot-renovate-43.x

git switch main

git merge renovate/ghcr.io-renovatebot-renovate-43.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

infrastructure/renovate-config!254

No description provided.

Rows
Columns

chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43 #254

Release Notes

Miscellaneous Chores

Build System

Bug Fixes

Bug Fixes

Bug Fixes

Miscellaneous Chores

Bug Fixes

Documentation

Bug Fixes

Documentation

Breaking changes for 43

Allowlisting required for "unsafe commands" #​40684

postUpgradeTasks will no longer run with shell mode by default #​40230

binarySource=docker is officially deprecated #​40735

Renovate now ships as ESM (ECMAScript Modules) #​9890 / #​40756

config:best-practices will now perform weekly lockfile maintenance #​40735

JSON Schema split for repo or global configuration #​38619

Replacements cannot be grouped with other updates #​40758

Lock file maintenance cannot be grouped with other updates #​40781

Use wasm-java build of Bouncy Castle #​40678

Renovate now requires a minimum of Node 24 #​40675

Package name for Node.JS in Mise has changed to node #​40466

The useCloudMetadataServices configuration is now environment variable only #​40638

Default tool version updates #​39100

Commentary for 43

Deprecations

⚠ BREAKING CHANGES

Features

Bug Fixes

Documentation

Miscellaneous Chores

Bug Fixes

Build System

Bug Fixes

Miscellaneous Chores

Continuous Integration

Features

Bug Fixes

Build System

Bug Fixes

Bug Fixes

Bug Fixes

Build System

Bug Fixes

Miscellaneous Chores

Code Refactoring

Bug Fixes

Miscellaneous Chores

Code Refactoring

Tests

Bug Fixes

Code Refactoring

Features

Bug Fixes

Documentation

Miscellaneous Chores

Bug Fixes

Features

Documentation

Miscellaneous Chores

Bug Fixes

Code Refactoring

Bug Fixes

Bug Fixes

Bug Fixes

Miscellaneous Chores

Code Refactoring

Bug Fixes

Documentation

Miscellaneous Chores

Bug Fixes

Miscellaneous Chores

Code Refactoring

Build System

Bug Fixes

Bug Fixes

Miscellaneous Chores

Build System

Allowlisting required for "unsafe commands" #40684

`postUpgradeTasks` will no longer run with `shell` mode by default #40230

`binarySource=docker` is officially deprecated #40735

Renovate now ships as ESM (ECMAScript Modules) #9890 / #40756

`config:best-practices` will now perform weekly lockfile maintenance #40735

JSON Schema split for repo or global configuration #38619

Replacements cannot be grouped with other updates #40758

Lock file maintenance cannot be grouped with other updates #40781

Use `wasm-java` build of Bouncy Castle #40678

Renovate now requires a minimum of Node 24 #40675

Package name for Node.JS in Mise has changed to `node` #40466

The `useCloudMetadataServices` configuration is now environment variable only #40638

Default tool version updates #39100