feat(deps)!: Update Renovate (major)

Joris Kraakrequested to merge
renovate/major-renovate into main

This MR contains the following updates:

Package Type Update Change
ghcr.io/renovatebot/renovate (source) major 41.173.1 -> 42.13.3
renovate-bot/renovate-runner repository major v24.0.0 -> v25.0.0

Release Notes

renovatebot/renovate (ghcr.io/renovatebot/renovate)

v42.13.3

Compare Source

Miscellaneous Chores
Build System

v42.13.2

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.5.3 (main) (#​39360) (43799bd)
Documentation
Continuous Integration
  • close-answered-discussions: reduce number of discussions per page (#​39358) (99617c9)

v42.13.0

Compare Source

Features
Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.5.2 (main) (#​39350) (8cde76c)
Documentation
Continuous Integration

v42.12.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.5.1 (main) (#​39345) (65e99f0)
Continuous Integration

v42.12.0

Compare Source

Features
Bug Fixes
  • datasource/pypi: sponsors URL vs sponsors in project name mixup (#​39225) (7a01aa4)
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.4.1 (main) (#​39320) (44ab523)
Documentation
Miscellaneous Chores
Build System
Continuous Integration

v42.11.0

Compare Source

Features
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.3.0 (main) (#​39308) (b52a96b)
Miscellaneous Chores

v42.10.5

Compare Source

Bug Fixes
  • deps: update ghcr.io/containerbase/sidecar docker tag to v13.24.3 (main) (#​39300) (808801d)
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v13.24.3 (main) (#​39299) (5e541b8)

v42.10.4

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.2.1 (main) (#​39298) (1861733)

v42.10.3

Compare Source

Miscellaneous Chores
Build System

v42.10.2

Compare Source

Bug Fixes
Documentation
  • minimumReleaseAge: further clarify what happens with multiple releases (#​39266) (ab1f7c0)
Tests

v42.10.1

Compare Source

Build System
  • deps: update opentelemetry-js monorepo to v0.208.0 (main) (#​39293) (f2c01cb)

v42.10.0

Compare Source

Features
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.2.0 (main) (#​39291) (0431ed7)
Miscellaneous Chores
  • deps: update docker/dockerfile docker tag to v1.20.0 (main) (#​39290) (c050b18)
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v13.24.2 (main) (#​39289) (d19a32e)

v42.9.2

Compare Source

Miscellaneous Chores
Build System

v42.9.1

Compare Source

Bug Fixes
  • config/validation: don't allow global: presets outside of global configuration (#​39211) (7092644)

v42.9.0

Compare Source

Features
Bug Fixes

v42.8.1

Compare Source

Bug Fixes
  • gerrit: avoid retrieving messages in updatePr and createPr (#​39015) (84633f1)

v42.8.0

Compare Source

Features

v42.7.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.1.8 (main) (#​39262) (4a8391e)
Documentation
Miscellaneous Chores

v42.7.0

Compare Source

Features
Bug Fixes
Miscellaneous Chores
Tests

v42.6.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.1.7 (main) (#​39253) (c505dd6)
Miscellaneous Chores

v42.6.2

Compare Source

Miscellaneous Chores
Build System

v42.6.1

Compare Source

Build System

v42.6.0

Compare Source

Features
  • manager/gradle: add support for variables in plugin names (#​39002) (96a7d27)

v42.5.4

Compare Source

Bug Fixes
  • deps: update dependency mkdocs-material to v9.7.0 (main) (#​39227) (50b4d13)

v42.5.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.1.6 (main) (#​39224) (684ce89)

v42.5.2

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.1.5 (main) (#​39220) (808029c)
Miscellaneous Chores
  • deps: update actions/dependency-review-action action to v4.8.2 (main) (#​39219) (a17245c)

v42.5.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/containerbase/sidecar docker tag to v13.24.1 (main) (#​39218) (909e043)
Miscellaneous Chores
  • deps: update ghcr.io/containerbase/devcontainer docker tag to v13.24.1 (main) (#​39217) (4532ddd)
  • deps: update linters to v9.39.1 (main) (#​39216) (b607128)

v42.5.0

Compare Source

Features
  • add configValidationError option to log config validation errors as errors instead of warnings (#​39177) (83d6464)
Miscellaneous Chores
  • deps: update dependency typescript-eslint to v8.46.3 (main) (#​39209) (39b7896)
Build System

v42.4.1

Compare Source

Bug Fixes
  • ignore .npmrc when the npmrc configuration is being used (#​39205) (67b256a)
Documentation
Code Refactoring

