Replacement escapes its packageRule and is offered on sibling deps of the same packageName

[benlangfeld]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

Other (please specify)

Which version of Renovate are you using?

44.54.0 (first seen on 44.52.1, reproduced on both)

Please tell us more about your question or problem

Summary

A dependency that matches no packageRules entry containing replacementName is nevertheless offered that replacement. In the reproduction below, percona/percona-postgresql-operator:2.6.0 — a bare operator tag — is offered percona/percona-distribution-postgresql:17.7-2, an entirely different image, alongside its legitimate version updates.

This matters because that Docker repository hosts several different components distinguished only by tag suffix, so a mis-applied replacement swaps one component's image for another's rather than merely picking a wrong version.

Environment

Self-hosted CLI on Node 24.20.0. re2 is installed and loaded (the log shows no RE2 not usable warning). The reproduction below runs against the local filesystem with RENOVATE_PLATFORM=local, so it is not platform-specific.

Minimal reproduction

Reproduction repository: https://github.com/benlangfeld/renovate-repro-45603

The repo root is the reproduction, so Renovate can be pointed straight at it; ./reproduce.sh runs it locally with no platform involved. The two files are reproduced inline below.

values.yaml (picked up by the helm-values manager):

a:
  image: percona/percona-postgresql-operator:2.7.0-ppg17.5.2-postgres
b:
  image: percona/percona-postgresql-operator:2.7.0-ppg17.5.2-postgres-gis3.3.8
c:
  image: percona/percona-postgresql-operator:2.6.0

renovate.json:

{ "packageRules": [
  { "matchDatasources":["docker"], "matchPackageNames":["percona/percona-postgresql-operator"],
    "matchCurrentVersion":"/^\\d+\\.\\d+\\.\\d+$/", "versioning":"semver" },
  { "matchDatasources":["docker"], "matchPackageNames":["percona/percona-postgresql-operator"],
    "matchCurrentVersion":"/-postgres-gis/", "allowedVersions":"/^(nonexistent)$/" },
  { "matchDatasources":["docker"], "matchPackageNames":["percona/percona-postgresql-operator"],
    "matchCurrentVersion":"/-postgres$/", "replacementName":"percona/percona-distribution-postgresql", "replacementVersion":"17.7-2" }
] }

Run:

LOG_LEVEL=debug RENOVATE_PLATFORM=local RENOVATE_DRY_RUN=full renovate

All three images are public, so this needs no credentials.

Observed

All three deps are offered the replacement to percona/percona-distribution-postgresql:17.7-2, including c (2.6.0), which gets it alongside its legitimate minor and major updates. See the packageFiles with updates excerpt in the logs section below.

Expected

Only dep a matches the replacement rule's matchCurrentVersion (/-postgres$/). Deps b and c should get no replacement update.

The regexes behave correctly in isolation — tested directly against the three tag strings, /-postgres$/ matches only 2.7.0-ppg17.5.2-postgres — so the rule's own matching is not the problem.

What the trigger seems to need

Removing any one of these three makes the output correct, so all three appear necessary:

1. versioning: "semver" on a rule that matches the victim dep (c). Dropping it from rule 1 makes the run clean. Its allowedVersions is not needed.
2. A rule with an unsatisfiable allowedVersions matching a third dep (b). Removing that rule, or giving it a satisfiable allowedVersions, makes the run clean.
3. A dep that legitimately matches the replacement rule (a). With only b and c present, the run is clean.

Deps b and c both receive the replacement belonging to a, which is why this reads as a replacement escaping its rule and attaching to sibling deps of the same packageName.

Ruled out

• Not the RE2 fallback. First seen with the JS fallback, then reproduced with re2 installed and active.
• Not a stale cache. Reproduced with the cache directory removed before each run.
• Not flaky. Deterministic across repeated runs.

Possibly related

#20304 (closed, completed) is in the same area — a replacement affecting a dependency it should not have — but its symptom is the old image being rewritten with the new image's digest, whereas here an unrelated dep gains a whole replacement update. #12623 also touches docker replacements.

Notes

I hit this while adding replacementName rules to a shared preset for images Percona moved between repositories. The reproduction above is the reduced form of a larger real-world config, cut down from 28 rules and 8 dependencies to 3 and 3, and is published at https://github.com/benlangfeld/renovate-repro-45603. Happy to transfer it into renovate-reproductions if you would rather own it there.

Logs (if relevant)

Logs

packageFiles with updates (abridged to the relevant deps):

2.7.0-ppg17.5.2-postgres            replacement -> percona-distribution-postgresql:17.7-2
2.7.0-ppg17.5.2-postgres-gis3.3.8   replacement -> percona-distribution-postgresql:17.7-2
2.6.0                               minor -> 2.9.0; major -> 3.0.0; replacement -> percona-distribution-postgresql:17.7-2

[benlangfeld]

Minimal reproduction repository: https://github.com/benlangfeld/renovate-repro-45603

The repo root is the reproduction — values.yaml with three tags of the same Docker repository, and renovate.json with three packageRules — so you can point Renovate straight at it. The readme covers current vs. expected behaviour and which three ingredients the trigger needs.

./reproduce.sh runs it locally without any platform: it copies the two config files into a fresh temp directory, installs renovate@44.54.0 plus re2, and runs with RENOVATE_PLATFORM=local RENOVATE_DRY_RUN=full, which only reads. Needs node >= 24 and Docker Hub access; all three images are public so no credentials. Set RENOVATE_VERSION to try another release.

It prints the per-dependency updates and the regex engine Renovate picked, so the JS-regex fallback can be ruled out from the output itself — a clean run reports Using RE2 regex engine. Last run on 44.54.0:

regex engine (expect RE2): Using RE2 regex engine

--- updates per dependency ---
percona/percona-postgresql-operator:2.7.0-ppg17.5.2-postgres           replacement -> percona/percona-distribution-postgresql:17.7-2
percona/percona-postgresql-operator:2.7.0-ppg17.5.2-postgres-gis3.3.8  replacement -> percona/percona-distribution-postgresql:17.7-2
percona/percona-postgresql-operator:2.6.0                              minor -> 2.9.0; major -> 3.1.0; replacement -> percona/percona-distribution-postgresql:17.7-2

The minor/major targets on the third dep are legitimate and will drift as Percona publishes new operator tags. The signal is the replacement -> suffix on the second and third deps, neither of which matches the rule carrying replacementName.

Happy to transfer it into renovate-reproductions if you would rather own it there.

_{Supersedes the gist I posted first (https://gist.github.com/benlangfeld/4255d50acabf053b969ffa2f1fdfaa88) — same reproduction, now in a repository you can run Renovate against directly.}

[github-actions[bot]]

Hi there,
We notice that the Discussion you've created doesn't quite follow our template.
Please update the top-level comment in this Discussion to follow the structure of the template.
This improves the maintainers' time to triage, as key information is clearly indicated in the format we expect.
Thanks, the Renovate team

[benlangfeld]

Done.