Post-artifact minimumReleaseAge validation is skipped for Bun, npm, and Gradle

[risu729]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.24.0

Please tell us more about your question or problem

Renovate emits Could not re-extract the packageFile after updating it after an artifact update for managers that do not expose a usable extractPackageFile() implementation. I first saw this with Bun in https://github.com/risu729/github-notification-cleanup while using config:best-practices.

This warning means more than a failed diagnostic. With minimumReleaseAge, Renovate records ineligible releases in pendingVersions. A package manager may resolve one of those pending releases while generating a lockfile because Renovate cannot yet pass the exact selected version to every artifact command (#41624). checkForPendingVersions() is meant to re-extract the updated dependency after artifact generation and create an Artifact Error if the resolved version is pending. When re-extraction returns null, it logs this warning and skips that safeguard.

config:best-practices is affected because it extends security:minimumReleaseAgeNpm. npm-backed dependencies managed by Bun or npm can therefore reach this path without an explicit minimumReleaseAge setting. Gradle can reach the same path for Maven dependencies when Minimum Release Age is configured.

I created a public minimal reproduction covering Bun, npm, and Gradle:

https://github.com/risu729/renovate-package-reextract-repro/tree/182c40f8bf9b1a16d4a632b06438ef4bdc5307f7

It runs the real getUpdatedPackageFiles() and artifact commands against copied minimal fixtures. On renovatebot/renovate@c953fafcdc, all three managers emit the warning. The Bun and Gradle fixtures use bounded ranges that cause the artifact tool to select a known pending version into bun.lock or gradle.lockfile; no Artifact Error is produced because re-extraction fails. The npm fixture exercises its exact packageManager artifact update.

The initially apparent fix was to expose a single-file extractor for each manager. However, that only removes the warning and is not sufficient to restore the safeguard: a manifest contains a range, while the exact artifact-selected version is in the updated lockfile. Gradle also needs the other updated Gradle files to resolve cross-file variables, and npm's manager matches package.json, pnpm-workspace.yaml, and .yarnrc.yml and normally adds locked versions during post-extraction.

A complete solution therefore appears to require:

• passing all in-memory updated package files and generated artifacts to post-artifact extraction;
• making Bun re-extraction read the updated text bun.lock and fail safely for binary bun.lockb;
• making npm dispatch all of its package-file formats and run its normal npm/pnpm/Yarn lockfile post-processing against in-memory artifacts; and
• making Gradle re-extract with all configured updated files and read the resolved versions from gradle.lockfile.

I implemented and validated that approach in the exploratory draft PR #45278. The resulting package and lock files are byte-identical to upstream, while the fixed run creates the expected pending-version Artifact Errors for Bun and Gradle and no error for npm. However, the correct change is substantially larger and more cross-cutting than the original missing-extractor fix, so I am closing the PR rather than asking maintainers to review a large implementation before agreeing on the design.

I am happy to contribute the fix. Before reopening or splitting it, could maintainers confirm whether the lock-aware in-memory re-extraction approach is appropriate, or whether this safety check should instead use a different API/full repository re-extraction? I would also appreciate guidance on whether Bun, npm, and Gradle should be handled together or as separate PRs.

Logs (if relevant)

Logs

{"name":"renovate","hostname":"jr-microvm","pid":723,"level":40,"logContext":"188cf176-70ca-403f-9989-9523b53b3848","repository":"risu729/github-notification-cleanup","branch":"renovate/cloudflare-vitest-pool-workers-0.x","packageFile":"package.json","manager":"bun","msg":"Could not re-extract the packageFile after updating it","time":"2026-08-14T02:02:20.885Z","v":0}
{"name":"renovate","hostname":"jr-microvm","pid":723,"level":40,"logContext":"188cf176-70ca-403f-9989-9523b53b3848","repository":"risu729/github-notification-cleanup","branch":"renovate/wrangler-4.x","packageFile":"package.json","manager":"bun","msg":"Could not re-extract the packageFile after updating it","time":"2026-08-14T02:02:52.621Z","v":0}