Update ghcr.io/mend/renovate-ce Docker tag to v15.10.0

v15.10.0: : Out-of-band security release

Compare Source

[!IMPORTANT]
Note that this is the second of a few planned out-of-band security patches we have, due to the eMudhra CA compromise, and high/critical vulnerabilities across many ecosystems.

An additional release is planned early next week.

Application changes

• Renovate CLI: Update from 44.176.3 to 44.180.0
  • Docs
  • Pre-built documentation site
  • Full changelog
  • 🆕 new grouped changelog summary - see 44.180.0.md in release attachments
    • this is an experimental summary - feedback welcome!
• chore: update dependencies (see full list below for tools in the worker)
  • Java:
    • updated to 25.0.5+8.0.LTS (which not longer trusts the eMudhra CA)
  • jb:
    • updated the bundled command-line tool to be built with Go 1.27.3
  • Git:
    • Rolled back a change that broke read-only filesystem usage

Notable security fixes from 10.9.0

• chore: update dependencies
  • NodeJS 24.22.1
  • PHP 8.5.2
  • Go 1.27.3
  • Internal tools using Go to be built with Go 1.27.3
  • Renovate EE server image now uses a slimmer base image based on node:trixie-slim
  • ca-certificates updated to 20260816ubuntu0.24.04.1

Default tool versions

This release updates the tool versions installed on the images as follows.

In the "slim" images (ghcr.io/mend/renovate-ee-worker:15.10.0 and ghcr.io/mend/renovate-ce:15.10.0), the default tools are now:

(New tools are installed dynamically, as this uses binarySource=install)

In the "full" images (ghcr.io/mend/renovate-ee-worker:15.10.0-full and ghcr.io/mend/renovate-ce:15.10.0-full), the default tools are now:

(No new tools are installed dynamically, as this uses binarySource=global)

v15.9.0: : Out-of-band security release

Compare Source

[!CAUTION]
We recommend skipping this release, and immediately upgrading to 15.10.0, due to known issues in this release, which are fixed in 15.10.0

[!IMPORTANT]
Note that this is the first of a few planned out-of-band security patches we have, due to the eMudhra CA compromise, and high/critical vulnerabilities across many ecosystems.

An additional release is planned later today.

Known issues

• Java:
  • Still trusts the eMudhra CA
  • Using an older version of the JDK - we're blocked by there not being an upstream-built aarch64 build of the JDK that we use (renovatebot/base-image#3708)
• Git:
  • Our custom build of Git (which we will revert in the next release) leads to issues with read-only filesystems and i.e. containerbase/base#7922

Application changes

• Renovate CLI: Update from 44.164.1 to 44.176.3
  • Docs
  • Pre-built documentation site
  • Full changelog
  • 🆕 new grouped changelog summary - see 44.176.3.md in release attachments
    • this is an experimental summary - feedback welcome!
• chore: update dependencies (see full list below for tools in the worker)
  • NodeJS 24.22.1
  • PHP 8.5.2
  • Internal tools using Go to be built with Go 1.27.3
  • EE Slim image now uses a slimmer base image based on Debian Trixie
  • ca-certificates updated to 20260816ubuntu0.24.04.1

Dependency updates

• chore(deps): update dependency helm to v3.22.1 (main) by @​renovate[bot] in #​941

Default tool versions

This release updates the tool versions installed on the images as follows.

Enterprise Edition (EE)

In the "slim" worker image (ghcr.io/mend/renovate-ee-worker:15.9.0), the default tools are now:

(New tools are installed dynamically, as this uses binarySource=install)

In the "full" image (ghcr.io/mend/renovate-ee-worker:15.9.0-full) , the default tools are now:

(No new tools are installed dynamically, as this uses binarySource=global)

Community Edition (CE)

In the "slim" image (ghcr.io/mend/renovate-ce:15.9.0), the default tools are now:

(New tools are installed dynamically, as this uses binarySource=install)

In the "full" image (ghcr.io/mend/renovate-ce:15.9.0-full) , the default tools are now:

(No new tools are installed dynamically, as this uses binarySource=global)