packageRule being made redundant by transitive dependency

[niweico]

How are you running Renovate?

Self-hosted Renovate

Which platform you running Renovate on?

GitLab (.com or self-hosted)

Which version of Renovate are you using?

38.142.7

Please tell us more about your question or problem

Hi,
we are using renovate for our spring-boot-repositories, currently i have prevented a certain dependency (spring boot) from being updated to a new major version by using "matchPackageNames" to match any package-names containing "/^org.spring/" and disabling any updates of level "major", as this new major release (X.0.0) would break some of our applications. however, this version is pulled in anyway transitively by another dependency, whose package is not related to spring and thus not picked up by my packageRule, rendering the whole rule moot.
Question:
Does renovate-bot offer ways to prevent certain dependencies from being pulled in transitively across different dependencies?
I am aware as per the official docu that renovate-bot does not manage them, yet i was hoping there is some sort of control at least.

[RahulGautamSingh]

You mean the excluded dep is getting updated during lockfile update of another dep?

[niweico]

I mean that dependency A version X.0.0, which is specifically excluded via packageRule from being updated to this higher version, is included in the merge request anyway due to being needed at Version X.0.0 by dependency XYZ, effectively breaking the rule "no dependency A version X.0.0".

[RahulGautamSingh]

Okay.

Could you please retyr the latest version and if the issue still persists create a minimal reproduction for the same

[github-actions[bot]]

Hi there,

You're reporting a problem with an old version of Renovate. Please try the latest version and tell us if that fixes your problem.

Be sure to provide updated logs once you have run with a newer version.

Good luck,

The Renovate team

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the reproduction in your own repository. Ensure it's actually minimal (no unnecesary dependencies or config), or it will be rejected by maintainers.
5. Install the Renovate app to verify that what you say happens (or doesn't happen) reproduces.
6. Fill out the information in your repository's README.md. What you describe there should reflect what you see in this repo, with the hosted app, and not what you saw in your original repo/environment.
7. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.
8. Add a Discussion comment mentioning that the reproduction repo is now available and linked.

If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[niweico]

Upgrading to the latest version appears to have fixed the issue