Composer Packages with Unbound Version Constraints Aren't Updated

[timnolte]

We use Composer to mange WordPress plugins. We generally don't constrain the plugin package versions unless we need to pin a plugin to a specific version for compatibility reasons. WordPress plugins updates normally, outside of the Composer world, are not version pinned. Is there some way to get Renovate to update these packages with a specific configuration? The GitHub Dependabot was doing this without a problem.

renovate.json

{
  "extends": [
    "config:base"
  ],
  "enabledManagers": [
    "buildkite",
    "composer",
    "docker-compose",
    "dockerfile",
    "npm"
  ],
  "rangeStrategy": "bump",
  "automerge": false,
  "packageRules": [
    {
      "groupName": "Buildkite (all)",
      "matchManagers": ["buildkite"]
    },
    {
      "groupName": "Composer (all)",
      "matchManagers": ["composer"],
      "rangeStrategy": "update-lockfile"
    },
    {
      "groupName": "Docker (all)",
      "matchManagers": ["docker-compose","dockerfile"]
    },
    {
      "groupName": "NPM (all)",
      "matchManagers": ["npm"]
    }
  ],
  "separateMinorPatch": false
}

composer.json

{
  "name": "forumone/project",
  "type": "project",
  "repositories": [
    {
      "type": "composer",
      "url": "https://wpackagist.org"
    },
  ],
  "require": {
    "wecodemore/wpstarter": "~2.0",
    "johnpbloch/wordpress-core": "~5.5.0",
    "wpackagist-plugin/timber-library": "*",
    "wpackagist-plugin/admin-menu-editor": "*",
    "wpackagist-plugin/acf-content-analysis-for-yoast-seo": "*",
    "wpackagist-plugin/cloudflare": "*",
    "wpackagist-plugin/custom-post-type-ui": "1.7.4",
    "wpackagist-plugin/daggerhart-openid-connect-generic": "*",
    "wpackagist-plugin/disable-comments": "*",
    "wpackagist-plugin/google-site-kit": "*",
    "wpackagist-plugin/http-headers": "*",
    "wpackagist-plugin/jeepers-peepers": "*",
    "wpackagist-plugin/members": "*",
    "wpackagist-plugin/post-smtp": "*",
    "wpackagist-plugin/wordfence": "*",
    "wpackagist-plugin/wordfence-assistant": "*",
    "wpackagist-plugin/wordpress-seo": "~15.4.0",
    "wpackagist-plugin/wp-cfm": "*",
    "wpackagist-plugin/wp-security-audit-log": "*",
    "wpackagist-plugin/safe-svg": "*",
    "wpackagist-plugin/regenerate-thumbnails": "*",
    "wpackagist-plugin/related-posts-by-taxonomy": "*",
    "wpackagist-plugin/post-views-counter": "*"
  },
  "config": {
    "vendor-dir": "public/wp-content/vendor",
    "platform": {
      "ext-mysqli": "1.0.0"
    },
    "optimize-autoloader": true
  },
  "scripts": {
    "install-wp-starter": [
      "WCM\\WPStarter\\Setup::run"
    ],
    "install-codestandards": [
      "Dealerdirect\\Composer\\Plugin\\Installers\\PHPCodeSniffer\\Plugin::run"
    ],
    "post-install-cmd": [
      "@install-wp-starter",
      "@install-codestandards"
    ],
    "post-update-cmd": [
      "@install-wp-starter",
      "@install-codestandards"
    ],
    "lint": "public/wp-content/vendor/bin/phpcs",
    "lint-fix": "public/wp-content/vendor/bin/phpcbf"
  },
  "extra": {
    "wordpress-install-dir": "public/wp",
    "wordpress-content-dir": "public/wp-content",
    "wpstarter": {
      "prevent-overwrite": [
        ".gitignore",
        "public/wp-config.php",
        "public/index.php"
      ]
    },
    "installer-paths": {
      "public/wp-content/plugins/{$name}": [
        "type:wordpress-plugin"
      ],
      "public/wp-content/mu-plugins/{$name}": [
        "type:wordpress-muplugin"
      ],
      "public/wp-content/themes/{$name}": [
        "type:wordpress-theme"
      ]
    }
  },
  "require-dev": {
    "php": ">=7.3.0",
    "dealerdirect/phpcodesniffer-composer-installer": "^0.7.1",
    "squizlabs/php_codesniffer": "^3.5",
    "wp-coding-standards/wpcs": "^2.3",
    "phpcompatibility/php-compatibility": "^9.3",
    "phpcompatibility/phpcompatibility-wp": "^2.1"
  }
}

[rarkins]

What does the packageFiles with updates debug log message say about the dependency?

[timnolte]

@viceice so that is where I'm finding myself but this means having to manage version number constraints on 2 places. I would much rather Renovate just honor what is defined in my composer.json for version constraints like Composer does out-of-the-box.

[timnolte]

The other problem I have is that all rangeStrategy settings other than update-lockfile are changing the versions defined in the composer.json so none of the other options are even usable for us as it would break pinning versions for normal Composer use by developers.

[rarkins]

There is no option for "never update the composer.json". You can disable major or minor updates per dependency using package rules if you need. But otherwise if I see the word "honor" being thrown around one more time in an negative context then it's time to lock this thread.

[rarkins]

I believe this feature request describes what you're after: #13050

[timnolte]

@rarkins OK, just to clear the air hear I'm only trying to get clarity on how I should be using the tool in comparison to what I might be expecting. I don't think it's unreasonable for anyone starting to use the product to make the assumption that it would be functioning like the Composer application would under normal circumstances. What I or anyone else might expect versus what the original intent of the product goals are can easily be very different things. I have no doubt that Renovate is serving the majority of users exactly as they need it to. I appreciate that Renovate has much more capability than GitHub Dependabot as the whole reason I even started looking into Renovate is because Dependabot has no intention to provide dependency grouping on PRs. I'm thankful that you and your team have this capability as it's a pretty powerful aspect. Anyways, I appreciate the time and clarification on what is supported and what isn't.