Loop update of dependency in a pull request #33930

tmortagne · 2025-01-30T07:15:01Z

tmortagne
Jan 30, 2025

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

The history of xwiki/xwiki-platform#3194 suggests Renovate keeps updating it with the same version several times a day. It apparently started 2 days ago.

Logs (if relevant)

Logs

DEBUG: http cache: saving https://api.github.com/repos/xwiki/xwiki-platform/dependabot/alerts?state=open&direction=asc&per_page=100 (etag=W/"e92b740e6388628b672fa06fddc0100081f22c6c595c29e6d1090fadef70e5a9", lastModified=Mon, 27 Jan 2025 17:23:52 GMT)
DEBUG: GitHub vulnerability details
{
  "alerts": {
    "maven/org.apache.solr:solr-core": {
      ">= 6.6, < 9.8.0": "9.8.0",
      "< 9.8.0": "9.8.0"
    }
  }
}

DEBUG: alert package rules
{
  "alertPackageRules": [
    {
      "matchDatasources": [
        "maven"
      ],
      "matchPackageNames": [
        "org.apache.solr:solr-core"
      ],
      "matchFileNames": [
        "pom.xml"
      ],
      "matchCurrentVersion": "(,9.8.0)",
      "vulnerabilityFixVersion": "9.8.0",
      "prBodyNotes": [
        "### GitHub Vulnerability Alerts",
        "#### [CVE-2024-52012](https://nvd.nist.gov/vuln/detail/CVE-2024-52012)\n\nRelative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.",
        "#### [CVE-2025-24814](https://nvd.nist.gov/vuln/detail/CVE-2025-24814)\n\nCore creation allows users to replace \"trusted\" configset files with arbitrary configuration\n\nSolr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual \"trusted\" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.  These replacement config files are treated as \"trusted\" and can use \"<lib>\" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.\n\nThis issue affects all Apache Solr versions up through Solr 9.7.  Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from \"FileSystemConfigSetService\").  Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"<lib>\" tags by default."
      ],
      "isVulnerabilityAlert": true,
      "force": {
        "groupName": null,
        "schedule": [],
        "dependencyDashboardApproval": false,
        "minimumReleaseAge": null,
        "rangeStrategy": "update-lockfile",
        "commitMessageSuffix": "[SECURITY]",
        "branchTopic": "{{{datasource}}}-{{{depNameSanitized}}}-vulnerability",
        "prCreation": "immediate",
        "vulnerabilityFixStrategy": "lowest"
      }
    }
  ]
}

DEBUG: No baseBranches
DEBUG: extract()
DEBUG: Cached extract result cannot be used due to base branch SHA change (old=0043480db59a0ae3c6230bae158fa919874ed855, new=84e1efe46489615d5fdb49f6db4737f304a826b5)
DEBUG: Setting current branch to master
DEBUG: Initializing git repository into /tmp/renovate/repos/github/xwiki/xwiki-platform
DEBUG: Performing blobless clone
DEBUG: git clone completed
{
  "durationMs": 16050
}

......