v42.4.0

Compare Source

Features
Miscellaneous Chores

v42.3.0

Compare Source

Features
  • argocd: support OCI Helm charts without explicit chart field (#​39149) (82c09ba)
Documentation
Miscellaneous Chores

v42.2.0

Compare Source

Features
  • manager/npm: use volta node pin as node version constraint (#​38816) (3b81143)
Miscellaneous Chores
Build System

v42.1.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.1.4 (main) (#​39174) (1216402)
Build System

v42.1.2

Compare Source

Bug Fixes

v42.1.1

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.1.3 (main) (#​39172) (0ffd324)

v42.1.0

Compare Source

Features
Code Refactoring
  • deb: Split DebDatasource in smaller pieces and prepare for mutli-compression feature (#​38254) (5d36cf1)
  • presets: add type for presets with global-only configuration (#​39166) (8348930)
Build System
Continuous Integration

v42.0.3

Compare Source

Bug Fixes
  • deps: update ghcr.io/renovatebot/base-image docker tag to v12.1.2 (main) (#​39164) (534a686)
Documentation

v42.0.2

Compare Source

Bug Fixes
Miscellaneous Chores

v42.0.1

Compare Source

Documentation
Miscellaneous Chores
Build System
  • deps: update dependency google-auth-library to v10.5.0 (main) (#​39146) (748a623)

v42.0.0

Compare Source

Breaking changes for 42

Using minimumReleaseAge will now require a release timestamp #​38843

When specifying minimumReleaseAge, Renovate will look for a release timestamp to determine the age of the release, and whether it matched the minimumReleaseAge configuration.

Before Renovate 42, if a release timestamp was not present, Renovate would treat the dependency update as if the release timestamp was present and the dependency had passed that lifetime.

This means that users with artifact proxies, or in cases that the release timestamp wasn't consistently present could lead to dependencies "slipping through", and being updated before Renovate's policy enforced it to.

As of Renovate 42, the configuration minimumReleaseAgeBehaviour (added in 41.150.0) requires the release timestamp to be present.

If the release timestamp isn't present, Renovate will mark it as "awaiting schedule", and will output a debug log message to explain why.

You can revert to the existing behaviour by setting minimumReleaseAgeBehaviour=timestamp-optional.

Note that not all datasources support this functionality, nor do custom registries (such as Artifactory, etc). For more details on how to verify support for your repository, check out the Minimum Release Age documentation

minimumReleaseAge: 3 days will now be set by default for npm in config:best-practices #​37967

For users of config:best-practices, the Minimum Release Age functionality will now apply by default for the npm ecosystem.

This will introduce a delay of 3 days between package publishing and Renovate suggesting an update for the release, so:

  • there is time for malware researchers and scanners to (possibly) detect any malicious behaviour in new releases, before your CI infrastructure or developers receive a malicious version upgrade
  • you are not at risk of the package being unpublished in the 3 day window that the npm registry allows

This will be enforced by default for packages using the npm datasource via the security:minimumReleaseAgeNpm preset.

[!NOTE] This may require additional configuration if using a custom registry, or you have packages that you wish to not have minimum release age checks.

For more details on this functionality, check out the Minimum Release Age documentation.

Renovate now defaults to using Node.JS 24 #​38939

With Node 24 now in Long Term Support (LTS) release status, we have moved to target Node.JS 24 (^24.11.0) as our default engine for Node, and retain support for Node 22.

The pre-built Docker containers have been updated to use Node 24.

If you self-host without using our Docker image, you should be able to continue running Renovate with Node 22, for instance if you build your own image, or run the renovate npm package.

Redis clusters now authenticate to all nodes in the cluster with the provided credentials

When running Renovate against a Redis cluster with authentication, it was possible that a NOAUTH Authentication required error may appear:

DEBUG: Redis cache init
DEBUG: Redis cache connected
...
 WARN: Error while setting Redis cache value (repository=jcl-test/example)
       "err": {"message": "NOAUTH Authentication required."}

Renovate will now use the same authentication for all nodes in a cluster.

Support Yarn Catalogs #​38215

We now support the official Yarn Catalog functionality.

As part of this, we have removed support for the yarn-plugin-catalogs community plugin.

If you are using the yarn-plugin-catalogs community plugin, you will need to migrate your catalogs to the official Yarn Catalog functionality before Renovate 42 will update your dependencies.

Remove versioning modules needing to implement rangeStrategy=pin #​36261

This is an internal refactor to make it easier for creating and maintaining versioning modules.

