Release Notes - PR release notes only for first dep in a monorepo

[setchy]

How are you running Renovate?

• WhiteSource Renovate hosted app on github.com
• Self hosted

If using the hosted app, please skip to the next section.
Otherwise, if self-hosted, please complete the following:

Please select which platform you are using:

• Azure DevOps (dev.azure.com)
• Azure DevOps Server
• Bitbucket Cloud (bitbucket.org)
• Bitbucket Server
• Gitea
• github.com
• GitHub Enterprise Server
• gitlab.com
• GitLab self-hosted

Renovate version: @latest (25.56.10 at time of post)

Describe the bug
We have a nodejs project that has dependencies on both

• @apollo/federation and
• @apollo/gateway

It appears that when renovate-bot is producing the PR release notes is not handling both of the CHANGELOG.md files in the monorepo for each respective depdency

• https://github.com/apollographql/federation/blob/main/federation-js/CHANGELOG.md
• https://github.com/apollographql/federation/blob/main/gateway-js/CHANGELOG.md

Minimal reproduction details below

• Repository - https://github.com/setchy/renovate-bot-testbed-apollo
• Example PR - https://github.com/setchy/renovate-bot-testbed-apollo/pull/3

Only the apollographql/federation CHANGELOG.md notes are added, while the apollographql/gateway CHANGELOG.md is skipped entirely
...

Relevant debug logs

Click me to see logs

Copy/paste any log here, between the starting and ending backticks

Have you created a minimal reproduction repository?

Please read the minimal reproductions documentation to learn how to make a good minimal reproduction repository.

• I have provided a minimal reproduction repository
• I don't have time for that, but it happens in a public repository I have linked to
• I don't have time for that, and cannot share my private repository
• The nature of this bug means it's impossible to reproduce publicly

Additional context

...

[setchy]

@rarkins - please let me know if you require further information to triage this

[rarkins]

I don't see any minimal reproduction repository (please see the linked document above). I believe it's related to the way we de-dupe packages from the same repo

[setchy]

@rarkins - the reproduction repository is this one - https://github.com/setchy/apollo-federation-poc/pull/17

[rarkins]

The presence of 13 dependencies disqualifies it as minimal

[setchy]

Got it. Fixed

• Repository - https://github.com/setchy/renovate-bot-testbed-apollo
• Example PR - https://github.com/setchy/renovate-bot-testbed-apollo/pull/3

[github-actions]

Thank you for providing a reproduction! 🎉 🚀

The Renovate team will take a look at the reproduction repository.

[rarkins]

I think it's this logic that's causing us to dedupe:

renovate/lib/workers/pr/index.ts

Lines 317 to 329 in aa4fabe

	for (const upgrade of config.upgrades) {
	if (upgrade.hasReleaseNotes) {
	if (releaseNoteRepos.includes(upgrade.sourceUrl)) {
	logger.debug(
	{ depName: upgrade.depName },
	'Removing duplicate release notes'
	);
	upgrade.hasReleaseNotes = false;
	} else {
	releaseNoteRepos.push(upgrade.sourceUrl);
	}
	}
	}

The further challenge is that we display release notes in PRs grouped by repo today, so that would need to change because monorepos can have different packages with different release notes.

[rarkins]

To progress from status:requirements to status:ready we'd need agreement on how the logic and presentation should work once we move from the assumption of source URLs being the "key" for each release notes.

[setchy]

Resolved with #12543