minimumReleaseAge is still creating PRs before the configured age threshold leading to potential vulnerabilities #38324
Replies: 3 comments 11 replies
-
You expect As per the docs, there's no mention that solely Whether branch/PR is created or not can be controlled by users using other available options which gives users the flexibility to customize behavior.
A design choice, we won't be discussing that here
If no branch previously existed for the update .. then by default you won't get a branch because of If an older branch with same name exists, as in your case. You set
If you have found a case where it doesn't create a separate discussion. Now, the actual issue which cannot be handled by Renovate today is the update of an existing branch with updates that haven't met release age, which as you mentioned have potential to propagate attacks via CI pipelines incase those are configured to run when branch is pushed. We can discuss on how this can be tackled. |
Beta Was this translation helpful? Give feedback.
-
|
Actually, if we add an if-check here which prevents the branch from being updated incase |
Beta Was this translation helpful? Give feedback.
-
|
(still catching up on a few of the threads) I agree with Rahul, I see this as a bug in behaviour - Renovate should not be updating a branch that has been created because |
Beta Was this translation helpful? Give feedback.
-
|
Oh wait that's interesting, you caught on something I didn't notice. Indeed the TL;DR of the long explanation below
1st run: I requested a PR creation for Relevant logs: So what's interesting here is that Renovate was already aware of the contentful update but it did not include it in the PR; There is no line in the log about it but I understand that it's due to In then merged the PR in GitHub which triggered a second run 2nd run: PR was merged, no new PR is created Usually, this run right after a merge deletes orphan branches. I would have two open questions for that part:
3rd run: it's saturday we're in schedule So that gets me to the same conclusion as you; Renovate saw that the branch already existed and decided to create the PR even though it noticed that the "Update has not passed minimum release age" and ignored that information. Open question: Did renovate ignore Recap
And a lesson for myself: I should enable GitHub's automatic branch deletion after a merge on my projects :) |
Beta Was this translation helpful? Give feedback.
-
|
@onigoetz thanks very much for this! While investigating, would you mind sharing the links to the repo runs on https://developer.mend.io/github/onigoetz/onigoetz.github.io that these logs are from? We can do some additional debugging on the Mend side with access to the full debug logs (as you have - nothing extra we'll be debugging with) |
Beta Was this translation helpful? Give feedback.
-
|
@jamietanna my pleasure :) And the direct links are:
|
Beta Was this translation helpful? Give feedback.
-
|
I've prepared an example repository testing out this behaviour, using a Custom Datasource for more predictable testing. You can see copies of the full debug logs for each scenario being tested, and steps on how to run it in there. So far I've only tested with |
Beta Was this translation helpful? Give feedback.
-
|
Thanks very much @onigoetz for that digging + the detailed info. To expand on what you've said:
{
"currentValue": "11.7.19",
"currentVersion": "11.7.19",
"currentVersionAgeInDays": 10,
"currentVersionTimestamp": "2025-09-16T00:11:49.177Z",
"datasource": "npm",
"depName": "contentful",
"depType": "dependencies",
"fixedVersion": "11.7.19",
"homepage": "https://www.contentful.com/developers/documentation/content-delivery-api/",
"isSingleVersion": true,
"lockedVersion": "11.7.19",
"mostRecentTimestamp": "2025-09-26T17:27:32.574Z",
"packageName": "contentful",
"prettyDepType": "dependency",
"registryUrl": "https://registry.npmjs.org",
"sourceUrl": "https://github.com/contentful/contentful.js",
"versioning": "npm",
"warnings": [],
"updates": [
{
"bucket": "non-major",
"newVersion": "11.8.1",
"newValue": "11.8.1",
"releaseTimestamp": "2025-09-26T17:27:32.574Z",
"newVersionAgeInDays": 0,
"newMajor": 11,
"newMinor": 8,
"newPatch": 1,
"updateType": "minor",
"isBreaking": false,
"pendingChecks": true,
"libYears": 0.029367814466007103,
"branchName": "renovate/all-minor-patch"
}
]
},
{
"depType": "dependencies",
"depName": "contentful",
"currentValue": "11.7.19",
"datasource": "npm",
"prettyDepType": "dependency",
"lockedVersion": "11.7.19",
"updates": [
{
"bucket": "non-major",
"newVersion": "11.8.1",
"newValue": "11.8.1",
"releaseTimestamp": "2025-09-26T17:27:32.574Z",
"newVersionAgeInDays": 0,
"newMajor": 11,
"newMinor": 8,
"newPatch": 1,
"updateType": "minor",
"isBreaking": false,
"pendingChecks": true,
"libYears": 0.029367814466007103,
"branchName": "renovate/all-minor-patch"
}
],
"updates": [
{
"bucket": "non-major",
"newVersion": "11.8.1",
"newValue": "11.8.1",
"releaseTimestamp": "2025-09-26T17:27:32.574Z",
"newVersionAgeInDays": 0,
"newMajor": 11,
"newMinor": 8,
"newPatch": 1,
"updateType": "minor",
"isBreaking": false,
"pendingChecks": true,
"libYears": 0.029367814466007103,
"branchName": "renovate/all-minor-patch"
}
Aside: the
|
Beta Was this translation helpful? Give feedback.