          {
            "datasource": "maven",
            "depName": "org.apache.solr:solr-solrj",
            "currentValue": "9.4.1",
            "fileReplacePosition": 3522,
            "registryUrls": [
              "https://repo.maven.apache.org/maven2"
            ],
            "depType": "compile",
            "sharedVariableName": "solr.version",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "9.8.0",
                "newValue": "9.8.0",
                "releaseTimestamp": "2025-01-21T19:20:22.000Z",
                "newVersionAgeInDays": 8,
                "registryUrl": "https://repo1.maven.org/maven2",
                "newMajor": 9,
                "newMinor": 8,
                "newPatch": 0,
                "updateType": "minor",
                "branchName": "renovate/solr.version"
              }
            ],
            "packageName": "org.apache.solr:solr-solrj",
            "versioning": "maven",
            "warnings": [],
            "sourceUrl": "https://gitbox.apache.org/repos/asf?p=solr.git",
            "homepage": "https://solr.apache.org/",
            "packageScope": "org.apache.solr",
            "currentVersion": "9.4.1",
            "isSingleVersion": true,
            "fixedVersion": "9.4.1"
          },
          {
            "datasource": "maven",
            "depName": "org.apache.solr:solr-core",
            "currentValue": "9.4.1",
            "fileReplacePosition": 3522,
            "registryUrls": [
              "https://repo.maven.apache.org/maven2"
            ],
            "depType": "compile",
            "sharedVariableName": "solr.version",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "9.8.0",
                "newValue": "9.8.0",
                "releaseTimestamp": "2025-01-21T19:12:16.000Z",
                "newVersionAgeInDays": 8,
                "registryUrl": "https://repo1.maven.org/maven2",
                "newMajor": 9,
                "newMinor": 8,
                "newPatch": 0,
                "updateType": "minor",
                "branchName": "renovate/solr.version"
              }
            ],
            "packageName": "org.apache.solr:solr-core",
            "versioning": "maven",
            "warnings": [],
            "sourceUrl": "https://gitbox.apache.org/repos/asf?p=solr.git",
            "homepage": "https://solr.apache.org/",
            "packageScope": "org.apache.solr",
            "currentVersion": "9.4.1",
            "vulnerabilityFixVersion": "9.8.0",
            "vulnerabilityFixStrategy": "lowest",
            "isSingleVersion": true,
            "fixedVersion": "9.4.1"
          },
          {
            "datasource": "maven",
            "depName": "org.apache.solr:solr-analysis-extras",
            "currentValue": "9.4.1",
            "fileReplacePosition": 3522,
            "registryUrls": [
              "https://repo.maven.apache.org/maven2"
            ],
            "depType": "compile",
            "sharedVariableName": "solr.version",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "9.8.0",
                "newValue": "9.8.0",
                "releaseTimestamp": "2025-01-21T19:18:09.000Z",
                "newVersionAgeInDays": 8,
                "registryUrl": "https://repo1.maven.org/maven2",
                "newMajor": 9,
                "newMinor": 8,
                "newPatch": 0,
                "updateType": "minor",
                "branchName": "renovate/solr.version"
              }
            ],
            "packageName": "org.apache.solr:solr-analysis-extras",
            "versioning": "maven",
            "warnings": [],
            "sourceUrl": "https://gitbox.apache.org/repos/asf?p=solr.git",
            "homepage": "https://solr.apache.org/",
            "packageScope": "org.apache.solr",
            "currentVersion": "9.4.1",
            "isSingleVersion": true,
            "fixedVersion": "9.4.1"
          },

......

