{"schema":"threatline.record/2","record":{"id":"GHSA-2frq-pm48-6j4h","aliases":["GHSA-2frq-pm48-6j4h"],"summary":"A user's request to rebase a PR can bypass strict `minimumReleaseAge` internal checks","details":"It was previously possible for a user interaction with a Renovate PR to cause Renovate to incorrectly update to the latest version of a dependency, ignoring any `minimumReleaseAge` checks.\r\n\r\nFor instance, with a PR with updates such as:\r\n\r\n| Package | Update | Change | Pending |\r\n|---|---|---|---|\r\n| [anthropics/claude-code](https://redirect.github.com/anthropics/claude-code) | patch | `2.1.246` → `2.1.247` | `2.1.259` (+6) |\r\n| [anthropics/claude-code](https://redirect.github.com/anthropics/claude-code) | patch | `v2.1.246` → `v2.1.247` | `v2.1.259` (+6) |\r\n\r\nWe can see that Renovate only updates to 2.1.247 (as it has passed the `minimumReleaseAge`), and that there are other updates waiting to age.\r\n\r\nWhen a user (with a minimum of i.e. Write access to the repo on GitHub) clicks the `If you want to rebase/retry this PR, check this box` checkbox to rebase the PR, Renovate would then update the PR to i.e.\r\n\r\n| Package | Update | Change |\r\n|---|---|---|\r\n| [anthropics/claude-code](https://redirect.github.com/anthropics/claude-code) | patch | `2.1.258` → `2.1.259` |\r\n| [anthropics/claude-code](https://redirect.github.com/anthropics/claude-code) | patch | `v2.1.258` → `v2.1.259` |\r\n\r\n\r\nThis was only possible when a user requested this, and Renovate itself did not perform this change when a branch needed rebasing, for instance when there was a conflict in it.\r\n\r\nThis would allow for a potentially malicious dependency to have been pushed to the PR, and potentially start running CI, which is something Minimum Release Age aims to prevent.\r\n\r\nThis PR would have a pending `renovate/stability-days` status check on it, with \"Waiting for status to be reported — Updates have not met minimum release age requirement\".\r\n\r\n## Impact\r\n\r\n- If you have `minimumReleaseAge` set\r\n- If you have any dependencies that have `updateType=digest` updates\r\n- A dependency of yours releases a version\r\n- Renovate raises a PR for that version\r\n- Later, a dependency releases new versions\r\n- A human clicks the `If you want to rebase/retry this PR, check this box`\r\n\r\n## Patches\r\n\r\nThis is patched in [Renovate 44.61.3](https://github.com/renovatebot/renovate/releases/tag/44.61.3).\r\n\r\n## Workarounds\r\n\r\nModify [`prbodytemplate`](https://docs.renovatebot.com/configuration-options/#prbodytemplate) to remove the checkbox actions and/or set [`dependencyDashboard=true`](https://docs.renovatebot.com/configuration-options/#dependencydashboard).","categories":["Unclassified"],"product":"renovate","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"renovate"},"range":"<44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"renovate/renovate"},"range":"<44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/renovate/renovate"},"range":"<44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/renovate/renovate"},"range":"<44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend/renovate-ce"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/mend/renovate-ce"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/renovate-ce"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend/renovate-ee-server"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/mend/renovate-ee-server"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/renovate-ee-server"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend/renovate-ee-worker"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/mend/renovate-ee-worker"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/renovate-ee-worker"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/charts/mend-renovate-ce"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend-renovate-ce"},"range":"<15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/charts/mend-renovate-enterprise-edition"},"range":"<10.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend-renovate-enterprise-edition"},"range":"<10.5.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"renovate"},"version":"44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"renovate/renovate"},"version":"44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/renovate/renovate"},"version":"44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/renovate/renovate"},"version":"44.61.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend/renovate-ce"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/mend/renovate-ce"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/renovate-ce"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend/renovate-ee-server"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/mend/renovate-ee-server"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/renovate-ee-server"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend/renovate-ee-worker"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"docker.io/mend/renovate-ee-worker"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/renovate-ee-worker"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/charts/mend-renovate-ce"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend-renovate-ce"},"version":"15.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"ghcr.io/mend/charts/mend-renovate-enterprise-edition"},"version":"10.5.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","source_modified_at":"2026-09-29T11:25:03Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"docker","name":"mend-renovate-enterprise-edition"},"version":"10.5.0"}],"cvss":4.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-29T11:25:03Z","modified_at":"2026-09-29T11:25:03Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h","fetched_at":"2026-10-23T18:58:35.272684Z","source_modified_at":"2026-09-29T11:25:03Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-29T11:25:03Z","content_hash":"d12a924dbd7bcddee45f48bb6700f8fc0ac2c8608c4378e73fc54f76cbb45cd5"}}