diff --git a/lib/modules/datasource/maven/util.spec.ts b/lib/modules/datasource/maven/util.spec.ts
index fb94fa28ea7cae..fc42f24610b2b7 100644
--- a/lib/modules/datasource/maven/util.spec.ts
+++ b/lib/modules/datasource/maven/util.spec.ts
@@ -1,8 +1,7 @@
 import type Request from 'got/dist/source/core';
 import { partial } from '../../../../test/util';
 import { HOST_DISABLED } from '../../../constants/error-messages';
-import { type Http, HttpError } from '../../../util/http';
-import { parseUrl } from '../../../util/url';
+import { Http, HttpError } from '../../../util/http';
 import {
   checkResource,
   downloadHttpProtocol,
@@ -10,6 +9,8 @@ import {
   downloadS3Protocol,
 } from './util';
 
+const http = new Http('test');
+
 function httpError({
   name,
   message = 'unknown error',
@@ -46,16 +47,8 @@ describe('modules/datasource/maven/util', () => {
   describe('downloadMavenXml', () => {
     it('returns empty object for unsupported protocols', async () => {
       const res = await downloadMavenXml(
-        null as never, // #22198
-        parseUrl('unsupported://server.com/'),
-      );
-      expect(res).toEqual({});
-    });
-
-    it('returns empty object for invalid URLs', async () => {
-      const res = await downloadMavenXml(
-        null as never, // #22198
-        null,
+        http,
+        new URL('unsupported://server.com/'),
       );
       expect(res).toEqual({});
     });
@@ -63,8 +56,7 @@ describe('modules/datasource/maven/util', () => {
 
   describe('downloadS3Protocol', () => {
     it('returns null for non-S3 URLs', async () => {
-      // #22198
-      const res = await downloadS3Protocol(parseUrl('http://not-s3.com/')!);
+      const res = await downloadS3Protocol(new URL('http://not-s3.com/'));
       expect(res).toBeNull();
     });
   });
@@ -114,18 +106,12 @@ describe('modules/datasource/maven/util', () => {
 
   describe('checkResource', () => {
     it('returns not found for unsupported protocols', async () => {
-      const res = await checkResource(
-        null as never, // #22198
-        'unsupported://server.com/',
-      );
+      const res = await checkResource(http, 'unsupported://server.com/');
       expect(res).toBe('not-found');
     });
 
     it('returns error for invalid URLs', async () => {
-      const res = await checkResource(
-        null as never, // #22198
-        'not-a-valid-url',
-      );
+      const res = await checkResource(http, 'not-a-valid-url');
       expect(res).toBe('error');
     });
   });
diff --git a/lib/modules/datasource/maven/util.ts b/lib/modules/datasource/maven/util.ts
index b521b99d53ab1d..d68d35757bdf01 100644
--- a/lib/modules/datasource/maven/util.ts
+++ b/lib/modules/datasource/maven/util.ts
@@ -307,12 +307,8 @@ export function getMavenUrl(
 
 export async function downloadMavenXml(
   http: Http,
-  pkgUrl: URL | null,
+  pkgUrl: URL,
 ): Promise<MavenXml> {
-  if (!pkgUrl) {
-    return {};
-  }
-
   const protocol = pkgUrl.protocol;
 
