fix(deps): update dependency renovate to v42 [security]

[github-actions]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
renovate (source)	^41.46.5 → ^42.0.0

---

Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious distributionUrl

GHSA-pfq2-hh62-7m96

More information

Details

Summary

Renovate can be tricked into executing shell code while updating the Gradle Wrapper. A malicious distributionUrl in gradle/wrapper/gradle-wrapper.properties can lead to command execution in the Renovate runtime.

Details

When Renovate handles Gradle Wrapper artifacts, it may run a wrapper update command such as:

• ./gradlew :wrapper --gradle-distribution-url <value>

In the observed behavior, Renovate executes this via a shell (e.g., /bin/sh -c ...).
If distributionUrl contains shell command substitution syntax like $(...), the shell evaluates it before Gradle validates/parses the URL.

After that, Gradle attempts to parse the URL as a URI and fails with URISyntaxException, but the shell substitution has already executed.

This is reproducible even when allowScripts is disabled (default is OFF), because this execution happens as part of Gradle Wrapper artifact handling rather than “repository install scripts”.

Prerequisites / attack conditions:

• The attacker must be able to get a malicious gradle-wrapper.properties into a repository that Renovate scans (e.g., direct write access, or a maintainer merges an attacker’s change/PR).
• Renovate must be configured to process Gradle Wrapper updates/artifacts for that repository (default behavior for the Gradle Wrapper manager).

PoC

1. Create a repository with a Gradle Wrapper (gradlew, gradlew.bat, gradle/wrapper/gradle-wrapper.jar, and gradle/wrapper/gradle-wrapper.properties).
2. Set distributionUrl in gradle-wrapper.properties to include $(...).
3. Run Renovate against the repository.
4. Observe that a file is created during Renovate’s wrapper update step before Gradle fails with URISyntaxException.

A screen recording is attached showing end-to-end reproduction. In the demo, the payload creates /tmp/passwd_dump containing /etc/passwd, demonstrating that file read/exfiltration is possible within the Renovate execution context.

Impact

This allows arbitrary command execution in the Renovate runtime during Gradle Wrapper updates. Depending on deployment, this may expose credentials/tokens available to the bot and may allow an attacker to modify repositories or access internal resources reachable from the Renovate environment.

Remediation

Upgrading to Renovate 42.68.5 (2025-12-31) fixes this issue, and closes out other risks of shell evaluation for commands run by Renovate.

If using the composer, yarn (v1) or flux managers, please upgrade to 42.74.5 (2026-01-08), as there were follow-up fixes to keep these managers working.

Severity

• CVSS Score: 6.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96
• https://github.com/renovatebot/renovate
• https://github.com/renovatebot/renovate/releases/tag/42.68.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

renovatebot/renovate (renovate)

v42.68.5

Compare Source

Bug Fixes

• postUpgradeTasks: always run commands with shell mode (140a777)
• util/exec: don't use shell by default (f430552)

Documentation

• self-hosting: note risk of postUpgradeTasks with shell execution (d2872e2)

Code Refactoring

• github-actions: Simplify line parsing (#​40216) (fb80abb)
• util/exec: specify the args array for execa (a0a84a4)
• util/exec: use spawnargs to return error messages (b19c3ee)

Tests

• only validate subset of arguments to exec (bebff1c)
• remove encoding from stubs (#​40221) (8fab5f0)
• util/exec: clarify existing behaviour of shell parameter (d0bee7f)
• util/exec: document ability to use arguments with spaces (c5c98ea)

v42.68.4

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.9 (main) (#​40224) (51d097e)

v42.68.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.8 (main) (#​40223) (847413f)

Miscellaneous Chores

• deps: update python:3.14 docker digest to f05033a (main) (#​40222) (021ace6)

v42.68.2

Compare Source

Bug Fixes

• deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.19 (main) (#​40219) (16a1325)
• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.7 (main) (#​40220) (9d6553d)

v42.68.1

Compare Source

Bug Fixes

• util/exec: migrate to execa for command execution (#​40212) (e773b32)

Miscellaneous Chores

• deps: update dependency pnpm to v10.26.2 (main) (#​40217) (fdbeaba)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.25.19 (main) (#​40218) (3d8cca4)

v42.68.0

Compare Source

Features

• Add exact versioning (#​40098) (22721ed)

Miscellaneous Chores

• deps: update containerbase/internal-tools action to v3.14.42 (main) (#​40214) (73c14df)

v42.67.0

Compare Source

Features

• typst: Update datasource to use official registry API (#​38982) (151d78f)

Documentation

• remove announcement bar properly (#​40164) (99664ea)