{
        "datasource": "maven",
        "depName": "org.apache.solr:solr-solrj",
        "currentValue": "9.4.1",
        "fileReplacePosition": 3522,
        "registryUrls": [
          "https://repo.maven.apache.org/maven2"
        ],
        "depType": "compile",
        "sharedVariableName": "solr.version",
        "updates": [
          {
            "bucket": "non-major",
            "newVersion": "9.8.0",
            "newValue": "9.8.0",
            "releaseTimestamp": "2025-01-21T19:20:22.000Z",
            "newVersionAgeInDays": 8,
            "registryUrl": "https://repo1.maven.org/maven2",
            "newMajor": 9,
            "newMinor": 8,
            "newPatch": 0,
            "updateType": "minor",
            "branchName": "renovate/solr.version"
          }
        ],
        "packageName": "org.apache.solr:solr-solrj",
        "versioning": "maven",
        "warnings": [],
        "sourceUrl": "https://gitbox.apache.org/repos/asf?p=solr.git",
        "homepage": "https://solr.apache.org/",
        "packageScope": "org.apache.solr",
        "currentVersion": "9.4.1",
        "isSingleVersion": true,
        "fixedVersion": "9.4.1"
      },
      {
        "datasource": "maven",
        "depName": "org.apache.solr:solr-core",
        "currentValue": "9.4.1",
        "fileReplacePosition": 3522,
        "registryUrls": [
          "https://repo.maven.apache.org/maven2"
        ],
        "depType": "compile",
        "sharedVariableName": "solr.version",
        "updates": [
          {
            "bucket": "non-major",
            "newVersion": "9.8.0",
            "newValue": "9.8.0",
            "releaseTimestamp": "2025-01-21T19:12:16.000Z",
            "newVersionAgeInDays": 8,
            "registryUrl": "https://repo1.maven.org/maven2",
            "newMajor": 9,
            "newMinor": 8,
            "newPatch": 0,
            "updateType": "minor",
            "branchName": "renovate/solr.version"
          }
        ],
        "packageName": "org.apache.solr:solr-core",
        "versioning": "maven",
        "warnings": [],
        "sourceUrl": "https://gitbox.apache.org/repos/asf?p=solr.git",
        "homepage": "https://solr.apache.org/",
        "packageScope": "org.apache.solr",
        "currentVersion": "9.4.1",
        "vulnerabilityFixVersion": "9.8.0",
        "vulnerabilityFixStrategy": "lowest",
        "isSingleVersion": true,
        "fixedVersion": "9.4.1"
      },
      {
        "datasource": "maven",
        "depName": "org.apache.solr:solr-analysis-extras",
        "currentValue": "9.4.1",
        "fileReplacePosition": 3522,
        "registryUrls": [
          "https://repo.maven.apache.org/maven2"
        ],
        "depType": "compile",
        "sharedVariableName": "solr.version",
        "updates": [
          {
            "bucket": "non-major",
            "newVersion": "9.8.0",
            "newValue": "9.8.0",
            "releaseTimestamp": "2025-01-21T19:18:09.000Z",
            "newVersionAgeInDays": 8,
            "registryUrl": "https://repo1.maven.org/maven2",
            "newMajor": 9,
            "newMinor": 8,
            "newPatch": 0,
            "updateType": "minor",
            "branchName": "renovate/solr.version"
          }
        ],
        "packageName": "org.apache.solr:solr-analysis-extras",
        "versioning": "maven",
        "warnings": [],
        "sourceUrl": "https://gitbox.apache.org/repos/asf?p=solr.git",
        "homepage": "https://solr.apache.org/",
        "packageScope": "org.apache.solr",
        "currentVersion": "9.4.1",
        "isSingleVersion": true,
        "fixedVersion": "9.4.1"
      },

......

DEBUG: syncBranchState() (branch="renovate/solr.version")
DEBUG: syncBranchState(): update baseBranchSha (branch="renovate/solr.version")
DEBUG: branch.isUpToDate(): using cached result "true" (branch="renovate/solr.version")
DEBUG: getBranchPr(renovate/solr.version) (branch="renovate/solr.version")
DEBUG: findPr(renovate/solr.version, undefined, open) (branch="renovate/solr.version")
DEBUG: Found PR #3194 (branch="renovate/solr.version")
DEBUG: branchExists=true (branch="renovate/solr.version")
DEBUG: dependencyDashboardCheck=undefined (branch="renovate/solr.version")
DEBUG: PR rebase requested=false (branch="renovate/solr.version")
DEBUG: Open PR Count: 34, Existing Branch Count: 34, Hourly PR Count: 0 (branch="renovate/solr.version")
DEBUG: Checking if PR has been edited (branch="renovate/solr.version")
DEBUG: branch.isModified(): using cached result "false" (branch="renovate/solr.version")
DEBUG: Found existing branch PR (branch="renovate/solr.version")
DEBUG: Checking schedule(schedule=at any time, tz=null, now=2025-01-30T06:56:24.446Z) (branch="renovate/solr.version")
DEBUG: No schedule defined (branch="renovate/solr.version")
DEBUG: Converting rebaseWhen=auto to rebaseWhen=conflicted because no rule for behind-base-branch applies (branch="renovate/solr.version")
DEBUG: Branch already exists (branch="renovate/solr.version")
DEBUG: Skipping behind base branch check due to rebaseWhen=conflicted (branch="renovate/solr.version")
DEBUG: isBranchConflicted(master, renovate/solr.version) (branch="renovate/solr.version")
DEBUG: branch.isConflicted(): using git to calculate (branch="renovate/solr.version")
DEBUG: branch.isConflicted(): false (branch="renovate/solr.version")
DEBUG: Branch does not need rebasing (branch="renovate/solr.version")
DEBUG: Detected multiple rangeStrategies along with update-lockfile (branch="renovate/solr.version")
DEBUG: Using reuseExistingBranch: false (branch="renovate/solr.version")
DEBUG: Setting current branch to master (branch="renovate/solr.version")
DEBUG: latest commit (branch="renovate/solr.version")
{
  "branchName": "master"
  "latestCommitDate": "2025-01-30T07:54:53+01:00"
}

DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (branch="renovate/solr.version")
DEBUG: Updating org.apache.solr:solr-analysis-extras in pom.xml (branch="renovate/solr.version")
DEBUG: updateArtifacts for updatedPackageFiles (branch="renovate/solr.version")
DEBUG: Updated 1 package files (branch="renovate/solr.version")
DEBUG: Getting updated lock files (branch="renovate/solr.version")
DEBUG: Writing package.json files (branch="renovate/solr.version")
{
  "packageFiles": [
    "xwiki-platform-core/xwiki-platform-bootstrap/src/main/package.json",
    "xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-webjar/src/main/config/package.json",
    "xwiki-platform-core/xwiki-platform-notifications/xwiki-platform-notifications-webjar/src/main/vue/package.json"
  ]
}

DEBUG: Writing xwiki-platform-core/xwiki-platform-bootstrap/src/main/package-lock.json (branch="renovate/solr.version")
DEBUG: Writing xwiki-platform-core/xwiki-platform-livedata/xwiki-platform-livedata-webjar/src/main/config/package-lock.json (branch="renovate/solr.version")
DEBUG: Writing xwiki-platform-core/xwiki-platform-notifications/xwiki-platform-notifications-webjar/src/main/vue/package-lock.json (branch="renovate/solr.version")
DEBUG: Writing any updated package files (branch="renovate/solr.version")
DEBUG: Found 0 npm host rule(s) (branch="renovate/solr.version")
DEBUG: No updated lock files in branch (branch="renovate/solr.version")
DEBUG: 1 file(s) to commit (branch="renovate/solr.version")
DEBUG: Preparing files for committing to branch renovate/solr.version (branch="renovate/solr.version")
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (branch="renovate/solr.version")
DEBUG: Using containerbase dynamic installs (branch="renovate/solr.version")
DEBUG: Executing command (branch="renovate/solr.version")
{
  "command": "gpg --batch --no-tty --import /tmp/git-private-gpg.key"
}

DEBUG: exec completed (branch="renovate/solr.version")
{
  "durationMs": 31
  "stdout": ""
  "stderr": "gpg: directory '/home/ubuntu/.gnupg' created\ngpg: keybox '/home/ubuntu/.gnupg/pubring.kbx' created\ngpg: /home/ubuntu/.gnupg/trustdb.gpg: trustdb created\ngpg: key A1020E7F5FFD673D: public key \"Renovate Bot <[email protected]>\" imported\ngpg: key A1020E7F5FFD673D: secret key imported\ngpg: Total number processed: 1\ngpg:               imported: 1\ngpg:       secret keys read: 1\ngpg:   secret keys imported: 1\n"
}

