[bug?] Suggesting update for docker image (eclipse-temurin) without respecting versioning "granularity"

[tbroyer]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

Other (please specify)

Which version of Renovate are you using?

43.195.0

Please tell us more about your question or problem

For a few weeks now, Renovate creates PRs to update our compose.yaml and Dockerfile from eclipse-temurin:21-jre to eclipse-temurin:21.0.11_10-jre.

I don't understand why. It should IMO and IIUC stay on 21-jre (particularly as they do point to the same sha256! here and there), and it didn't happen with 21.0.9_10-jre for instance.

We do use a Docker registry mirror, but I don't think that matters here.

We're running Renovate on Jenkins using a command similar to:

docker run --pull=always --rm -u 0:0 \
    -e "RENOVATE_CONFIG_FILE=${pwd()}/config.js" \
    …
    -v "${pwd()}:${pwd()}:ro" \
    -v "renovate:/renovate" \
    renovate/renovate:43 \
    --endpoint="$gerritUrl" --platform="gerrit" \
    --persist-repo-data="true" --base-dir="/renovate" \
    --allowed-unsafe-executions='["goGenerate", "gradleWrapper"]' \
    …

(there are a few other params for inherited config, and environment variables for secrets)

Logs (if relevant)

Logs

DEBUG: Combined config
       "config": {
         "dependencyDashboard": true,
         "description": [
           …
         ],
         "packageRules": [
           …
           {
             "allowedVersions": "/^(?:8|11|17|21|25)(?:\\.|-|$)/",
             "description": [
               "Limit Java runtime versions to LTS releases. To receive all major releases add `workarounds:javaLTSVersions` to the `ignorePresets` array."
             ],
             "matchDatasources": ["docker", "java-version"],
             "matchPackageNames": [
               "eclipse-temurin",
               "amazoncorretto",
               "adoptopenjdk",
               "openjdk",
               "java",
               "java-jdk",
               "java-jre",
               "sapmachine",
               "/^azul/zulu-openjdk/",
               "/^bellsoft/liberica-openj(dk|re)-/",
               "/^cimg/openjdk/"
             ],
             "versioning": "regex:^(?<major>\\d+)?(\\.(?<minor>\\d+))?(\\.(?<patch>\\d+))?([\\._+](?<build>(\\d\\.?)+)(LTS)?)?(-(?<compatibility>.*))?$"
           },
           {
             "allowedVersions": "/^(?:8|11|17|21|25)(?:\\.|-|$)/",
             "description": [
               "Limit Java runtime versions to LTS releases. To receive all major releases add `workarounds:javaLTSVersions` to the `ignorePresets` array."
             ],
             "matchDatasources": ["docker", "java-version"],
             "matchDepNames": [
               "eclipse-temurin",
               "amazoncorretto",
               "adoptopenjdk",
               "openjdk",
               "java",
               "java-jre",
               "sapmachine"
             ],
             "versioning": "regex:^(?<major>\\d+)?(\\.(?<minor>\\d+))?(\\.(?<patch>\\d+))?([\\._+](?<build>(\\d\\.?)+)(LTS)?)?(-(?<compatibility>.*))?$"
           },
…
DEBUG: packageFiles with updates (repository=REDACTED, baseBranch=main)
       "config": {
         "docker-compose": [
           …
           {
             "deps": [
               …
               {
                 "depName": "eclipse-temurin",
                 "packageName": "eclipse-temurin",
                 "currentValue": "21-jre",
                 "replaceString": "eclipse-temurin:21-jre",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "21.0.11_10-jre",
                     "newValue": "21.0.11_10-jre",
                     "newMajor": 21,
                     "newMinor": 0,
                     "newPatch": 11,
                     "updateType": "patch",
                     "isBreaking": false,
                     "branchName": "renovate/all-minor-patch"
                   },
                   {
                     "bucket": "major",
                     "newVersion": "25.0.3_9-jre",
                     "newValue": "25.0.3_9-jre",
                     "newMajor": 25,
                     "newMinor": 0,
                     "newPatch": 3,
                     "updateType": "major",