Miscellaneous Chores

• deps: update python:3.14 docker digest to 5279485 (main) (#​40211) (4c7edaf)
• deps: update python:3.14 docker digest to 5fdc8eb (main) (#​40210) (14b4782)
• deps: update python:3.14 docker digest to 8797f8e (main) (#​40209) (e1d620e)

Code Refactoring

• util/exec: remove deprecated encoding property (#​40199) (39bfc09)

v42.66.14

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.6 (main) (#​40207) (ac0e6ae)

v42.66.13

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.5 (main) (#​40206) (a7d4425)

Miscellaneous Chores

• eslint: increase heap size to prevent OOM errors (#​40183) (6743a79)

Code Refactoring

• config: enable incremental TypeScript builds (#​40184) (cc08ce0)
• platform/local: use shared rawExec for commands (#​40200) (a0de103)

v42.66.12

Compare Source

Bug Fixes

• types: correct comments for error types (#​40202) (ef09ba0)

Documentation

• update references to renovate/renovate (main) (#​40188) (f31798a)

Miscellaneous Chores

• clarify security testing against Mend-hosted infra (#​40197) (bd365e8)
• deps: update containerbase/internal-tools action to v3.14.40 (main) (#​40190) (4bcc400)
• deps: update containerbase/internal-tools action to v3.14.41 (main) (#​40194) (00706e3)
• deps: update dependency @​containerbase/eslint-plugin to v1.1.24 (main) (#​40191) (40c49e6)
• deps: update dependency @​containerbase/istanbul-reports-html to v1.1.21 (main) (#​40192) (dc8d9f9)
• deps: update dependency @​containerbase/semantic-release-pnpm to v1.3.12 (main) (#​40193) (f4663e7)
• deps: update dependency renovatebot/github-action to v44.2.2 (main) (#​40195) (9ef65b9)
• deps: update dependency typescript-eslint to v8.50.1 (main) (#​40204) (ab6bfa5)

Code Refactoring

• github: add GraphQL branch query adapter (#​40177) (65a961c)

v42.66.11

Compare Source

Bug Fixes

• cache: use bitbucket-server as platform cache key (#​40168) (fb15aa4)

Miscellaneous Chores

• build: exclude nested node_modules from tsconfig (#​40179) (4b8803d)

v42.66.10

Compare Source

Bug Fixes

• manager/gradle: ignore DependencySubstitution modules (#​39965) (4392c1c)

v42.66.9

Compare Source

Build System

• deps: update dependency re2 to v1.23.0 (main) (#​40173) (76db2ee)

v42.66.8

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.4 (main) (#​40161) (7c08a22)

Miscellaneous Chores

• deps: update dependency pnpm to v10.26.1 (main) (#​40160) (fd41ae7)

v42.66.7

Compare Source

Miscellaneous Chores

• deps: update dependency @​smithy/util-stream to v4.5.8 (main) (#​40157) (2e0dc7c)

Build System

• deps: update dependency validate-npm-package-name to v7.0.1 (main) (#​40159) (fc5f112)

v42.66.6

Compare Source

Build System

• deps: update dependency @​renovatebot/detect-tools to v1.2.6 (main) (#​40155) (ca622da)
• deps: update dependency @​renovatebot/osv-offline to v2.0.1 (main) (#​40156) (6fa1935)

v42.66.5

Compare Source

Build System

• deps: update dependency fs-extra to v11.3.3 (main) (#​40154) (41287d1)

v42.66.4

Compare Source

Build System

• deps: update opentelemetry-js-contrib monorepo (main) (#​40150) (c3a7517)

v42.66.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.3 (main) (#​40148) (5266ce6)

v42.66.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.2 (main) (#​40133) (c5105d0)

Miscellaneous Chores

• deps: update dependency esbuild to v0.27.2 (main) (#​40131) (be368e8)
• deps: update dependency pdm to v2.26.3 (main) (#​40132) (98acb15)

v42.66.1

Compare Source

Bug Fixes

• instrumentation: instrument command execution (#​39654) (5c1cec3), closes #​38609

Miscellaneous Chores

• deps: update dependency @​smithy/util-stream to v4.5.7 (main) (#​40121) (9e6ab3e)
• deps: update dependency typescript-eslint to v8.50.0 (main) (#​40118) (abb6ad7)
• deps: update vitest monorepo to v4.0.16 (main) (#​40125) (57c47be)

Tests

• exec: clarify rawExec vs exec tests (#​40123) (650b2be)

v42.66.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.20.1 (main) (#​40115) (bbe357e)

v42.65.2

Compare Source

Bug Fixes

• deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.18 (main) (#​40113) (ef0a84b)

Miscellaneous Chores

• deps: update dependency pnpm to v10.26.0 (main) (#​40111) (d5b91ba)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.25.18 (main) (#​40112) (d6f3876)

v42.65.1

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.19.4 (main) (#​40110) (e6dd79a)