DEBUG: Private key import result (branch="renovate/solr.version")
{
  "stdout": ""
  "stderr": "gpg: directory '/home/ubuntu/.gnupg' created\ngpg: keybox '/home/ubuntu/.gnupg/pubring.kbx' created\ngpg: /home/ubuntu/.gnupg/trustdb.gpg: trustdb created\ngpg: key A1020E7F5FFD673D: public key \"Renovate Bot <[email protected]>\" imported\ngpg: key A1020E7F5FFD673D: secret key imported\ngpg: Total number processed: 1\ngpg:               imported: 1\ngpg:       secret keys read: 1\ngpg:   secret keys imported: 1\n"
}

DEBUG: gitPrivateKey: imported (branch="renovate/solr.version")
DEBUG: gitPrivateKey: configuring commit signing (branch="renovate/solr.version")
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (branch="renovate/solr.version")
DEBUG: Using containerbase dynamic installs (branch="renovate/solr.version")
DEBUG: Executing command (branch="renovate/solr.version")
{
  "command": "git config user.signingkey A1020E7F5FFD673D"
}

DEBUG: exec completed (branch="renovate/solr.version")
{
  "durationMs": 6
  "stdout": ""
  "stderr": ""
}

DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (branch="renovate/solr.version")
DEBUG: Using containerbase dynamic installs (branch="renovate/solr.version")
DEBUG: Executing command (branch="renovate/solr.version")
{
  "command": "git config commit.gpgsign true"
}

DEBUG: exec completed (branch="renovate/solr.version")
{
  "durationMs": 5
  "stdout": ""
  "stderr": ""
}

DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (branch="renovate/solr.version")
DEBUG: Using containerbase dynamic installs (branch="renovate/solr.version")
DEBUG: Executing command (branch="renovate/solr.version")
{
  "command": "git config gpg.format openpgp"
}

DEBUG: exec completed (branch="renovate/solr.version")
{
  "durationMs": 4
  "stdout": ""
  "stderr": ""
}

DEBUG: git commit (branch="renovate/solr.version")
{
  "deletedFiles": []
  "ignoredFiles": []
  "result": {
    "author": null,
    "branch": "renovate/solr.version",
    "commit": "dac9e1f4db7b99acc6187cee2f45425c8f2f1120",
    "root": false,
    "summary": {
      "changes": 1,
      "insertions": 1,
      "deletions": 1
    }
  }
}

DEBUG: Pushing refSpec renovate/solr.version:renovate/solr.version (branch="renovate/solr.version")
DEBUG: git push (branch="renovate/solr.version")
{
  "result": {
    "pushed": [],
    "ref": {
      "local": "refs/remotes/origin/renovate/solr.version"
    },
    "remoteMessages": {
      "all": []
    }
  }
}

DEBUG: Setting current branch to master (branch="renovate/solr.version")
DEBUG: latest commit (branch="renovate/solr.version")
{
  "branchName": "master"
  "latestCommitDate": "2025-01-30T07:54:53+01:00"
}

INFO: Branch updated (branch="renovate/solr.version")
{
  "commitSha": "dac9e1f4db7b99acc6187cee2f45425c8f2f1120"
}

DEBUG: Ensuring PR (branch="renovate/solr.version")
DEBUG: There are 0 errors and 0 warnings (branch="renovate/solr.version")
DEBUG: getBranchPr(renovate/solr.version) (branch="renovate/solr.version")
DEBUG: findPr(renovate/solr.version, undefined, open) (branch="renovate/solr.version")
DEBUG: Found PR #3194 (branch="renovate/solr.version")
DEBUG: Found existing PR (branch="renovate/solr.version")
DEBUG: PR cache matches and no PR changes in last 24hrs, so skipping PR body check (branch="renovate/solr.version")
DEBUG: PR is not configured for automerge (branch="renovate/solr.version")
DEBUG: setBranchCommit() (branch="renovate/solr.version")

......

