bug: unexpected dependency update net.bytebuddy:byte-buddy v1.18.8 to v1.18.8-jdk5

[todor-t]

How are you running Renovate?

as docker image renovate/renovate:43.183-full

Which platform you running Renovate on?

GitLab (.com or self-hosted)

Which version of Renovate are you using?

43.183.1

Please tell us more about your question or problem

Today our system got an MR to update net.bytebuddy:byte-buddy from 1.17.5 to 1.18.8-jdk5.
After internal review we decided to update to v1.18.8, since we don't need backward compatibility. Unfortunately once the change has been merged, the renovate plugin generated an unexpected MR to update net.bytebuddy:byte-buddy from 1.18.8 to 1.18.8-jdk5.
Can you please help with this isssue? Not sure if it caused by misconfiguration or it is a bug in the plugin.

[github-actions[bot]]

Hi there,
To the Discussion creator: please edit and improve the "Which version of Renovate are you using?" answer.
You've specified either latest or a major version number, but as Renovate ships many updates daily, the specific version of Renovate that runs changes.
You can find the specific Renovate version by checking the INFO: Repository started log line.
Thanks, the Renovate team

[github-actions[bot]]

Hi there,
We notice that the Discussion you've created doesn't quite follow our template.
Please update the top-level comment in this Discussion to follow the structure of the template.
This improves the maintainers' time to triage, as key information is clearly indicated in the format we expect.
Thanks, the Renovate team

[todor-t]

update discussion, hope it's better now

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

Read the Renovate docs, troubleshooting, self-hosted to learn how to find the logs.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[todor-t]

Sorry! I cannot provide any logs.

[todor-t]

but it really looks like a bug, since both versions 1.18.8 and 1.18.8-jdk5 equally valid.

[bsa01]

@todor-t we had the same problem with bytebuddy, as they release multiple tags.

We used a package rule to ignore the jdk5 tag.

"packageRules": [
   {
      "matchPackageNames": ["net.bytebuddy:byte-buddy-agent","net.bytebuddy:byte-buddy"],
      "allowedVersions": "/^[0-9]+\\.[0-9]+\\.[0-9]+$/"
    }
]

[hazendaz]

I feel like this situation with byte buddy is one where the author of byte buddy disagrees with community and should be one of those built ins that just ignores that jdk 5 cut. His stance is that it hurts nothing and is same as it was prior to the dual release which is fair but something I think most do not, would not want. It was never clear who is using java 5 to start with making it so important. See #42509 as duplicate of this issue where I added 2 additional package rule styles that can be used to ignore as well.

My opinion not withstanding, the problem really boils down to how renovate wants to work for masses that means everyone has to add such an exclusion which shouldn't be necessary, corporate policies may differ and have more broad control but generally speaking 'jdk5' in a version string for maven isn't even following maven standards so it should be just out right ignored with suggestion of it being one opted into IMO.