Adds new admin option “skipInstalls” that is applicable for npm-only for now (including lerna-npm). If set to false, Renovate will perform a full install of modules rather than `—package-lock-only`. This is necessary in some cases to work around bugs in npm.

Self-hosted bot users can set this option themselves on the bot’s config, but app users will require it to be enabled per-repository by the app admin.

Closes #2374

Add support for renovating Docker images in Kubernetes manifests

Adds rules to skip any configured grouping or schedules that prevent insecure packages from being updated immediately.

If GitHub's vulnerability alerts are detected, package rules are added to force empty schedule and grouping for each affected package. Settings are configurable via new `vulnerabilityAlerts` config object, e.g. so that custom PR titles, labels or assignees can be configured.

Closes #1567

Closes #2302

Adds new config option `rollbackPrs` which defaults to `true` (current behaviour). Setting to false will disable creation of rollback PRs - configurable globally, per-language, per-package, etc.

Adds support for .gitlabci.yml files. Part of the logic is same as Docker Compose files, however the “services” list is new/different so requires additional logic.

Closes #1598

"docker" in config now refers to the Docker "language", which is the parent of dockerfile, docker-compose and circleci managers.

docs: fix typo

Closes https://github.com/renovatebot/config-help/issues/63

If an encrypted npmToken is found alongside an unencrypted npmrc in config, then the token will replace any `${NPM_TOKEN}` placeholder found, or be appended to the end of the file. This enables large npmrc files to be defined in config without needing to enrypt the entire thing.

Closes #1796

Renovate now ignores any upgrades that are marked as deprecated, unless the current version is itself also deprecated. The new config option `ignoreDeprecated` can be set to false to disable this if necessary.

Closes #1988

Adds config option repositoryUrls which can be used by pip to define an alternate host to pypi.

Closes #2181

Raises a deprecation warning issue per-dependency. Uses logic that if latest version is deprecated then the package is deprecated.

Closes #1592

Thanks @hbetts

Adds an `updateTypes` field to `packageRules` that lets you specify rules based on update types such as major, minor, patch, pin, etc.

Closes #2215

Adds initial documentation on how .NET support works, and how Renovate knows which packages to update via nuget.org.

Closes #2156

This deprecates branch-push and branch-merge-commit automergeTypes and replaces with “branch”, which has the same behaviour as the previous branch-push.

BREAKING CHANGE: branch-merge-commit automergeType behaviour is no longer supported, all branch automerges now use branch push approach.

Changes gitAuthor to be an admin-only setting, i.e. configurable by bot admin and not by repo admin.

BREAKING CHANGE: gitAuthor can no longer be configured in repository config and can be set by bot admin only.

Updates renovateapp -> renovatebot

Adds config options force and forceCli. These cover the use case where a certain setting is desired to be forced by the bot admin, regardless of repository config, for example removing all configured schedules in order to force PR creation.

Closes #1731 

Closes #2127