This should not be a non-breaking change, as the versioning modules will have defaults available.

However, we're releasing it as part of this major release, and highlighting it, in case it does lead to breaking changes.

PGP encryption is now performed using Bouncy Castle #​39032

GPG encryption is no longer performed using kbpgp Keybase's PGP for JavaScript), and has been replaced with a Bouncy Castle version.

Some users have found license compliance issues with the kbpgp package, so this will now resolve them.

Legacy RSA encryption has been removed #​39111

Deprecated since 37.315.0 (2024-04-21), the legacy RSA encryption is now no longer available.

Change to the default User Agent #​37535

The user-agent header for Renovate's outgoing HTTP calls has changed the default to Renovate/${version}.

Default tool version updates #​39100

For users of the upstream Renovate container images, the following tools have been updated to new major versions:

Tool Version
Erlang 28
Gradle 9
Java 25
Node 24
Python 3.14.0

Commentary for 42

Focus on minimumReleaseAge

You'll notice that there are a number of big features here - and in recent minor releases - that focus on Minimum Release Age.

With recent supply chain attacks, the Renovate team have been hard at work improving the support we've had in Renovate (since 2019!) for this functionality, and making it as predictable as possible, so we can then enable it by default for users of config:best-practices.

You can read more about this focus in a blog post we've written on the Mend blog.

We're starting with the enabling of the npm datasource, but will look to extend this functionality in future major releases, based on community feedback, and ecosystem support.

Deprecations

As part of this release, we want to make you aware of deprecated features which will be removed as of Renovate 43:

42.0.0 (2025-11-06)

⚠️ BREAKING CHANGES
  • deps: Update ghcr.io/renovatebot/base-image Docker tag to v12 (main) (#​39100)
  • deps: Needs NodeJS v24.11.0 instead of v24.10.0. NodeJS v22 is still supported.
  • npm: communit plugin yarn-catalogs-plugin is not supported anymore
  • drop legacy rsa encryption (#​39111)
  • remove rangeStrategy=pin from versioning modules (#​36261)
  • minimumReleaseAge: require a release timestamp by default (#​38843)
  • best-practices: provide default minimumReleaseAge for npm (#​37967)
  • redis: add default auth to redis clusters (#​37337)
  • remove the "Bot" from user-agent header (#​37535)
Features
Bug Fixes
Code Refactoring
Build System
renovate-bot/renovate-runner (renovate-bot/renovate-runner)

