[SECURITY]: Child processes spawned by Renovate incorrectly have full access to environment variables (since 2025-12-30)

[jamietanna]

Today we're announcing a Moderate security advisory, which will affect self-hosted users.

More details can be found in GHSA-8wc6-vgrq-x6cf.

There are patched versions available for Renovate 42.x and 43.x, and the Mend Renovate Self-Hosted Community and Enterprise edtions (CE and EE).