New rangeStrategy=in-range-only Feature is Not Updating Packages as Expected

[timnolte]

Hmm, so this feature appears to not update everything "in range". I have the following in my composer.json

"johnpbloch/wordpress": "~5.5.0",
"johnpbloch/wordpress-core": "~5.5.0",

The current version in the lockfile is

"johnpbloch/wordpress": "5.5.1",
"johnpbloch/wordpress-core": "5.5.1",

And the latest version of 5.5.x is 5.5.8 which will update when I issue a standard composer update.

  - Upgrading johnpbloch/wordpress (5.5.1 => 5.5.8)
  - Upgrading johnpbloch/wordpress-core (5.5.1 => 5.5.8)

With the setup of using in-range-only I'm not seeing any attempt to update these packages.

Originally posted by @timnolte in #13050 (comment)

I've setup an example repository here: https://github.com/timnolte/renovate-example2

Here is the latest debug information from a Renovate run:

DEBUG: packageFiles with updates
{
  "config": {
    "composer": [
      {
        "packageFile": "services/wordpress/composer.json",
        "deps": [
          {
            "depType": "require",
            "depName": "johnpbloch/wordpress",
            "currentValue": "~5.5.0",
            "datasource": "packagist",
            "lockedVersion": "5.5.1",
            "depIndex": 0,
            "warnings": [],
            "versioning": "composer",
            "sourceUrl": "https://github.com/johnpbloch/wordpress",
            "homepage": "http://wordpress.org/",
            "currentVersion": "5.5.1",
            "isSingleVersion": false,
            "fixedVersion": "5.5.1",
            "updates": []
          },
          {
            "depType": "require",
            "depName": "johnpbloch/wordpress-core",
            "currentValue": "~5.5.0",
            "datasource": "packagist",
            "lockedVersion": "5.5.1",
            "depIndex": 1,
            "warnings": [],
            "versioning": "composer",
            "sourceUrl": "https://github.com/johnpbloch/wordpress-core",
            "homepage": "https://wordpress.org/",
            "currentVersion": "5.5.1",
            "isSingleVersion": false,
            "fixedVersion": "5.5.1",
            "updates": []
          }
        ],
        "lockFiles": [
          "services/wordpress/composer.lock"
        ],
        "registryUrls": [
          "https://wpackagist.org",
          "https://packagist.org"
        ],
        "managerData": {
          "composerJsonType": "project"
        }
      }
    ]
  }
}

[viceice]

As renovate don't find new versions, it's probably related to:

• Migrate packagist API to v2 #13359

[rarkins]

Does rangeStrategy=update-lockfile work?

[timnolte]

Does rangeStrategy=update-lockfile work?

No that doesn't work as mentioned here is a previous issue comment: #12766 (reply in thread)

Later this issue was opened in response to the behavior I was still seeing: #12766 (reply in thread)

[timnolte]

@viceice interesting that this could be related to the packagist API, seems like pulling the correct version through the v1 API should still be working shouldn't it?

[viceice]

No, they told that the the old api won't provide all updates. Can somebody compare both Apis for the relevant package?

[RahulGautamSingh]

No, they told that the the old api won't provide all updates. Can somebody compare both Apis for the relevant package?

We get the same list from both APIs. Both APIs return 5.9.0 as the latest version for this package.
The new API is supposed to provide data related to updates faster than the old API so the data will be the same for both APIs after sometime(probably a few minutes)

[timnolte]

@RahulGautamSingh OK, thanks for confirming then that this has nothing to do with the API version and is another new issue.

[timnolte]

It has been many months and it appears that this feature is still broken and not really functioning.

[viceice]

somebody needs to debug this.

[timnolte]

I feel like there are either 2 things happening.

1. When the latest version of the package is beyond the version constraint it can't update to the latest version that does match the version constraint. This means that if you miss applying an update then Renovate will never include that update again going forward.
2. There is a bug that is only comparing the lock file version to the composer.json version pattern and if they pass then it does nothing.

[RahulGautamSingh]

@timnolte You're correct. It is a code-logic problem.

We use the latest version from allVersions list to get the best release, for all range strategies which is not good when we only want the latest version within a range. Instead we should be using the allSatisfyingVersions list when rangeStrategy='in-range-only'

Gotta change this line;

renovate/lib/workers/repository/process/lookup/index.ts

Line 238 in 368f635

allVersions,

To something like this:

 config.rangeStrategy === 'in-range-only'
          ? allSatisfyingVersions
          : allVersions,

[RahulGautamSingh]

Test run result:

DEBUG: packageFiles with updates (repository=RahulGautamSingh-testing/renovate-example2, baseBranch=main)
       "config": {
         "composer": [
           {
             "packageFile": "services/wordpress/composer.json",
             "deps": [
               {
                 "depType": "require",
                 "depName": "johnpbloch/wordpress",
                 "currentValue": "~5.5.0",
                 "datasource": "packagist",
                 "lockedVersion": "5.5.1",
                 "depIndex": 0,
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "5.5.10",
                     "newValue": "~5.5.0",
                     "releaseTimestamp": "2022-08-30T17:53:35.000Z",
                     "newMajor": 5,
                     "newMinor": 5,
                     "updateType": "patch",
                     "isRange": true,
                     "isLockfileUpdate": true,
                     "branchName": "renovate/johnpbloch-wordpress-5.x-lockfile"
                   }
                 ],
                 "warnings": [],
                 "versioning": "composer",
                 "sourceUrl": "https://github.com/johnpbloch/wordpress",
                 "homepage": "http://wordpress.org/",
                 "currentVersion": "5.5.1",
                 "isSingleVersion": true,
                 "fixedVersion": "5.5.1"
               }
             ],
             "lockFiles": ["services/wordpress/composer.lock"],
             "registryUrls": ["https://wpackagist.org", "https://packagist.org"],
             "managerData": {"composerJsonType": "project"}
           }
         ]
       }

[timnolte]

@RahulGautamSingh that looks like what I would expect! 👍🏼

[RahulGautamSingh]

@rarkins @viceice Should I submit a PR for this?

[renovate-release]

🎉 This issue has been resolved in version 32.236.4 🎉

The release is available on:

• GitHub release
• 32.236.4

Your semantic-release bot 📦🚀