v25.0.0

Compare Source

⚠️ BREAKING CHANGES
Features
Documentation
  • Add info about onboarding config behavior (renovate-bot/renovate-runner!3326 (merged)) (f41b890)
  • update dependencies (c2c469a)
  • update references to ghcr.io/renovatebot/renovate to v41.113.3 (1b619c8)
  • update references to ghcr.io/renovatebot/renovate to v41.122.3 (8ca16b4)
  • update references to ghcr.io/renovatebot/renovate to v41.132.5 (renovate-bot/renovate-runner!3331 (merged)) (2e9f888)
  • update references to ghcr.io/renovatebot/renovate to v41.135.5 (4b60062)
  • update references to ghcr.io/renovatebot/renovate to v41.146.0 (69d1d98)
  • update references to ghcr.io/renovatebot/renovate to v41.152.9 (5add397)
  • update references to ghcr.io/renovatebot/renovate to v41.159.4 (2477096)
  • update references to ghcr.io/renovatebot/renovate to v41.169.1 (d83ab04)
  • update references to ghcr.io/renovatebot/renovate to v41.32.1 (3c83e15)
  • update references to ghcr.io/renovatebot/renovate to v41.40.0 (d33f981)
  • update references to ghcr.io/renovatebot/renovate to v41.43.5 (fd7ec7c)
  • update references to ghcr.io/renovatebot/renovate to v41.51.1 (89cc2d0)
  • update references to ghcr.io/renovatebot/renovate to v41.61.1 (181c08e)
  • update references to ghcr.io/renovatebot/renovate to v41.76.0 (8f102b3)
  • update references to ghcr.io/renovatebot/renovate to v41.82.10 (4319a62)
  • update references to ghcr.io/renovatebot/renovate to v41.91.3 (0a80216)
  • update references to ghcr.io/renovatebot/renovate to v41.97.9 (5d6490a)
Miscellaneous Chores
  • config: migrate renovate config (renovate-bot/renovate-runner!3313 (merged)) (76f1c2c)
  • deps: lock file maintenance (140eb9a)
  • deps: lock file maintenance (241213b)
  • deps: lock file maintenance (0727ba4)
  • deps: lock file maintenance (1d97461)
  • deps: lock file maintenance (70ba039)
  • deps: lock file maintenance (51d14f2)
  • deps: lock file maintenance (bf76bba)
  • deps: lock file maintenance (87c61ab)
  • deps: lock file maintenance (8dbecac)
  • deps: lock file maintenance (edf7851)
  • deps: lock file maintenance (0e078f9)
  • deps: lock file maintenance (72b610e)
  • deps: lock file maintenance (634e7f7)
  • deps: lock file maintenance (5f00a6f)
  • deps: lock file maintenance (4feef66)
  • deps: lock file maintenance (renovate-bot/renovate-runner!3332 (merged)) (b1a62c3)
  • deps: update dependency @​semantic-release/gitlab to v13.2.7 (048f24a)
  • deps: update dependency @​semantic-release/gitlab to v13.2.8 (b0e3425)
  • deps: update dependency @​semantic-release/gitlab to v13.2.9 (af99fa1)
  • deps: update dependency conventional-changelog-conventionalcommits to v9 (renovate-bot/renovate-runner!3325 (merged)) (7489a8d)
  • deps: update dependency conventional-changelog-conventionalcommits to v9.1.0 (00e333e)
  • deps: update dependency prettier to v3.6.0 (8051b0f)
  • deps: update dependency prettier to v3.6.1 (b6ec6a2)
  • deps: update dependency prettier to v3.6.2 (bacd703)
  • deps: update dependency semantic-release to v24.2.6 (495ccac)
  • deps: update dependency semantic-release to v24.2.7 (e499155)
  • deps: update dependency semantic-release to v24.2.8 (d84cd16)
  • deps: update dependency semantic-release to v24.2.9 (renovate-bot/renovate-runner!3330 (merged)) (50ac61a)
  • deps: update ghcr.io/containerbase/node docker digests to 02fff10 (371d901)
  • deps: update ghcr.io/containerbase/node docker digests to 0436008 (e81fb30)
  • deps: update ghcr.io/containerbase/node docker digests to 0854715 (f17838a)
  • deps: update ghcr.io/containerbase/node docker digests to 0caffc0 (808f89d)
  • deps: update ghcr.io/containerbase/node docker digests to 12541c6 (220a81b)
  • deps: update ghcr.io/containerbase/node docker digests to 147e153 (6b7f10f)
  • deps: update ghcr.io/containerbase/node docker digests to 1975866 (e28d398)
  • deps: update ghcr.io/containerbase/node docker digests to 1ac33b9 (1dcf961)
  • deps: update ghcr.io/containerbase/node docker digests to 29bbd55 (8846157)
  • deps: update ghcr.io/containerbase/node docker digests to 2bc8d39 (45b2562)
  • deps: update ghcr.io/containerbase/node docker digests to 2f1b9ab (5037119)
  • deps: update ghcr.io/containerbase/node docker digests to 2f4b266 (0e4c4e6)
  • deps: update ghcr.io/containerbase/node docker digests to 3100285 (cf77130)
  • deps: update ghcr.io/containerbase/node docker digests to 325512e (7e859cc)
  • deps: update ghcr.io/containerbase/node docker digests to 34086ab (0e0f510)
  • deps: update ghcr.io/containerbase/node docker digests to 36be61a (86cc1cd)
  • deps: update ghcr.io/containerbase/node docker digests to 3777548 (3d038f0)
