fix(renovate): set internalChecksFilter to strict - #284
Merged
Conversation
Frequently-releasing dependencies were getting stuck under the dependency dashboard's "Pending Status Checks" section and never turned into PRs. The only blocker was Renovate's internal `renovate/stability-days` check staying pending because the update was always pinned to the newest release, still inside its 14-day `minimumReleaseAge` soak. Setting `internalChecksFilter: "strict"` makes Renovate skip pending versions and propose the highest already-soaked version, so a PR is created (and auto-merges) once soaked, while preserving the 14-day supply-chain soak. Refs DevSecNinja/truenas-apps#115 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Repositories consuming these shared Renovate presets get container/tool updates stuck under the dependency dashboard's "Pending Status Checks" section, and their PRs are never created. Reported in DevSecNinja/truenas-apps#115 (e.g.
ghcr.io/italypaleale/traefik-forward-authstuck at4.8.0since March while4.9–4.13shipped).Root cause
base.json5setsminimumReleaseAge: "14 days"but leavesinternalChecksFilterat its effectivenonebehaviour. Renovate keeps targeting the newest release — which is still inside its 14-day soak — so the internalrenovate/stability-dayscheck stays pending forever for frequently-releasing dependencies, and no branch/PR is created.Verified on a stuck
socket-proxybranch: all required CI checks passed; onlyrenovate/stability-days("Updates have not met minimum release age requirement") was pending, and the branch sat orphaned for 3+ months.Fix
Add
internalChecksFilter: "strict"next tominimumReleaseAgeso Renovate skips still-pending versions and proposes the highest already-soaked version. The soaked update then creates a PR and auto-merges, while the 14-day supply-chain soak is preserved. Applies to every repo extendingbase.json5.Refs DevSecNinja/truenas-apps#115