Is minimumReleaseAge behaviour not as documented or am I misunderstanding things?

[erdi]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Github, v40.2.7 of the action

Please tell us more about your question or problem

I'm trying to add minimumReleaseAge to our renovate config but the behaviour does not seem to be as documented. The documentation states that:

If you use minimumReleaseAge=3 days and internalChecksFilter="strict" then Renovate only creates branches when 3 (or more days) have passed since the version was released.

But what I'm seeing is that the PRs are created straight away and a check like this is being added to them:

I also don't see any pending PRs in the renovate dependency dashboard.

This does not work well for dependencies that move fast, like for example software.amazon.awssdk:bom which has a new version every day. This means every day we run renovate it updates the PR with the latest version so the minimumReleaseAge condition can never be fulfilled.

Is what I'm seeing as expected or did I misconfigure something?

Below is our slightly redacted config:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "timezone": "Europe/London",
  "gitAuthor": "Redacted",
  "includePaths": [
    "platform/**",
  ],
  "dependencyDashboard": true,
  "prBodyNotes": [
    "**REDACTED**"
  ],
  "respectLatest": false,
  "rangeStrategy": "pin",
  "separateMajorMinor": false,
  "prHourlyLimit": 0,
  "prConcurrentLimit": 0,
  "platformCommit": "enabled",
  "packageRules": [
    // Configure docker datasource commit message
    {
      "matchDatasources": [
        "docker"
      ],
      "commitMessageExtra": "to {{newVersion}}",
    },

    // Don't bump Jakarta EE dependencies beyond the latest EE 9 versions
    {
      "matchPackageNames": [
        "org.glassfish:jakarta.el",
      ],
      "allowedVersions": "[4.0.2,5.0)",
    },
    {
      "matchPackagePrefixes": [
        "com.sun.xml.bind:",
      ],
      "allowedVersions": "[3.0.2,4.0)",
    },
    {
      "matchPackagePrefixes": [
        "com.sun.xml.ws:",
      ],
      "allowedVersions": "[3.0.2,4.0)",
    },

    // Some Apache Commons artefacts were published with date-of-release format versions (e.g. 20030203) historically, and subsequently switched to SemVer (e.g. 2.6), but Renovate thinks the higher number means newer...
    {
      "matchPackageNames": [
        "commons-lang:commons-lang",
      ],
      "allowedVersions": "[2.0,3.0)",
    },
    {
      "matchPackageNames": [
        "commons-io:commons-io",
      ],
      "allowedVersions": "[2.0,3.0)",
    },
    {
      "matchPackageNames": [
        "commons-collections:commons-collections",
      ],
      "allowedVersions": "[3.0,4.0)",
    },
    {
      "matchPackageNames": [
        "commons-codec:commons-codec",
      ],
      "allowedVersions": "[1.0,2.0)",
    },
    {
      "matchPackageNames": [
        "commons-beanutils:commons-beanutils",
      ],
      "allowedVersions": "[1.0,2.0)",
    },

    // Unusually, for this artefact version 1 is newer than version 2...
    {
      "matchPackageNames": [
        "xml-apis:xml-apis",
      ],
      "allowedVersions": "[1.0,2.0)",
    },

    // Stick to RESTEasy 6.0 for now, as versions 6.1 and beyond require Jakarta EE 10 (see above)
    {
      "matchPackagePrefixes": [
        "org.jboss.resteasy:",
      ],
      "allowedVersions": "[6.0.3.Final,6.1)",
    },

    // RESTEasy MicroProfile versions 2.1.2.Final and beyond require Jakarta EE 10 (see above)
    {
      "matchPackagePrefixes": [
        "org.jboss.resteasy.microprofile:",
      ],
      "allowedVersions": "[2.0.0.Final,2.1.2.Final)",
    },

    // Stick to Jetty 11 for now, as version 12 needs additional configuration to work with Jakarta EE 9 (see above)
    {
      "matchPackagePrefixes": [
        "org.eclipse.jetty:",
      ],
      "allowedVersions": "[11.0.20,12.0)",
    },

    // Stick to version 3 of Apache XML Security for now, as versions 4 and beyond require Jakarta EE 10 (see above)
    {
      "matchPackageNames": [
        "org.apache.santuario:xmlsec",
      ],
      "allowedVersions": "[3.0.4,4.0)",
    },

