AWS SDK for Java monorepo PRs mix versions

[devurandom]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

No response

Please tell us more about your question or problem

The AWS SDK for Java (software.amazon.awssdk.*) is grouped as the aws-java-sdk-v2 monorepo. Recent PRs created by Renovate mixed different versions for the different libraries of the SDK that we use. I would expect the same version to be used for all libraries of a monorepo.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    "docker:pinDigests",
    "helpers:pinGitHubActionDigests",
    ":configMigration",
    ":disableDependencyDashboard"
  ],
  "labels": [
    "test-cypress",
    "test-e2e"
  ],
  "minimumReleaseAge": "14 days",
  "packageRules": [/* none of these apply to `software.amazon.awssdk.*` */]
}

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[ydsveluvolu2996]

Renovate's aws-java-sdk-v2 monorepo preset groups related updates into one PR; grouping does not force every Maven artifact to the same target version. That is why a grouped PR may still contain mixed versions.

For AWS SDK for Java v2, make its BOM the single versioned dependency and remove explicit versions from the individual SDK modules:

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>software.amazon.awssdk</groupId>
      <artifactId>bom</artifactId>
      <version>${aws.sdk.version}</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

Then declare s3, sts, and other SDK modules without a <version>. Renovate updates ${aws.sdk.version} (or the BOM version) once, and Maven resolves every SDK component to that version.

This distinction between grouping and version alignment is also described in Renovate discussion #31399. AWS's own versioning policy says all SDK dependencies should use the same version and recommends the BOM because mixed components can cause compile-time or runtime failures.

For Gradle, use implementation(platform("software.amazon.awssdk:bom:<version>")) and omit versions from the individual SDK modules.