Git · Renovate · CVE-2026-88884
**Name of the Vulnerable Software and Affected Versions**
Renovate versions prior to 44.3.1
Mend Renovate CE/EE images versions prior to 15.4.0
mend-renovate-ce Helm chart versions prior to 15.4.0
mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0
**Description**
Digest updates are not subject to internal `minimumReleaseAge` stability age checks. When a repository uses `minimumReleaseAge` and has dependencies with `updateType=digest` (such as Docker images, Go modules, NuGet packages, or GitHub Actions pinned to a commit SHA with a floating tag), the tool may open a pull request for a newly published digest. This allows potentially malicious dependency versions to trigger pull requests and CI workflows before the configured minimum release age has elapsed.
**Recommendations**
Update Renovate to version 44.3.1.
Update Mend Renovate CE/EE images to version 15.4.0.
Update mend-renovate-ce Helm chart to version 15.4.0.
Update mend-renovate-enterprise-edition Helm chart to version 10.4.0.
As a temporary workaround, disable digest updates or gate them behind `dependencyDashboardApproval`.