    // Stick to Hibernate Validator 6 for now, as versions 8 and beyond require Jakarta EE 10 (see above)
    {
      "matchPackagePrefixes": [
        "org.hibernate.validator:",
      ],
      "allowedVersions": "[7.0.5.Final,8.0)",
    },

    // Stick to Jersey 3 for now, as versions 4 and beyond require Jakarta EE 10 (see above)
    {
      "matchPackagePrefixes": [
        "org.glassfish.jersey",
      ],
      "allowedVersions": "[3.0.12,4.0)",
    },

    // Versions 3.2.0 and beyond require Jakarta EE 10 (see above)
    {
      "matchPackageNames": [
        "io.smallrye.config:smallrye-config",
      ],
      "allowedVersions": "[3.0.0,3.2.0)"
    },

    // Versions 1.1.0 and beyond require Jakarta EE 10
    {
      "matchPackageNames": [
        "org.eclipse.parsson:parsson",
      ],
      "allowedVersions": "[1.0.5,1.1.0)"
    },

    // Versions with -redacted suffix of org.openapitools.openapidiff:openapi-diff-core are from a fork
    {
      "matchPackageNames": [
        "org.openapitools.openapidiff:openapi-diff-core",
      ],
      "allowedVersions": "!/^.+-redacted/",
    },

    // Version 1.0.0 of io.prometheus.jmx:jmx_prometheus_javaagent has functional issues and should not be used
    {
      "matchPackageNames": [
        "io.prometheus.jmx:jmx_prometheus_javaagent",
      ],
      "allowedVersions": "!/^1\\.0\\.0$/",
    },

    // Configure versioning for Redacted artefacts
    {
      "matchPackagePatterns": [
        "^com\\.redacted.*",
      ],
      // Redacted builds don't use semantic versioning, so let's say all builds are patches, with the last number in the version representing the patch version
      "versioning": "regex:^\\d+\\.\\d+\\.(?<patch>\\d+)$",
    },

    // Configure the default Maven registries
    {
      "matchDatasources": [
        "maven",
      ],
      "registryUrls": [
        "https://repo.maven.apache.org/maven2/", // Maven Central
        "https://plugins.gradle.org/m2", // Gradle Plugins Portal
        "https://redacted.jfrog.io/artifactory/redacted-remote", // Redacted Remote
      ],
      "minimumReleaseAge": "7 days",
      "internalChecksFilter": "strict"
    },

    // Configure Maven registries for internal Redacted artefacts
    {
      "matchPackagePatterns": [
        "^com\\.redacted.*",
      ],
      "registryUrls": [
        "https://redacted.jfrog.io/artifactory/redacted-central", // Redacted Central
      ]
    },

    // Configure Maven registries for Kafka clients (see redacted)
    {
      "matchPackageNames": [
        "org.apache.kafka:kafka-clients",
      ],
      "registryUrls": [
        "https://repo.maven.apache.org/maven2/", // Maven Central
      ],
    },

    // Reduce noise of nightly AWS SDK releases
    {
      "matchPackageNames": [
        "com.amazonaws:aws-java-sdk-bom",
        "software.amazon.awssdk:bom",
      ],
      "schedule": ["on friday"],
    },

    // Reduce noise of internal Redacted artefact builds
    {
      "matchPackagePatterns": [
        "^com\\.redacted.*",
      ],
      "schedule": ["on the 2nd and 4th day instance on friday"],
    },

    // Don't group "com.redcted" group artefacts into a single PR; this group contains many artefacts which are completely unrelated
    {
      "matchPackagePrefixes": [
        "com.redacted:"
      ],
      "groupName": null,
    },

    // Disable Renovate for some artefacts
    {
      "matchPackageNames": [
        "common:core", // contains a project called "iso8583" which Renovate thinks is a version it can manage...
        "connectors:mastercardcurrencycalculator", // contains a project called "v1_0_0" which Renovate thinks is a version it can manage...
        "unit-test:support", // contains a project called "i18n" which Renovate thinks is a version it can manage...
        "com.safenetinc.luna:lunaapi", // manually uploaded artifact, unlikely to change yet causing renovate to emit resolution warnings
        "jakarta.platform:jakarta.jakartaee-bom", // updating the version of Jakarta EE is much more involved than just increasing the bom version
        "com.ancientprogramming.fixedformat4j:fixedformat4j", // we think Renovate is confused by the number in this package name...
      ],
      "enabled": false,
    },