                     "isBreaking": true,
                     "branchName": "renovate/eclipse-temurin-25.x"
                   }
                 ],
                 "versioning": "regex:^(?<major>\\d+)?(\\.(?<minor>\\d+))?(\\.(?<patch>\\d+))?([\\._+](?<build>(\\d\\.?)+)(LTS)?)?(-(?<compatibility>.*))?$",
                 "warnings": [],
                 "sourceUrl": "https://github.com/adoptium/containers",
                 "registryUrl": "REDACTED",
                 "homepage": "https://hub.docker.com/_/eclipse-temurin",
                 "lookupName": "library/eclipse-temurin",
                 "currentVersion": "21-jre",
                 "isSingleVersion": true,
                 "fixedVersion": "21-jre"
               },
               …
             ],
             "packageFile": "REDACTED/compose.yaml"
           }
         ],
         "dockerfile": [
           …
           {
             "deps": [
               {
                 "depName": "eclipse-temurin",
                 "packageName": "eclipse-temurin",
                 "currentValue": "21-jre",
                 "replaceString": "eclipse-temurin:21-jre",
                 "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
                 "datasource": "docker",
                 "depType": "final",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "21.0.11_10-jre",
                     "newValue": "21.0.11_10-jre",
                     "newMajor": 21,
                     "newMinor": 0,
                     "newPatch": 11,
                     "updateType": "patch",
                     "isBreaking": false,
                     "branchName": "renovate/all-minor-patch"
                   },
                   {
                     "bucket": "major",
                     "newVersion": "25.0.3_9-jre",
                     "newValue": "25.0.3_9-jre",
                     "newMajor": 25,
                     "newMinor": 0,
                     "newPatch": 3,
                     "updateType": "major",
                     "isBreaking": true,
                     "branchName": "renovate/eclipse-temurin-25.x"
                   }
                 ],
                 "versioning": "regex:^(?<major>\\d+)?(\\.(?<minor>\\d+))?(\\.(?<patch>\\d+))?([\\._+](?<build>(\\d\\.?)+)(LTS)?)?(-(?<compatibility>.*))?$",
                 "warnings": [],
                 "sourceUrl": "https://github.com/adoptium/containers",
                 "registryUrl": "REDACTED",
                 "homepage": "https://hub.docker.com/_/eclipse-temurin",
                 "lookupName": "library/eclipse-temurin",
                 "currentVersion": "21-jre",
                 "isSingleVersion": true,
                 "fixedVersion": "21-jre"
               }
             ],
             "packageFile": "REDACTED/Dockerfile"
           },
           …
DEBUG: branches info extended (repository=REDACTED)
       "branchesInformation": [
         {
           "branchName": "renovate/all-minor-patch",
           "prNo": REDACTED,
           "prTitle": "Update eclipse-temurin Docker tag to v21.0.11_10-jre",
           "result": "done",
           "upgrades": [
             {
               "datasource": "docker",
               "depName": "eclipse-temurin",
               "displayPending": "",
               "fixedVersion": "21-jre",
               "currentVersion": "21-jre",
               "currentValue": "21-jre",
               "newValue": "21.0.11_10-jre",
               "newVersion": "21.0.11_10-jre",
               "packageFile": "REDACTED/Dockerfile",
               "updateType": "patch",
               "packageName": "eclipse-temurin"
             },
             {
               "datasource": "docker",
               "depName": "eclipse-temurin",
               "displayPending": "",
               "fixedVersion": "21-jre",
               "currentVersion": "21-jre",
               "currentValue": "21-jre",
               "newValue": "21.0.11_10-jre",
               "newVersion": "21.0.11_10-jre",
               "packageFile": "REDACTED/compose.yaml",
               "updateType": "patch",
               "packageName": "eclipse-temurin"
             }
           ]
         },

[tbroyer]