-
|
My next steps are, given:
|
Beta Was this translation helpful? Give feedback.
-
|
renovate/lib/workers/repository/update/branch/index.ts Lines 429 to 444 in 616dc31 That'd evaluate as: if (
!false &&
!true &&
'yellow' === 'yellow' &&
['not-pending', 'status-success'].includes(config.prCreation!) // I don't see this overridden, so should be the default of https://docs.renovatebot.com/configuration-options/#prcreation which would be `immediate`
) {(aka this conditional would not be triggered) |
Beta Was this translation helpful? Give feedback.
-
|
In the meantime of a "long term fix", I've raised #38566 to make sure that we inform repo owners that they could be susceptible to a bug / race condition here |
Beta Was this translation helpful? Give feedback.
-
|
This should be fixed by #38720 - I'll be reviewing it today |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
How are you running Renovate?
A Mend.io-hosted app
If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.
No response
Please tell us more about your question or problem
My project's configuration includes
minimumReleaseAge:https://github.com/onigoetz/renovate-preset/blob/main/base.json#L15-L20
(some other settings that interact with
minimumReleaseAgesuch asinternalChecksFilterorprCreationwere at their default value at the moment of the described facts2025-09-26T16:13:15Zcontentfulversion 11.8.0 released2025-09-26T17:27:32Zcontentfulversion 11.8.1 released2025-09-26T21:27:25ZI checked "Update all non-major dependencies (next,node,yarn)" on the Dependency Dashboard onigoetz/onigoetz.github.io#892025-09-26T21:28:35ZRenovate opened a PR Update all non-major dependencies onigoetz/onigoetz.github.io#3332025-09-26T21:33:41ZI merged the PR2025-09-27T02:22:03ZRenovate opened a PR for contentful 1.8.1: Update all non-major dependencies onigoetz/onigoetz.github.io#334internalChecksFilter=strictis the default but it still created the PRnpmMinimalAgeGate: 4320which strictly prevents installing packages younger than three days2025-10-01T00:09:10.105Zcontentful Released version 11.8.2Why is this a problem?
minimumReleaseAgeto three days, I really expect no PR nor branch to be created under three days.minimumReleaseAgeto do just thatnpmMinimalAgeGatefeaturepackage.jsonyarn installbut fails as Yarn finds no installable candidateWhat I expect
I expect that the
minimumReleaseAgesetting strictly enforces to forbid packages under the specified age to be added to the repository.I opened a PR that introduces a new
allowedMinimumReleaseAgewhich would strictly applyminimumReleaseAgethe same wayallowedVersionsdoes: #38267Additional insights
As you can see in the log below, Renovate finds the update candidate, then proceeds to create the PR as it is within schedule. I think
minimulReleaseAgeis it possible that it doesn't interact well with groups ?Small bug report
The "lock file error" in the log has a clear message on what's wrong with Yarn, but the artifact update error message on the PR does not show that message. I can open a separate discussion just for that aspect
Logs (if relevant)
Logs
Full Log: https://gist.github.com/onigoetz/752b0cb3f4963abf815eaa7a856b09d0
Beta Was this translation helpful? Give feedback.
All reactions