    // Disable renovate for all build logic modules (both libraries and plugins) apart from the java-library plugin.
    // These modules have a lot of published versions so even though the version is driven from a single variable in the version catalog analysing them
    // all is not only wasteful but it also leads to out of memory errors. It's enough to only check for new versions of a single module using the
    // `buildLogic` variable from the catalog and the java-library plugin was chosen as it's unlikely to be ever removed from the catalog.
    {
      "matchPackagePatterns": [
        "^com\\.redacted\\.gradle\\.platform[:.].*",
        "^com\\.redacted\\.platform\\..+:.+\\.gradle\\.plugin"
      ],
      "enabled": false,
    },
    {
      "matchPackageNames": [
        "com.redacted.platform.java-library:com.redacted.platform.java-library.gradle.plugin"
      ],
      "enabled": true,
    },
    {
      "description": "Default container registry (prod)",
      "matchDatasources": [
        "docker"
      ],
      "registryUrls": [
        "redacted.dkr.ecr.eu-west-1.amazonaws.com"
      ]
    }
  ],

}

Logs (if relevant)

No response

[erdi]

Do I need to use https://docs.renovatebot.com/configuration-options/#prcreation by chance to get the behaviour as expected? It looks like it..

[RahulGautamSingh]

You could change prCreation to get a PR once the checks pass. But, this might mean no PR for the aws dep as it gets released too frequently. Maybe, you could try the internalChecksFilter->flexible for the aws dep ... this way youe get older versions say 1.0.3 is latest but not mature yet but 1.0.2 is ... you will get PR for 1.0.2

[erdi]

Thanks, @RahulGautamSingh.

I've changed prCreation to not-pending and I'm now seeing some items under Pending Status Checks on Dependency Dashboard.

Your suggestion for internalChecksFilter is somewhat contrary to the docs. For strict the docs say (emphasis mine)

All pending releases will be filtered. PRs will be skipped unless a non-pending version is available

And for flexible they say (emphasis again mine)

Similar to strict, but in the case where all versions are pending then a PR will be created with the highest pending version

Are the docs misleading?

[erdi]

I'm considering leaving my current config for a couple of days and seeing what happens as it feels like this might do what I'm after.

[RahulGautamSingh]

Are the docs misleading?

No, I read them wrong 😅

[erdi]

Ok, I cannot get it to work and give up. Despite of what the docs suggest, if a version is followed by another version within minimumReleaseAge with internalChecksFilter set to strict and prCreation set to not-pending a PR is not opened for such version after minimumReleaseAge has elapsed since its release.

[lukas-beumer]

I think we have had the same problem for about 8 days, the last time the dependencies were suggested correctly was on October 10th. Something has changed, especially because “strict” is now actually the default value and doesn't need to be set explicitly.

#31947

Anyone of the Renovate Team into this?

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[github-actions[bot]]

Hi there,

This discussion is too complex, and we want you to simplify. This way you are more likely to get help or a solution.

For example, if you've pasted your whole complex config, while your problem is about just one part, consider removing the parts that are not relevant to your problem. The best way to do this is to create a minimal reproduction.

You may have tried many ways to do something, and described all the methods you tried. If none of the methods worked, please focus on the most promising method, or the ideal solution. Avoid complicating the description (or logs) with the failed attempts.

To summarize: please reduce the complexity of your discussion, to increase the chances of getting help.

Thanks, the Renovate team

[github-actions[bot]]

Hi there,

Please remember that there are no Service Level Agreements (SLAs) or roadmap commitments in Open Source projects like Renovate. The maintainers and contributors work on bugs/features/docs at their own pace. This means that sometimes you will have to wait for things to happen, or to get a response.

Please avoid comments like: "Any update on this?" or "When will this be fixed?". Do not chase a maintainer to get answers quickly. We will block you if you nudge us frequently.

Please read our Code of Conduct, how we prioritize work to learn more about how we prioritize what to work on. If you are a paying Mend.io customer, please tell your support or customer contact that this issue is important to you.

Thanks, the Renovate team