Renovate: minimumReleaseAge is not applied to digest updates, so fresh dependency digests reach CI early

Impact

Renovate skips the internal minimumReleaseAge stability check for updateType=digest, so a newly published digest for a pinned GitHub Action, container image, Go module or NuGet package still opens a pull request, carrying only a pending stability status check. The control that exists precisely to let a malicious release be caught before it is consumed does not apply on the path most often used to pin dependencies by SHA. For a team whose GPU node images, device-plugin manifests and training-job containers are updated through Renovate, a compromised upstream tag can trigger CI workflows on infrastructure repositories sooner than the configured quarantine window allows. Impact is on the build pipeline, not on running GPU nodes.

Who can reach it

Remote, unauthenticated with respect to the Renovate instance: whoever can publish a new digest to an upstream dependency the repository tracks. No access to the Renovate deployment is needed.

What to do

Upgrade to Renovate 44.3.1, Mend Renovate CE/EE image 15.4.0, mend-renovate-ce Helm chart 15.4.0, or mend-renovate-enterprise-edition Helm chart 10.4.0. For a self-hosted deployment this is an image or chart bump and a restart of the Renovate service - no node maintenance. Until then the advisory's workaround is to disable digest updates or gate them behind dependencyDashboardApproval.

References

Related entries

• Schneider Electric StruxureWare Data Center Expert before 7.4.0: Passwords held in cleartext in RAM on the DCIMCVE-2017-8371 · Schneider Electric StruxureWare Data Center Expert before 7.4.0Medium
• RPMB protocol message authentication subsystem in Intel TXE before 4.0.30 (replay-protected memory block)CVE-2020-12355 · RPMB protocol message authentication subsystem in Intel TXE before 4.0.30 (replay-protected memory block)Medium
• Replay Protected Memory Block (RPMB) protocol as specified for eMMC, UFS and ALL versions of NVMeCVE-2020-13799 · Replay Protected Memory Block (RPMB) protocol as specified for eMMC, UFS and ALL versions of NVMe - multi-vendor…Medium
• IBM Spectrum Scale Container Native Storage Access (CSI volume handling): Anyone who can create a pod plus a PV/PVCCVE-2022-40607 · IBM Spectrum Scale Container Native Storage Access (CSI volume handling)Medium
• AMD - overlap between segmented reverse map table (RMP) and SMM memory: Improper handling of overlap between theCVE-2025-0012 · AMD - overlap between segmented reverse map table (RMP) and SMM memoryMedium
• Motherboards from ASRock and its subsidiaries ASRockRack and ASRockInd built on Intel 500-series chipsetsCVE-2025-14304 · Motherboards from ASRock and its subsidiaries ASRockRack and ASRockInd built on Intel 500-series chipsetsMedium