Preset config:base triggers warnings for Spring dependencies

[ChristianCiach]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us what version of Renovate you run.

36.0.3

If you're self-hosting Renovate, select which platform you are using.

Gitlab self-hosted

Was this something which used to work for you, and then stopped?

It used to work, and then stopped

Describe the problem

Our renovate.json files look like this:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],
  "assigneesFromCodeOwners": true
}

I just updated from v35 to v36.0.3 (latest version on docker hub) and now most of our repos trigger this warning:

 WARN: Use matchDepNames instead of matchPackageNames (repository=censored)                                                                                                                                                                     
       "packageName": "org.springframework.boot:org.springframework.boot.gradle.plugin",                                                                                                                                                                      
       "depName": "org.springframework.boot"       

This is probably caused by the included preset group:springBoot that, according to the documentation, is implemented this way:

{
  "packageRules": [
    {
      "groupName": "spring boot",
      "matchPackageNames": [
        "org.springframework.boot"
      ],
      "matchPackagePrefixes": [
        "org.springframework.boot:"
      ]
    }
  ]
}

Even if this warning had been generated by a custom rule, I would rather not use matchDepNames as long as the documentation scares me away from using it by saying:

For advanced use only! Use at your own risk!

Reproducible example: https://github.com/ChristianCiach/renovate-v36-spring-warnings

Relevant debug logs

No response

Have you created a minimal reproduction repository?

I have linked to a minimal reproduction in the description above

[rarkins]

Can you reproduce this publicly? I'm curious why the depName is how it is

[rarkins]

@Churro is this possibly due to a variable name?

[Churro]

group:springBoot is supposed to apply to depName, whereas packageName includes the concrete plugin. Hence, changing the preset to matchDepNames is the way to go but I think you already know that by now 👍

[ChristianCiach]

@Churro Just so I get this right, too: You are proposing to change the preset to this:

{
  "packageRules": [
    {
      "groupName": "spring boot",
      "matchDepNames": [
        "org.springframework.boot"
      ],
      "matchPackagePrefixes": [
        "org.springframework.boot:"
      ]
    }
  ]
}

Then matchDepNames is exclusively used to match the Gradle plugin name, while matchPackagePrefixes is used to match the regular maven dependencies on maven-central, right?

By the way, thank you for all your contributions to make Renovate work with Gradle. Thanks to you we recently were able to start using Gradle version catalogs. Awesome work!

[Churro]

@ChristianCiach, yes, this is the preset change I meant and also what @rarkins just realized in PR #23187.

• matchDepNames matches the org.springframework.boot (= depName) that gradle internally expands to org.springframework.boot:org.springframework.boot.gradle.plugin (= packageName) .
• matchPackagePrefixes matches dependencies whose depName starts with org.springframework.boot: and this would almost match the plugin as well - almost because you specify in the gradle buildscript without trailing colon: id("org.springframework.boot")
  We could strip the colon in this case but then we'd risk confusion if packages would be published in a group like org.springframework.bootsomething. To prevent this in the first place, there are two patterns.

Thank you for the feedback! I'm really happy to hear that you find them so valuable 😊

[ChristianCiach]

I see that the PR has been merged. I will test this and close this discussion tomorrow if everything works out fine. Thanks a lot, all you guys!

[github-actions[bot]]

Hi there,

Get your issue fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this.

To get started, please read our guide on creating a minimal reproduction.

We may close the issue if you, or someone else, haven't created a minimal reproduction within two weeks. If you need more time, or are stuck, please ask for help or more time in a comment.

Good luck,

The Renovate team

[rarkins]

Do you have a repository to link to?

[ChristianCiach]

Added to the description of this discussion before I made the previous comment.

[rarkins]

Thanks, that reproduces for me

[ChristianCiach]

Did you overlook my previous link at #23178 (reply in thread) ? This links to both the repository and the logs that show the issue. Was this not sufficient?

[rarkins]

Yes, it's sufficient

[rarkins]

@ChristianCiach is it resolved for you in 36.1.5?

[ChristianCiach]

Yes, the Spring issue has been fixed! Thanks a lot!

Now I am seeing a similar warning for some repos and the same renovate.json (extending config:base):

 WARN: Use matchDepNames instead of matchPackageNames (repository=censored)
       "packageName": "nodejs/node",
       "depName": "node"

I leave this up to you if this is worth pursuing.

Edit: Probably caused by

renovate/lib/config/presets/internal/group.ts

Lines 298 to 309 in e064eb4

	nodeJs: {
	description:
	"Group anything that looks like Node.js together so that it's updated together.",
	packageRules: [
	{
	commitMessageTopic: 'Node.js',
	excludePackageNames: ['calico/node', 'kindest/node'],
	matchDatasources: ['docker'],
	matchPackageNames: ['node'],
	matchPackagePatterns: ['/node$'],
	},
	],

[rarkins]

#23213

[ChristianCiach]

Thank you very much for your crazy fast responses and fixes!