Important
Note that this is the second of a few planned out-of-band security patches we have, due to the eMudhra CA compromise, and high/critical vulnerabilities across many ecosystems.
An additional release is planned early next week.
Application changes
- Renovate CLI: Update from
44.176.3to44.180.0- Docs
- Pre-built documentation site
- Full changelog
- 🆕 new grouped changelog summary - see 44.180.0.md in release attachments
- this is an experimental summary - feedback welcome!
- chore: update dependencies (see full list below for tools in the worker)
- Java:
- updated to
25.0.5+8.0.LTS(which not longer trusts the eMudhra CA)
- updated to
jb:- updated the bundled command-line tool to be built with Go 1.27.3
- Git:
- Rolled back a change that broke read-only filesystem usage
- Java:
Default tool versions
This release updates the tool versions installed on the images as follows.
In the "slim" images (ghcr.io/mend/renovate-ee-worker:15.10.0 and ghcr.io/mend/renovate-ce:15.10.0), the default tools are now:
| Tool | Version |
|---|---|
| git | 2.56.0
|
| jq | 1.8.2
|
(New tools are installed dynamically, as this uses binarySource=install)
In the "full" images (ghcr.io/mend/renovate-ee-worker:15.10.0-full and ghcr.io/mend/renovate-ce:15.10.0-full), the default tools are now:
| Tool | Version |
|---|---|
| bazelisk | 1.30.0
|
| bun | 1.4.3
|
| bundler | 4.0.23
|
| cocoapods | 1.17.0
|
| composer | 2.10.3
|
| conan | 2.33.0
|
| copier | 9.19.1
|
| dart | 3.13.7
|
| devbox | 0.18.4
|
| dotnet | 10.0.402
|
| elixir | 1.20.4
|
| erlang | 28.5.0.8
|
| flutter | 3.47.7
|
| git | 2.56.0
|
| golang | 1.27.3
|
| gradle | 9.8.2
|
| hashin | 1.0.5
|
| helm | 4.3.1
|
| java | 25.0.5+8.0.LTS
|
| jb | 0.6.0.1
|
| jq | 1.8.2
|
| mise | 2026.10.17
|
| nix | 2.35.4
|
| node | 24.22.1
|
| pdm | 2.29.3
|
| php | 8.5.12
|
| pip-tools | 7.6.2
|
| pipenv | 2026.10.2
|
| pnpm | 10.34.7
|
| poetry | 2.5.1
|
| python | 3.14.8
|
| ruby | 4.0.9
|
| rust | 1.99.1
|
| uv | 0.13.5
|
| vendir | 0.46.3
|
| yarn | 4.18.1
|
(No new tools are installed dynamically, as this uses binarySource=global)