Important
Note that this is the first of a few planned out-of-band security patches we have, due to the eMudhra CA compromise, and high/critical vulnerabilities across many ecosystems.
An additional release is planned later today.
Known issues
- Java:
- Still trusts the eMudhra CA
- Using an older version of the JDK - we're blocked by there not being an upstream-built aarch64 build of the JDK that we use (renovatebot/base-image#3708)
- Git:
- Our custom build of Git (which we will revert in the next release) leads to issues with read-only filesystems and i.e. containerbase/base#7922
Application changes
- Renovate CLI: Update from
44.164.1to44.176.3- Docs
- Pre-built documentation site
- Full changelog
- 🆕 new grouped changelog summary - see 44.176.3.md in release attachments
- this is an experimental summary - feedback welcome!
- chore: update dependencies (see full list below for tools in the worker)
- NodeJS 24.22.1
- PHP 8.5.2
- Internal tools using Go to be built with Go 1.27.3
- EE Slim image now uses a slimmer base image based on Debian Trixie
ca-certificatesupdated to20260816ubuntu0.24.04.1
Dependency updates
Default tool versions
This release updates the tool versions installed on the images as follows.
Enterprise Edition (EE)
In the "slim" worker image (ghcr.io/mend/renovate-ee-worker:15.9.0), the default tools are now:
| Tool | Version |
|---|---|
| git | 2.56.0
|
| jq | 1.8.2
|
(New tools are installed dynamically, as this uses binarySource=install)
In the "full" image (ghcr.io/mend/renovate-ee-worker:15.9.0-full) , the default tools are now:
| Tool | Version |
|---|---|
| bazelisk | 1.30.0
|
| bun | 1.4.3
|
| bundler | 4.0.23
|
| cocoapods | 1.17.0
|
| composer | 2.10.3
|
| conan | 2.33.0
|
| copier | 9.19.1
|
| dart | 3.13.6
|
| devbox | 0.18.4
|
| dotnet | 10.0.402
|
| elixir | 1.20.4
|
| erlang | 28.5.0.8
|
| flutter | 3.47.7
|
| git | 2.56.0
|
| golang | 1.27.3
|
| gradle | 9.8.2
|
| hashin | 1.0.5
|
| helm | 4.3.1
|
| java | 25.0.4+101.0.LTS
|
| jb | 0.6.0
|
| jq | 1.8.2
|
| mise | 2026.10.17
|
| nix | 2.35.3
|
| node | 24.22.1
|
| pdm | 2.29.3
|
| php | 8.5.12
|
| pip-tools | 7.6.2
|
| pipenv | 2026.10.2
|
| pnpm | 10.34.7
|
| poetry | 2.5.1
|
| python | 3.14.8
|
| ruby | 4.0.7
|
| rust | 1.99.1
|
| uv | 0.13.4
|
| vendir | 0.46.3
|
| yarn | 4.18.1
|
(No new tools are installed dynamically, as this uses binarySource=global)
Community Edition (CE)
In the "slim" image (ghcr.io/mend/renovate-ce:15.9.0), the default tools are now:
| Tool | Version |
|---|---|
| git | 2.56.0
|
| jq | 1.8.2
|
(New tools are installed dynamically, as this uses binarySource=install)
In the "full" image (ghcr.io/mend/renovate-ce:15.9.0-full) , the default tools are now:
| Tool | Version |
|---|---|
| bazelisk | 1.30.0
|
| bun | 1.4.3
|
| bundler | 4.0.23
|
| cocoapods | 1.17.0
|
| composer | 2.10.3
|
| conan | 2.33.0
|
| copier | 9.19.1
|
| dart | 3.13.6
|
| devbox | 0.18.4
|
| dotnet | 10.0.402
|
| elixir | 1.20.4
|
| erlang | 28.5.0.8
|
| flutter | 3.47.7
|
| git | 2.56.0
|
| golang | 1.27.3
|
| gradle | 9.8.2
|
| hashin | 1.0.5
|
| helm | 4.3.1
|
| java | 25.0.4+101.0.LTS
|
| jb | 0.6.0
|
| jq | 1.8.2
|
| mise | 2026.10.17
|
| nix | 2.35.3
|
| node | 24.22.1
|
| pdm | 2.29.3
|
| php | 8.5.12
|
| pip-tools | 7.6.2
|
| pipenv | 2026.10.2
|
| pnpm | 10.34.7
|
| poetry | 2.5.1
|
| python | 3.14.8
|
| ruby | 4.0.7
|
| rust | 1.99.1
|
| uv | 0.13.4
|
| vendir | 0.46.3
|
| yarn | 4.18.1
|
(No new tools are installed dynamically, as this uses binarySource=global)