DEBUG: getBranchPr(renovate/solr.version)
DEBUG: findPr(renovate/solr.version, undefined, open)
DEBUG: Found PR #3194

.....

    {
      "automerge": false,
      "baseBranch": "master",
      "baseBranchSha": "84e1efe46489615d5fdb49f6db4737f304a826b5",
      "branchName": "renovate/solr.version",
      "branchSha": "dac9e1f4db7b99acc6187cee2f45425c8f2f1120",
      "isModified": false,
      "isPristine": true
    },

.....

 {
      "branchName": "renovate/solr.version",
      "prNo": 3194,
      "prTitle": "Update solr.version to v9.8.0",
      "result": "done",
      "upgrades": [
        {
          "datasource": "maven",
          "depName": "org.apache.solr:solr-analysis-extras",
          "displayPending": "",
          "fixedVersion": "9.4.1",
          "currentVersion": "9.4.1",
          "currentValue": "9.4.1",
          "newValue": "9.8.0",
          "newVersion": "9.8.0",
          "packageFile": "pom.xml",
          "updateType": "minor",
          "packageName": "org.apache.solr:solr-analysis-extras"
        },
        {
          "datasource": "maven",
          "depName": "org.apache.solr:solr-core",
          "displayPending": "",
          "fixedVersion": "9.4.1",
          "currentVersion": "9.4.1",
          "currentValue": "9.4.1",
          "newValue": "9.8.0",
          "newVersion": "9.8.0",
          "packageFile": "pom.xml",
          "updateType": "minor",
          "packageName": "org.apache.solr:solr-core"
        },
        {
          "datasource": "maven",
          "depName": "org.apache.solr:solr-solrj",
          "displayPending": "",
          "fixedVersion": "9.4.1",
          "currentVersion": "9.4.1",
          "currentValue": "9.4.1",
          "newValue": "9.8.0",
          "newVersion": "9.8.0",
          "packageFile": "pom.xml",
          "updateType": "minor",
          "packageName": "org.apache.solr:solr-solrj"
        }
      ]
    },

rarkins · 2025-02-01T07:29:20Z

rarkins
Feb 1, 2025
Maintainer

Initial analysis:

Forking Renovate
This update is related to a vulnerability rule
It's a shared variable (solr.version)
Multiple dependencies use it so are updated in this branch
The cache says the branch is up to date: DEBUG: branch.isUpToDate(): using cached result "true" (branch="renovate/solr.version")
Renovate thinks it doesn't need rebasing: DEBUG: Branch does not need rebasing (branch="renovate/solr.version")
Yet, it still does work to double check. Maybe because of this: DEBUG: Detected multiple rangeStrategies along with update-lockfile (branch="renovate/solr.version")

Checking the source code confirms this:

renovate/lib/workers/repository/update/branch/reuse.ts

Lines 84 to 90 in 1386cf7

    
           logger.debug(`Branch does not need rebasing`); 
        
           // Branches can get in an inconsistent state if "update-lockfile" is used at the same time as other strategies 
        
           // On the first execution, everything is executed, but if on a second execution the package.json modification is 
        
           // skipped but the lockfile update is executed, the lockfile will have a different result than if it was executed 
        
           // along with the changes to the package.json. Thus ending up with an incomplete branch update 
        
           // This is why we are skipping branch reuse in this case (#10050)

I wonder if we can skip this logic in this case somehow?

BTW this functionality is pretty old so I'm not sure why behavior would have changed.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Loop update of dependency in a pull request #33930

{{title}}

Replies: 1 comment

{{title}}

Select a reply

Loop update of dependency in a pull request #33930

tmortagne Jan 30, 2025

How are you running Renovate?

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Please tell us more about your question or problem

Logs (if relevant)

Replies: 1 comment

rarkins Feb 1, 2025 Maintainer

tmortagne
Jan 30, 2025

rarkins
Feb 1, 2025
Maintainer