  • deps: update ghcr.io/containerbase/node docker digests to 40e354c (f1465ba)
  • deps: update ghcr.io/containerbase/node docker digests to 46c849f (a85a279)
  • deps: update ghcr.io/containerbase/node docker digests to 4de8607 (847fe15)
  • deps: update ghcr.io/containerbase/node docker digests to 4df946c (175b01c)
  • deps: update ghcr.io/containerbase/node docker digests to 5056795 (9df98c0)
  • deps: update ghcr.io/containerbase/node docker digests to 51f3756 (1059788)
  • deps: update ghcr.io/containerbase/node docker digests to 53f3230 (9128983)
  • deps: update ghcr.io/containerbase/node docker digests to 5948412 (ff8299e)
  • deps: update ghcr.io/containerbase/node docker digests to 5d4bf54 (de4db04)
  • deps: update ghcr.io/containerbase/node docker digests to 5e76a37 (815f038)
  • deps: update ghcr.io/containerbase/node docker digests to 61def4d (667c501)
  • deps: update ghcr.io/containerbase/node docker digests to 6e5bb25 (8a33e6e)
  • deps: update ghcr.io/containerbase/node docker digests to 71f08b4 (f26bdbe)
  • deps: update ghcr.io/containerbase/node docker digests to 736c07d (dd9b2f9)
  • deps: update ghcr.io/containerbase/node docker digests to 75cd886 (b8950e1)
  • deps: update ghcr.io/containerbase/node docker digests to 7667e6b (816e7f1)
  • deps: update ghcr.io/containerbase/node docker digests to 788fc81 (05934e7)
  • deps: update ghcr.io/containerbase/node docker digests to 7def8d5 (281473d)
  • deps: update ghcr.io/containerbase/node docker digests to 812af8d (b617132)
  • deps: update ghcr.io/containerbase/node docker digests to 8c42cd7 (6cb4be1)
  • deps: update ghcr.io/containerbase/node docker digests to 8e9fa0b (7f71e67)
  • deps: update ghcr.io/containerbase/node docker digests to 8f03344 (acd51b0)
  • deps: update ghcr.io/containerbase/node docker digests to 945a020 (0456eab)
  • deps: update ghcr.io/containerbase/node docker digests to 9efad3c (c331eca)
  • deps: update ghcr.io/containerbase/node docker digests to a2ad477 (e5d9bee)
  • deps: update ghcr.io/containerbase/node docker digests to a4a1f9c (209a5e4)
  • deps: update ghcr.io/containerbase/node docker digests to a4ce1a2 (8a186ac)
  • deps: update ghcr.io/containerbase/node docker digests to ac2d7bf (8535ef1)
  • deps: update ghcr.io/containerbase/node docker digests to ae575b0 (df2b6d1)
  • deps: update ghcr.io/containerbase/node docker digests to b735d99 (73351a8)
  • deps: update ghcr.io/containerbase/node docker digests to b9bfa05 (41aea34)
  • deps: update ghcr.io/containerbase/node docker digests to bad6d47 (27e892b)
  • deps: update ghcr.io/containerbase/node docker digests to bd92011 (da19f7f)
  • deps: update ghcr.io/containerbase/node docker digests to bfc4e94 (64221bb)
  • deps: update ghcr.io/containerbase/node docker digests to c6545f4 (76e2479)
  • deps: update ghcr.io/containerbase/node docker digests to cf571ba (927b4ce)
  • deps: update ghcr.io/containerbase/node docker digests to d66fad8 (ddbfe94)
  • deps: update ghcr.io/containerbase/node docker digests to d76acd8 (8bf15e4)
  • deps: update ghcr.io/containerbase/node docker digests to da58144 (18cd182)
  • deps: update ghcr.io/containerbase/node docker digests to de646cf (a94c4d5)
  • deps: update ghcr.io/containerbase/node docker digests to e2df4cd (6361ea1)
  • deps: update ghcr.io/containerbase/node docker digests to e57bf43 (renovate-bot/renovate-runner!3328 (merged)) (b0a6595)
  • deps: update ghcr.io/containerbase/node docker digests to e7150ce (420da78)
  • deps: update ghcr.io/containerbase/node docker digests to e79a56b (df49d1c)
  • deps: update ghcr.io/containerbase/node docker digests to eb977f7 (eee4e58)
  • deps: update ghcr.io/containerbase/node docker digests to ee6ca89 (439beed)
  • deps: update ghcr.io/containerbase/node docker digests to f000ac9 (eeb4299)
  • deps: update ghcr.io/containerbase/node docker digests to f0f728d (a678d5e)
  • deps: update ghcr.io/containerbase/node docker digests to f5b5cc5 (dfbe3b4)
  • deps: update ghcr.io/containerbase/node docker digests to f67bcbb (0790163)
  • deps: update ghcr.io/containerbase/node docker digests to f6fde72 (79c76af)
  • deps: update node.js to v22.17.1 (fa73149)
  • deps: update node.js to v22.18.0 (1bf920f)
  • deps: update node.js to v22.19.0 (30b6364)
  • deps: update node.js to v22.20.0 (renovate-bot/renovate-runner!3329 (merged)) (7b9bfd3)
  • deps: update node.js to v22.21.0 (d160779)
  • deps: update node.js to v22.21.1 (c90d108)
  • deps: update node.js to v24 (renovate-bot/renovate-runner!3333 (merged)) (051cfd9)
  • renovate: do not bump version for docs update (e97806f), closes renovate-bot/renovate-runner#124 (closed)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports