44.60.1

renovatebot/renovate44.60.1Sep 3, 2026by github-actions[bot]

AI Summary

A security-focused patch release that enforces strict validation for environment variables and headers across host rules and configurations.

Key Highlights

Enforced `allowedEnv` and `allowedHeaders` in configuration and host rules
Merged headers across matching rules
Added `requiresCheckAtTrustBoundary` option flag
Validated resolved presets

New Features

`requiresCheckAtTrustBoundary` option

Full Release Notes

## [44.60.1](https://github.com/renovatebot/renovate/compare/44.60.0...44.60.1) (2026-09-03)

### Bug Fixes

* **config:** enforce `allowedEnv` when applying env vars ([6b2b607](https://github.com/renovatebot/renovate/commit/6b2b607080d90a18959d6d1eb3d4c6c0cd631cbd))
* **config:** enforce `allowedHeaders` when applying headers ([223e6ef](https://github.com/renovatebot/renovate/commit/223e6efd4e285b71a34cbb201db97c1642e07eb0))
* **config:** report top-level "security" violations for `env` ([61cbc87](https://github.com/renovatebot/renovate/commit/61cbc876769f7e8577a17816dc002d3a5ae28662))
* **config:** report top-level "security" violations for `hostRules[].headers` ([ae34610](https://github.com/renovatebot/renovate/commit/ae3461046819cd221d9875bd9f87139d38e230a8))
* **util/host-rules:** apply the admin's `headers` over a repository's ([4732da7](https://github.com/renovatebot/renovate/commit/4732da7d2b92ff2e31c87c0efc532c2fc067287f))
* **util/host-rules:** enforce `allowedHeaders` within `add()` ([c98f4f7](https://github.com/renovatebot/renovate/commit/c98f4f71c8a2d45c5fce714da4eb41026bc05fe8))
* **util/host-rules:** merge `headers` across matching rules ([3d56c38](https://github.com/renovatebot/renovate/commit/3d56c38cf667987cece8d76fec9084cfe2fabe98))
* **workers/global:** enforce `allowedHeaders` for the admin's own `hostRules` ([432bb00](https://github.com/renovatebot/renovate/commit/432bb00cd2e0de3efcebbfbd95019f8ec51c162f))
* **workers/repository:** validate resolved presets ([2382888](https://github.com/renovatebot/renovate/commit/2382888bc7309790dcc0ba40d6d3c2fa92b289ff))

### Code Refactoring

* **config:** add `requiresCheckAtTrustBoundary` option flag ([711d46b](https://github.com/renovatebot/renovate/commit/711d46b19b9b1b96f3ebbed6ad2ddacee47299d6))

### Tests

* **config:** add a reminder to add check for trust boundaries ([c1a00f1](https://github.com/renovatebot/renovate/commit/c1a00f1968896fd05d9cb382efb33e486a40dc83))
* **config:** cover existing `allowedEnv` behaviour ([6e0bbee](https://github.com/renovatebot/renovate/commit/6e0bbee44d9da675d951b128deab876a190ffff8))
* **config:** cover existing `allowedHeaders` behaviour ([d088346](https://github.com/renovatebot/renovate/commit/d088346f7b30ddf7422c3ec275130ac6d20287e4))
* **util/host-rules:** cover existing header merging behaviour ([9a91b69](https://github.com/renovatebot/renovate/commit/9a91b69f3c14b21d0b221d30474ea7d33e35e0e8))
* **workers/repository:** don't mock more than we need to ([cf491cc](https://github.com/renovatebot/renovate/commit/cf491cc1cd27b505a6d9a1126e699fcd7e6a5697))
* **workers/repository:** set explicit `allowedEnv` ([f189d93](https://github.com/renovatebot/renovate/commit/f189d934b399f18919bfb8e1132b118230238378))