How to skip a specific version?

[nielsbasjes]

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us what version of Renovate you run.

No response

If you're self-hosting Renovate, select which platform you are using.

None

What is your question?

The org.apache.maven.plugins:maven-artifact-plugin version 3.5.0 has a bug that breaks releasing my projects. So I want to disallow this specific version in my renovate config.
So no update to 3.5.0 but as soon as there is a 3.5.1 or 3.6.0 I want to get that update.

With this purpose I have added this to my packageRules:

{
  "description": "Disable broken maven-artifact-plugin version",
  "matchPackageNames": ["org.apache.maven.plugins:maven-artifact-plugin"],
  "allowedVersions": "!/3.5.0/"
},

Yet after this renovate still provides me with a merge request for that version.

What have I done incorrectly?
How do I fix this?

Logs (if relevant)

Full logs: https://developer.mend.io/github/nielsbasjes/codeowners/-/job/8664b0a5-e0ce-49b2-adf4-08bf0e7fa0e6

It loads my config

      {
        "description": "Disable broken maven-artifact-plugin version",
        "matchPackageNames": [
          "org.apache.maven.plugins:maven-artifact-plugin"
        ],
        "allowedVersions": "!/3.5.0/"
      },

It finds the newer version (which I do not want)

          {
            "currentValue": "3.4.1",
            "currentVersion": "3.4.1",
            "datasource": "maven",
            "depName": "org.apache.maven.plugins:maven-artifact-plugin",
            "depType": "build",
            "fileReplacePosition": 1882,
            "fixedVersion": "3.4.1",
            "groupName": "maven-artifact-plugin.version",
            "homepage": "https://maven.apache.org/plugins/",
            "isSingleVersion": true,
            "packageName": "org.apache.maven.plugins:maven-artifact-plugin",
            "registryUrl": "https://repo.maven.apache.org/maven2",
            "registryUrls": [
              "https://repo.maven.apache.org/maven2"
            ],
            "versioning": "maven",
            "warnings": [],
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "3.5.0",
                "newValue": "3.5.0",
                "releaseTimestamp": "2023-09-29T05:52:06.000Z",
                "newMajor": 3,
                "newMinor": 5,
                "updateType": "minor",
                "branchName": "renovate/maven_build_plugins"
              }
            ]
          },

and then

DEBUG: Updating org.apache.maven.plugins:maven-artifact-plugin in pom.xml (branch="renovate/maven_build_plugins")
...
 "upgrades": [
        {
          "datasource": "maven",
          "depName": "org.apache.maven.plugins:maven-artifact-plugin",
          "displayPending": "",
          "fixedVersion": "3.4.1",
          "currentVersion": "3.4.1",
          "currentValue": "3.4.1",
          "newValue": "3.5.0",
          "newVersion": "3.5.0",
          "packageFile": "pom.xml",
          "updateType": "minor",
          "packageName": "org.apache.maven.plugins:maven-artifact-plugin"
        },

[nielsbasjes]

Second attempt; same unwanted effect

      {
        "description": "Disable broken maven-artifact-plugin version",
        "matchPackageNames": [
          "org.apache.maven.plugins:maven-artifact-plugin"
        ],
        "allowedVersions": "!/^3\\.5\\.0$/"
      },

[nielsbasjes]

Looking at the output in the log I see that both these have the exact same value

"depName": "org.apache.maven.plugins:maven-artifact-plugin",
"packageName": "org.apache.maven.plugins:maven-artifact-plugin",

Reading through #16012 I read that the depName is (going to be?) intended as "pretty name"/"short name"

So shouldn't I use the matchPackageNames instead of the matchDepNames in this case?

[PhilipAbed]

true, but i had a case where depName worked while packageName didn't so i thought its worth a try.
i tried to reproduce, i couldn't

this is my config:
https://github.com/PhilipAbed/malicious-dependencies/blob/main/renovate.json

i ran, it opened a PR with maven-plugin-artifact 3.5.0 , but when i added the Package-rule, it removed the PR completely.

[PhilipAbed]

[PhilipAbed]

could be another rule after it overriding it? try to set it at the end of the config! and do it like i did(see example above in config)

[nielsbasjes]

I will try your suggestions. Thanks.

[nielsbasjes]

In my config I also have this one:

{
  "matchPackagePrefixes": [
    "org.apache.maven.plugins",
    "org.codehaus.mojo",
    "org.sonarsource.scanner.maven",
    "com.github.spotbugs",
    "com.google.code.maven-replacer-plugin",
    "io.fabric8",
    "pl.project13.maven",
    "com.alexecollins.maven.plugin",
    "org.jetbrains.kotlin",
    "net.alchim31.maven"
  ],
  "groupSlug": "maven_build_plugins",
  "groupName": "maven build plugins",
  "labels": [
    "maven-build-plugins"
  ]
},

and this one

{
  "description": "Disallow Cloudera/Hortonworks/Spring/... internal versions",
  "matchPackagePrefixes": ["org.apache."],
  "allowedVersions": "/^[0-9]{1,3}\\.[0-9]{1,3}(?:\\.[0-9]{1,3})?(?:-M[0-9]{1,3})?$/"
},

I suspect double rules that match is indeed the problem I'm facing.
I'm going to change the ordering and see what happens.

[nielsbasjes]

@PhilipAbed
Thank you for your help. It was indeed 2 rules that matched and the ordering of those rules.
After I move the rule after the last one I showed the MR was almost immediately autoclosed.