So, do we agree that this is a bug in the definition of the javaLTSVersions workaround? (neutering the docker versioning that considers 21-jre higher than 21.0.11_10-jre)

IIUC, if I know I never pin versions and don't care about the precise Java versioning (e.g. with the _<build> suffix), I could ignore the workarounds:javaLTSVersions preset and create my own package rules without the versioning field (to keep the docker versioning)

"fixed" package rules

      {
        allowedVersions: '/^(?:8|11|17|21|25)(?:\\.|-|$)/',
        description: 'Limit Java runtime versions to LTS releases.',
        matchDatasources: ['docker', 'java-version'],
        matchPackageNames: [
          'eclipse-temurin',
          'amazoncorretto',
          'adoptopenjdk',
          'openjdk',
          'java',
          'java-jdk',
          'java-jre',
          'sapmachine',
          '/^azul/zulu-openjdk/',
          '/^bellsoft/liberica-openj(dk|re)-/',
          '/^cimg/openjdk/',
        ],
      },
      {
        allowedVersions: '/^(?:8|11|17|21|25)(?:\\.|-|$)/',
        description: 'Limit Java runtime versions to LTS releases.',
        matchDatasources: ['docker', 'java-version'],
        matchDepNames: [
          'eclipse-temurin',
          'amazoncorretto',
          'adoptopenjdk',
          'openjdk',
          'java',
          'java-jre',
          'sapmachine',
        ],
      },
      {
        allowedVersions: '/^(?:jdk|jdk-all|jre)-(?:8|11|17|21|25)(?:\\.|-|$)/',
        description: 'Limit Java runtime versions to LTS releases.',
        matchDatasources: ['docker'],
        matchPackageNames: [
          'bellsoft/hardened-liberica-runtime-container',
          'bellsoft/liberica-runtime-container',
        ],
      },

[jamietanna]

Sorry, this user is spamming the Discussions with AI generated replies. I've blocked them now

@RahulGautamSingh mind taking a look at this question?

[tbroyer]

Gentle ping.

Is it a bug or somehow the intended behavior?

[RahulGautamSingh]

Expected behavior, your custom versioning is the cause. (More-of an expected limitation, not a bug)

regex versioning doesn't reproduce docker's "same number of version segments" rule. Default docker versioning treats 21-jre (1 segment) and 21.0.11_10-jre (3 segments) as incompatible, so it never offers that update.

Your regex only compares the compatibility group, both tags resolve to jre, so they match and the update is offered. (The shared digest isn't checked; filtering is on version strings.)

Possible fixes:

1. Remove the versioning override on eclipse-temurin and use native docker versioning. To keep the LTS-only restriction, do it with allowedVersions in a packageRules matcher instead of a custom versioning.

2. Keep the regex but track a fixed granularity. Pin the value to 21.0.11_10-jre instead of 21-jre so comparisons stay within the same segment count.

[tbroyer]

I think you misunderstood the situation: I do not have a custom versioning (unless you're talking about workarounds:javaLTSVersions but that's not mine), that was a suggestion for a workaround. And Renovate wants to update 21-jre to 21.0.11_10-jre, which I'm trying to find a solution to as I want to keep 21-jre.

[RahulGautamSingh]

My bad, I confused the details.

The mechanism: default docker versioning won't offer 21-jre → 21.0.11_10-jre because it enforces a matching segment count. The preset overrides that with regex versioning, which has no segment-count rule, so 21.0.11 sorts above 21 and the update is offered

To stay on 21-jre today, you'll need to add a package rule that ignores updates when the current tag is major-only:

{
"matchDatasources": ["docker"],
"matchPackageNames": ["eclipse-temurin"],
"matchCurrentValue": "/^\\d+-/",
"allowedVersions": "/^\\d+-/"
}

Longer term this looks like a real limitation in the preset's regex versioning and we should track fixing it. Possibly using the docker versioning could be a solution as it blocks the 21-jre to 21.0.11_10-jre update as it counts segement and it also enforces LTS only