Downgrade maven dependency

[cb9115]

How are you running Renovate?

None

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

We use renovate to update our maven dependencies. Is there a solution with renovate to downgrade a maven dependency?

If renovate updates a dependency in our projects and this leads to error on our test environment, we would like to downgrade the dependency using renovate.

e.g. org.springframework.boot:spring-boot-starter-parent was updated by renvoate to version 3.4.1 and we now want to downgrade all our projects to version 3.4.0.

Does renvoate provide such a mechanism? What was currently tried is with "replacement" and "allowedVersions", but no Pull-Request was created there wit a lower version.

Logs (if relevant)

No response

[rarkins]

I don't think there's any way to achieve this but how would the "UX" for this work?

e.g. you say "all your projects" so is this something you'd want to apply "globally" (for all repos)?

Where/how would you propose to configure such a rule? And presumably one day you'd like to remove the rule too?

[cb9115]

Exactly I have a global configuration for all repositories:

packageRules: [
        {
            matchDatasources: ["maven"],
            registryUrls: ["NEXUS_URL"],
        },
        {
            // Deactivate everything to only enable specific rules
            enabled: false,
            matchUpdateTypes: ["major", "minor", "patch", "pin", "pinDigest", "digest", "lockFileMaintenance", "rollback", "bump", "replacement"],
        },
        {
            groupName: "all non-major dependencies",
            groupSlug: "all-minor-patch",
            matchPackagePatterns: ["*"],
            matchUpdateTypes: ["minor", "patch"],
        },
        {
            enabled: true,
            matchDatasources: ["maven"],
            matchUpdateTypes: ["minor", "patch"],
            matchNewValue: "/^[0-9]+\\.[0-9]+\\.[0-9]+$/"
        }
    ]

And I would like to customize the global configuration, e.g. with:

        {
            matchPackageNames: ["org.springframework.boot:spring-boot-starter-parent"],
            allowedVersions: "3.4.0"
        },
        {
            matchPackageNames: ["org.springframework.boot:spring-boot-starter-parent"],
            versioningStrategy: "pin"
        }

And then start renovate again with this new configuration so that the dependency is updated (downgraded).

Exactly, if a new version of the dependency is available, then I would delete the configuration again so that renovate updates the dependency again.

Although this requires manual intervention in the global renovate configuration, it is still better than manually downgrading 80 projects.

[rarkins]

We have a feature "rollbackPrs" today which is for downgrading (rolling back) when the currently used version is missing. However I think that this rollback check is done before the allowedVersions filtering is done. It might be possible to refactor this feature to incorporate allowedVersions, although would technically be a change in functionality for existing users and may have downsides we haven't thought of.

[milas]

I'm in favor of rollbackPrs + allowedVersions working together to trigger the opening of downgrade PRs.

I actually thought it would work and ended up here while looking for an explanation on how to have Renovate trigger downgrade PRs for the same reasons. (In my intance, not for Maven, but similar use case.)

[mcfedr]

I'd love something similar for npm deps, I've been trying to make it happen but doesnt work.

I have a situation where a dep we use has been updasted in a few projects, but its got a bug, and i want to automatically rollback.

tried using allowedVersions and constraints, together with rollbackPrs but doesnt work. also replacementVersion doesnt work.

[alles-klar]

I was successful with the use of replacementVersion

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "packageRules": [
    {
      "description": "Migrate to new versioning",
      "matchDatasources": [
        "docker"
      ],
      "matchPackageNames": [
        "foo"
      ],
      "matchCurrentValue": "/(4\\.1)/",
      "replacementVersion": "1.0"
    },
    {
      "description": "Update software",
      "matchDatasources": [
        "docker"
      ],
      "matchPackageNames": [
        "foo"
      ],
      "allowedVersions": "!/(4\\.1)/"
    }
  ]
}

This solution updates/downgrades from 4.1 to 1.0. If a newer version is available, a update to 1.1 is done after the first PR was merged and renovate runs again.

More fancy and dynamic solutions might possible with replacementVersionTemplate.