GHSA-5vjq-5jmg-39xq Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

• npm renovate: >= 43.65.0, < 43.102.11 → fixed in 43.102.11

When using `lockFileMaintenance` using the bazel-module or bazelisk managers between Renovate 43.65.0 (2026-03-12) and 43.102.11 (2026-04-02), there was the opportunity for remote code execution from a malicious dependency, _if the Bazel module executes code that relies on a dependency_. As this is an "unsafe" execution path, we have disabled this by default, and self-hosted administrators must add it to the `allowedUnsafeExecutions` allowlist. It is recommended to review whether you have enabled this functionality for these managers, and if so, whether any dependency updates may have led to remote code execution. Impact If Renovate suggested an update to a malicious dependency, _and_ that dependency is referenced as part of the `bazel mod deps` call - for instance as part of a `ctx.execute` call - this would call attacker-controlled code. This could lead to insider attackers and outside attackers, executing code that is distributed as part of the package. Patches This is patched in 43.102.11. This does not affect any versions of Mend Renovate Self-Hosted. Workarounds • Upgrade your Renovate version • Disable `lockFileMaintenance` for these managers Why did this happen? This was missed in code review (as part of https://github.com/renovatebot/renovate/pull/41507).