Renovate is a tool that automates dependency updates. The vulnerability occurs because digest updates (such as pinned commit SHAs or floating tags for GitHub Actions, Docker images, Go modules, or NuGet packages) are not subjected to the internal minimumReleaseAge stability checks in affected versions. As a result, Renovate may open pull requests for newly published digest updates prematurely, marked only with a pending stability-days status check. This behavior can lead to CI workflows running on potentially unstable or malicious dependency versions before the configured minimum release age has passed. The flaw is resolved in Renovate version 44.3.1 and corresponding Mend Renovate CE/EE and Helm chart versions.

The vulnerability allows potentially malicious or unstable dependency versions to trigger pull requests and CI workflows before the configured minimum release age, undermining the intended stability control. This could lead to premature integration of unvetted dependency updates, increasing risk in the software supply chain. However, no known exploits are reported in the wild.

A fix is available in Renovate version 44.3.1 and corresponding Mend Renovate CE/EE images and Helm charts (15.4.0 and 10.4.0 respectively). Users should upgrade to these fixed versions. As a workaround, digest updates can be disabled or gated behind dependencyDashboardApproval to prevent premature pull requests. Patch status is not explicitly confirmed beyond the fixed version statement; users should verify with vendor advisories for the latest remediation guidance.