Build System

• deps: update dependency azure-devops-node-api to v15.1.2 (main) (#​40109) (6803124)

v42.65.0

Compare Source

Features

• Add Broadcom App Catalog to bitnami workaround (#​40082) (7a5f834)

Bug Fixes

• deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.17 (main) (#​40108) (e659a7c)

Documentation

• update references to renovate/renovate (main) (#​40099) (b68c9b8)

Miscellaneous Chores

• deps: lock file maintenance (main) (#​40100) (0af8d9b)
• deps: update containerbase/internal-tools action to v3.14.36 (main) (#​40084) (2f6143d)
• deps: update containerbase/internal-tools action to v3.14.38 (main) (#​40102) (1ccf98c)
• deps: update dependency @​containerbase/eslint-plugin to v1.1.23 (main) (#​40103) (4cd1936)
• deps: update dependency @​containerbase/istanbul-reports-html to v1.1.19 (main) (#​40085) (6a6a147)
• deps: update dependency @​containerbase/istanbul-reports-html to v1.1.20 (main) (#​40104) (9fa1efe)
• deps: update dependency @​containerbase/semantic-release-pnpm to v1.3.10 (main) (#​40087) (17582a8)
• deps: update dependency @​containerbase/semantic-release-pnpm to v1.3.11 (main) (#​40105) (ed4a3cb)
• deps: update dependency @​types/node to v22.19.3 (main) (#​40093) (04723b5)
• deps: update dependency renovatebot/github-action to v44.2.1 (main) (#​40106) (a3a3c92)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.25.17 (main) (#​40107) (b16614d)
• deps: update linters to v9.39.2 (main) (#​40088) (478f46f)

v42.64.1

Compare Source

Build System

• deps: update dependency xmldoc to v2.0.3 (main) (#​40073) (b88461f)

v42.64.0

Compare Source

Features

• homebrew: support NPM packages (#​40059) (f3c3fe8)

Code Refactoring

• platforms: changes around createdAt field (#​40063) (a052292)

v42.63.0

Compare Source

Features

• dashboard: detected dependencies update new values (#​40032) (5e1da5e)

Bug Fixes

• composer: Remove composer.lock file for lock file maintenance (#​39920) (a30c550)

Miscellaneous Chores

• presets: add sourceUrl for group:apiPlatform (#​39742) (93f9cd8)

v42.62.0

Compare Source

Features

• add allowedUnsafeExecutions for ./gradlew (#​39945) (f504709)

Bug Fixes

• deps: update dependency mkdocs-material to v9.7.1 (main) (#​40062) (0646aad)

Documentation

• gradle: clarify ./gradlew for Verificaton Metadata updates (#​40044) (0723e80)

v42.61.0

Compare Source

Features

• presets: expand tsconfigNodeVersions file patterns (#​40034) (71e1724)

v42.60.0

Compare Source

Features

• presets: add new preset workarounds:clamavDockerImageVersioning (#​40035) (dfde989)

Documentation

• remove announcement banner (#​40043) (a4b9a9a)

Miscellaneous Chores

• deps: update dependency @​containerbase/istanbul-reports-html to v1.1.18 (main) (#​40042) (2b0a5b1)

Code Refactoring

• homebrew: modernize manager (#​39926) (c25c393)
• replacements: tsconfig extends custom manager (#​40055) (78f72bf)
• update fixture headers (#​40031) (fd149d6)
• use unicode right-arrow for changes template (#​40033) (7309d18)

v42.59.1

Compare Source

Bug Fixes

• galaxy-collection: make sure that releaseTimestamp is returned correctly (#​39899) (844e299), closes #​35936

v42.59.0

Compare Source

Features

• custom: support tsconfig/node in extends array (#​40030) (384018a)

v42.58.4

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.19.3 (main) (#​40036) (179d527)

v42.58.3

Compare Source

Bug Fixes

• forgejo: support fallback for all forgejo-* host types (#​39968) (a8ee664)

Miscellaneous Chores

• deps: update github/codeql-action action to v4.31.9 (main) (#​40029) (a39c529)

v42.58.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.19.2 (main) (#​40025) (54cf847)

v42.58.1

Compare Source

Miscellaneous Chores

• deps: update vite to v8 (#​39993) (da6234d)

Code Refactoring

• Cache decorator (#​40014) (cc60dfd)
• Refactor TTL tests (#​40015) (4c91716)

Build System

• deps: update dependency openpgp to v6.3.0 (main) (#​40024) (b4475ec)

v42.58.0

Compare Source

Features

• log all awaiting schedule (#​40021) (912d19b)