   if (protocol === 'http:' || protocol === 'https:') {
diff --git a/lib/workers/repository/update/pr/changelog/bitbucket/index.spec.ts b/lib/workers/repository/update/pr/changelog/bitbucket/index.spec.ts
index f4a9c45f556b5d..4eb26101e06c61 100644
--- a/lib/workers/repository/update/pr/changelog/bitbucket/index.spec.ts
+++ b/lib/workers/repository/update/pr/changelog/bitbucket/index.spec.ts
@@ -79,7 +79,7 @@ describe('workers/repository/update/pr/changelog/bitbucket/index', () => {
   it('handles release notes', async () => {
     httpMock
       .scope(apiBaseUrl)
-      .get('/2.0/repositories/some-org/some-repo/src?pagelen=100')
+      .get('/2.0/repositories/some-org/some-repo/src/HEAD?pagelen=100')
       .reply(200, bitbucketTreeResponse)
       .get('/2.0/repositories/some-org/some-repo/src/abcd/CHANGELOG.md')
       .reply(200, changelogMd);
@@ -94,7 +94,7 @@ describe('workers/repository/update/pr/changelog/bitbucket/index', () => {
   it('handles missing release notes', async () => {
     httpMock
       .scope(apiBaseUrl)
-      .get('/2.0/repositories/some-org/some-repo/src?pagelen=100')
+      .get('/2.0/repositories/some-org/some-repo/src/HEAD?pagelen=100')
       .reply(200, bitbucketTreeResponseNoChangelogFiles);
     const res = await getReleaseNotesMdFile(bitbucketProject);
     expect(res).toBeNull();
diff --git a/lib/workers/repository/update/pr/changelog/bitbucket/index.ts b/lib/workers/repository/update/pr/changelog/bitbucket/index.ts
index 56ddb2b0ac6f66..3f0ca2cce7a7ab 100644
--- a/lib/workers/repository/update/pr/changelog/bitbucket/index.ts
+++ b/lib/workers/repository/update/pr/changelog/bitbucket/index.ts
@@ -1,3 +1,4 @@
+import path from 'node:path';
 import is from '@sindresorhus/is';
 import changelogFilenameRegex from 'changelog-filename-regex';
 import { logger } from '../../../../../../logger';
@@ -18,15 +19,16 @@ const bitbucketHttp = new BitbucketHttp(id);
 export async function getReleaseNotesMd(
   repository: string,
   apiBaseUrl: string,
-  _sourceDirectory?: string,
+  sourceDirectory?: string,
 ): Promise<ChangeLogFile | null> {
   logger.trace('bitbucket.getReleaseNotesMd()');
 
   const repositorySourceURl = joinUrlParts(
     apiBaseUrl,
-    `2.0/repositories`,
+    '2.0/repositories',
     repository,
-    'src',
+    'src/HEAD',
+    sourceDirectory ?? '',
   );
 
   const rootFiles = (
@@ -41,7 +43,9 @@ export async function getReleaseNotesMd(
 
   const allFiles = rootFiles.filter((f) => f.type === 'commit_file');
 
-  const files = allFiles.filter((f) => changelogFilenameRegex.test(f.path));
+  const files = allFiles.filter((f) =>
+    changelogFilenameRegex.test(path.basename(f.path)),
+  );
 
   const changelogFile = files
     .sort((a, b) => compareChangelogFilePath(a.path, b.path))
@@ -59,7 +63,10 @@ export async function getReleaseNotesMd(
 
   const fileRes = await bitbucketHttp.get(
     joinUrlParts(
-      repositorySourceURl,
+      apiBaseUrl,
+      '2.0/repositories',
+      repository,
+      'src',
       changelogFile.commit.hash,
       changelogFile.path,
     ),
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index 67f7cb7f39847e..adca446b53ad6f 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -5,19 +5,19 @@ ARG BASE_IMAGE_TYPE=slim
 # --------------------------------------
 # slim image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:9.9.6@sha256:4a0e4b6be9cd684dc5d5e5e4ae82acfae92c200e9bc129d318f865a192c0808e AS slim-base
+FROM ghcr.io/renovatebot/base-image:9.10.0@sha256:8d2882ef06158bf71a0ac95085582c0bbbf775d51c3ac567639fa718d4dac091 AS slim-base
 
 # --------------------------------------
 # full image
 # --------------------------------------
-FROM ghcr.io/renovatebot/base-image:9.9.6-full@sha256:7c4ee885c42417b083839f4ea32a4eb2514c080835a12e6357bd05af925f8398 AS full-base
+FROM ghcr.io/renovatebot/base-image:9.10.0-full@sha256:d39f9b1f282850a2e397db6c03b6eef0f1e6eb44e984a4f344e05a45ea3bc895 AS full-base
 
 ENV RENOVATE_BINARY_SOURCE=global
 
 # --------------------------------------
 # build image
 # --------------------------------------
-FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:9.9.6@sha256:4a0e4b6be9cd684dc5d5e5e4ae82acfae92c200e9bc129d318f865a192c0808e AS build
+FROM --platform=$BUILDPLATFORM ghcr.io/renovatebot/base-image:9.10.0@sha256:8d2882ef06158bf71a0ac95085582c0bbbf775d51c3ac567639fa718d4dac091 AS build
 
 # We want a specific node version here
 # renovate: datasource=node-version