Major updates being pushed in cases where we are not expecting them

[dreyes333]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Kubernetes, being used for GitLab. Renovate v39.207.3

Please tell us more about your question or problem

We have a GitLab project that inherits the following config.json:

{
    "packageRules": [
        {
            "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
            "enabled": true
        }
    ],
    "schedule" : ["* * * * 1"],
    "vulnerabilityAlerts": {
      "enabled": true
    },
    "extends": ["mergeConfidence:all-badges"],
    "allowedPostUpgradeCommands": [".*"]
}

The project has a local renovate.json that looks like this:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
}

From what I understand, the packageRule we have defined in config.json should exclude major updates except for security related ones since have vulnerabilityAlerts enabled.

The problem we're seeing is that a major update is still being created for the package org.springframework.boot. Renovate is proposing for it to be upgraded from version 2.7.18 to version 3.4.3. It's definitely not a security related update. One solution we have found for this is to explicitly disable major updates by adding the following package rule:

{
      "matchUpdateTypes": ["major"],
      "enabled": false
 }

One other theory I had was that maybe Renovate was proposing the update because the version was unsupported/deprecated but when looking into it there was no mention of the package being unsupported/deprecated.

I did look through the logs(DEBUG mode) and couldn't find anything that shows how renovate makes its decisions, also tried looking at source code but got lost in all the code.

The only other thing i can think of is that maybe major updates are enabled by default and thats why the solution above works. Would love some clarity on this, thank you.

Logs (if relevant)

Logs

Looking up org.springframework.boot:org.springframework.boot.gradle.plugin in repository https://plugins.gradle.org/m2/

Found 204 new releases for org.springframework.boot:org.springframework.boot.gradle.plugin in repository https://plugins.gradle.org/m2/

getBranchPr(renovate/major-spring-boot)

[rarkins]

Your rule does nothing at all. Enabled=true is default behavior so the rule changes nothing. Instead, you need a rule which sets enabled=false for major updates

[dreyes333]

Makes sense, thank you.