Group with "allowedVersion": "<13.0.0" still showing major upgrades to v13 for approval in dependency dashboard. Expected behavior or misconfiguration?

[LeoniePhiline]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab Community

include:
  - remote: https://gitlab.com/renovate-bot/renovate-runner/-/raw/v18.23.0/templates/renovate.gitlab-ci.yml

Please tell us more about your question or problem

I have config like:

{
  "extends": [
    "config:recommended",
    "docker:pinDigests",
    "mergeConfidence:all-badges",
    ":automergeMinor",
    ":automergeDigest",
    ":automergeTesters",
    ":automergeLinters",
    ":automergeTypes",
    ":rebaseStalePrs",
    ":prHourlyLimit1",
    ":maintainLockFilesWeekly",
    ":labels(dependencies)"
  ],
  "major": {
    "dependencyDashboardApproval": true
  },
  "rangeStrategy": "bump",
  "packageRules": [
    {
      "description": "Allow MariaDB up to 10.11",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["amd64/mariadb"],
      "allowedVersions": "<11.0"
    },
    {
      "description": "Allow only Solr docker versions compatible with TYPO3 12",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["typo3solr/ext-solr"],
      "allowedVersions": "<13.0.0"
    },
    {
      "description": "Allow only Solr packagist versions compatible with TYPO3 12",
      "matchDepTypes": ["require", "require-dev"],
      "matchPackageNames": ["apache-solr-for-typo3/solr"],
      "allowedVersions": "<13.0.0"
    },
    {
      "description": "Group TYPO3 CMS packages",
      "matchDatasources": ["packagist"],
      "matchPackageNames": ["/^typo3\\/cms-.+$/"],
      "groupName": "TYPO3 CMS",
      "allowedVersion": "<13.0.0"
    }
  ]
}

Actual behavior:

Despite the last packageRules group ("groupName": "TYPO3 CMS") having "allowedVersion": "<13.0.0" set, renovate posts in the dependency dashboard:

## Pending Approval

These branches will be created by Renovate only once you click their checkbox below.

 - [ ] <!-- approve-branch=renovate/major-typo3-cms -->fix(deps): update typo3 cms to v13 (major) (`typo3/cms-backend`, `typo3/cms-core`, `typo3/cms-extbase`, `typo3/cms-frontend`)

Expected behavior (possibly based on a misconception on my part):

I would have expected (and I am trying to achieve) that versions outside the "allowedVersions" range are not proposed for approval in the dependency dashboard.

Strangely enough, this seems to work with the other package rules for mariadb, typo3solr/ext-solr and apache-solr-for-typo3/solr, all of which do not show up for major approval in the dependency dashboards, even though higher versions are available.

My question is:

Is this expected behavior, or result of misconfiguration on my behalf? (Or possibly a bug in combining "groupName" with "allowedVersions"? I previously had the grouping and the version restraint split into two separate package rules matching on the same package names, with identical behavior by renovate.)

The regex at "matchPackageNames": ["/^typo3\\/cms-.+$/"] appears to be correct, since the grouping does work.

Logs (if relevant)

No response

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

Good luck,

The Renovate team

[rarkins]

It doesn't look right to me. If you can reproduce it then we'll take a look.

[RahulGautamSingh]

Possible Typo: the last package rules has allowedVersion and not allowedVersions .. s is missing

[LeoniePhiline]

😱 Thank you so much. That must be it. 🤦🏼‍♀️

[rarkins]

Good catch! Ideally I've config validation caught it first if it's in repo config.

[LeoniePhiline]

The config validator CI job outputs:

Using docker image sha256:c6431e4a0b69c93b85047101fcfd546fa510a998faa60985e099a7c38e0477b1 for ghcr.io/renovatebot/renovate:38.47.0@sha256:ad47f0412f2c49ec7da77c0c32ff3f6a4129591e465860b86fcc9596e078fb24 with digest ghcr.io/renovatebot/renovate@sha256:ad47f0412f2c49ec7da77c0c32ff3f6a4129591e465860b86fcc9596e078fb24 ...
$ renovate-config-validator $RENOVATE_CONFIG_VALIDATOR_EXTRA_FLAGS
 INFO: Validating renovate.json
DEBUG: Checking for config file in config.js
DEBUG: No config file found on disk - skipping
 INFO: Config validated successfully

.gitlab-ci.yml (very lightly redacted):

include:
  - project: clients/client/infra/ci-templates
    ref: main
    file: workflow-stages.yml

  - project: clients/client/infra/ci-templates
    ref: main
    file: prettier.yml

  - remote: https://gitlab.com/renovate-bot/renovate-runner/-/raw/v18.23.0/templates/renovate.gitlab-ci.yml

  - remote: https://gitlab.com/renovate-bot/renovate-runner/-/raw/v18.23.0/templates/renovate-config-validator.gitlab-ci.yml

variables:
  LOG_LEVEL: debug
  RENOVATE_DETECT_HOST_RULES_FROM_ENV: "true"
  RENOVATE_GIT_AUTHOR: Renovate Bot <[email protected]>
  RENOVATE_ONBOARDING_CONFIG: '{"$$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["local>clients/client/infra/renovate-runner"]}'
  RENOVATE_REPOSITORIES: <list of space-separated repo paths>

I would need to configure the config validator to not only check renovate.json, but also default.json (used by all other packages) and other, more specific includes.

I.e., the actual projects import these files, which appear to be unchecked by the validator:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>clients/client/infra/renovate-runner",
    "local>clients/client/infra/renovate-runner:typo3-12",
    "local>clients/client/infra/renovate-runner:typo3-extension"
  ]
}

[LeoniePhiline]

Solution to the secondary issue:

Adding to .gitlab-ci.yml's variables section:

  RENOVATE_CONFIG_VALIDATOR_EXTRA_FLAGS: "*.json"

This makes the config validator find all presets and surface the errors:

ERROR: Found errors in configuration
       "file": "typo3-10.json",
       "errors": [
         {
           "topic": "Configuration Error",
           "message": "Invalid configuration option: packageRules[2].allowedVersion"
         }
       ]
 INFO: Validating typo3-11.json
ERROR: Found errors in configuration
       "file": "typo3-11.json",
       "errors": [
         {
           "topic": "Configuration Error",
           "message": "Invalid configuration option: packageRules[3].allowedVersion"
         }
       ]
 INFO: Validating typo3-12.json
ERROR: Found errors in configuration
       "file": "typo3-12.json",
       "errors": [
         {
           "topic": "Configuration Error",
           "message": "Invalid configuration option: packageRules[3].allowedVersion"
         }
       ]
 INFO: Validating typo3-extension.json

Docs: https://docs.renovatebot.com/config-validation/#pass-file-to-check-as-cli-arguments