Bug Fixes

• add missing type definitions for autoApprove and prTitleStrict (#​40016) (e4dd2d2)
• deps: update ghcr.io/renovatebot/base-image docker tag to v12.19.1 (main) (#​40023) (fde321f)
• github/vulnerabilityAlerts: don't error on unknown ecosystems (#​39417) (2809af3)

Miscellaneous Chores

• deps: update dependency @​types/node to v22.19.2 (main) (#​40017) (2723823)
• deps: update otel/opentelemetry-collector-contrib docker tag to v0.142.0 (main) (#​40019) (6befa87)
• deps: update prom/prometheus docker tag to v3.8.1 (main) (#​40022) (ccc0929)
• deps: update python:3.14 docker digest to 492b292 (main) (#​40018) (9f49cbf)

v42.57.1

Compare Source

Bug Fixes

• onboarding: prevent secrets resolution (#​39624) (2298b2f)

Miscellaneous Chores

• deps: update dependency typescript-eslint to v8.49.0 (main) (#​40012) (0554c76)

v42.57.0

Compare Source

Features

• self-hosted: onboardingAutoCloseAge (#​39876) (ef0ff99)

v42.56.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.19.0 (main) (#​40010) (b0b573c)

v42.55.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.18.0 (main) (#​40009) (51e96cf)

Miscellaneous Chores

• deps: update dependency pnpm to v10.25.0 (main) (#​40008) (07eb02d)

v42.54.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.17.7 (main) (#​40005) (0669245)

v42.54.2

Compare Source

Bug Fixes

• deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.16 (main) (#​40003) (4aae3f7)

Miscellaneous Chores

• deps: update dependency @​vitest/eslint-plugin to v1.5.2 (main) (#​39675) (225e2b7)
• deps: update dependency renovatebot/github-action to v44.2.0 (main) (#​40001) (61f6865)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.25.16 (main) (#​40002) (841715e)

v42.54.1

Compare Source

Bug Fixes

• presets: helpers:githubDigestChangelogs should only apply to Git digest updates (#​39995) (1bd574c)

v42.54.0

Compare Source

Features

• bitbucket: massage markdown for collapsible sections section (#​39720) (aacb026)

Bug Fixes

• gerrit: pass credentials to api calls in initPlatform (#​39970) (32bf2bf)
• maven: preserve the original version when versionCompatibility is used for later lookup (#​38906) (1e3d873)

Documentation

• npm-unpublish: Correct npm unpublish time frame 24h -> 72h (#​39941) (a67d6af)

Miscellaneous Chores

• minimumReleaseAge: only log once per case of "did not have a releaseTimestamp" (#​39936) (847c980)

v42.53.0

Compare Source

Features

• replacements: Adds replacement for Docker grafana/grafana-oss to grafana/grafana (#​39512) (d64c669)

Bug Fixes

• github-actions: handling of quoted Docker image references (#​39635) (fef1439)
• gitlab: properly massage config migration MR links (#​39474) (32befe2), closes #​32178
• pip-requirements: Make the version specifier in pip-requirements with extras (e.g. mypackage[myextra]) optional (#​39480) (9499ad6)

Documentation

• update references to renovate/renovate (main) (#​39986) (f31419a)

Miscellaneous Chores

• deps: lock file maintenance (main) (#​39987) (101d1e6)
• deps: update containerbase/internal-tools action to v3.14.34 (main) (#​39988) (fa9503f)
• deps: update containerbase/internal-tools action to v3.14.35 (main) (#​39992) (43911e5)
• deps: update dependency @​containerbase/eslint-plugin to v1.1.22 (main) (#​39989) (a7595f3)
• deps: update dependency @​containerbase/istanbul-reports-html to v1.1.17 (main) (#​39990) (054303f)
• deps: update dependency @​containerbase/semantic-release-pnpm to v1.3.9 (main) (#​39991) (df20c3a)

v42.52.8

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.17.6 (main) (#​39984) (67d91e8)

v42.52.7

Compare Source

Bug Fixes

• deps: update ghcr.io/containerbase/sidecar docker tag to v13.25.15 (main) (#​39983) (95168e0)

Miscellaneous Chores

• deps: update dependency type-fest to v5.3.1 (main) (#​39980) (9f0440d)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.25.15 (main) (#​39982) (7dd2f12)

v42.52.6

Compare Source

Build System

• deps: update dependency @​renovatebot/detect-tools to v1.2.5 (main) (#​39977) (e2cec35)

v42.52.5

Compare Source

Build System

• deps: update dependency toml-eslint-parser to v0.10.1 (main) (#​39976) (06812d6)

v42.52.4

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v12.17.5 (main) (#​39975) (5a6308c)

Miscellaneous Chores

• deps: update dependency markdownlint-cli2 to v0.20.0 (main) (#​39974) (6a1adb6)

[v42.52.3](https://redirect.g

---

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.