Why renovate still try to update dependencies in subofolders?

[gremo]

With the following configuration, Renovate still open PRs to "Pin dependencies"... what I'm doing wrong?

{
  "extends": [
    "config:base",
    ":disablePeerDependencies"
  ],
  "packageRules": [
    {
      "matchPaths": ["+(package.json)"],
      "depTypeList": [
        "devDependencies"
      ],
      "rangeStrategy": "bump"
    }
  ],
  "semanticCommits": "disabled"
}

Test repository: https://github.com/gremo/test-renovate

[viceice]

because you did not disabled it. you only changed rangeStrategy for the root package.json

[gremo]

Thank you @rarkins for your time and patience, I'll follow your suggestion. Right now I've read the documentation again, and there are some aspects hard to understand (like :skipStatusChecks, I was not aware).

Anyways I ended up with this: https://github.com/gremo/test-renovate/blob/master/renovate.json which "partially works", but probably I'll open an issue about that. All these dependencies where "outdated", but for some reason Renovate opened and automatically merged only updates for classnames and eslint.

Starting package.json:

{
  "name": "test-renovate",
  "private": true,
  "version": "1.0.0",
  "license": "ISC",
  "dependencies": {
    "classnames": "2.3.0",
    "react": "17.0.1",
    "react-dom": "17.0.1"
  },
  "devDependencies": {
    "eslint": "^7.22.0",
    "stylelint": "^13.11.0"
  }
}

renovate.json:

{
  "extends": [
    "config:base",
    ":disablePeerDependencies",
    ":semanticCommitsDisabled",
    ":skipStatusChecks"
  ],
  "packageRules": [
    {
      "matchDepTypes": ["dependencies"],
      "matchUpdateTypes": [
        "minor",
        "patch",
        "pin",
        "digest"
      ],
      "rangeStrategy": "pin",
      "automerge": true
    },
    {
      "matchDepTypes": ["devDependencies"],
      "rangeStrategy": "bump",
      "automerge": true
    }
  ]
}

After (note that react react-dom and stylelint where not updated):

{
  "name": "test-renovate",
  "private": true,
  "version": "1.0.0",
  "license": "ISC",
  "dependencies": {
    "classnames": "2.3.1",
    "react": "17.0.1",
    "react-dom": "17.0.1"
  },
  "devDependencies": {
    "eslint": "^7.23.0",
    "stylelint": "^13.11.0"
  }
}

[viceice]

{
      "matchDepTypes": ["devDependencies"],
      "rangeStrategy": "bump",
      "automerge": true
    }

This will only bump if the current range doen't match the new version. try replace strategy.

[viceice]

WARNING You should not skip status checks with automerge, it can break your main branch if there is something wrong with the update!

[gremo]

@viceice thanks, it turns out that Renovate actually updated all dependencies as expected, but react react-dom and stylelint where updated 3 hours later than classnames and eslint. Don't know why.

[gremo]

WARNING You should not skip status checks with automerge, it can break your main branch if there is something wrong with the update!

I know :) it's a testing repository. When I use Renovate in production, I always have some kind of testing.

[gremo]

Still struggling into this. can't make it work. I would say "disable renovate globally and then enable only for the root package.json). I guess I still can't understand how renovate evaluate the configuration... thanks

{
  "extends": [
    "config:base",
    ":automergeMinor",
    ":automergePatch",
    ":pinDevDependencies",
    ":semanticCommitsDisabled",
    ":skipStatusChecks",
    "::disableRenovate"
  ],
  "packageRules": [
    {
      "matchFiles": ["package.json"],
      "enabled": true
    },
    {
      "matchDepTypes": ["dependencies"],
      "rangeStrategy": "bump"
    }
  ]
}

[viceice]

You have a typo ::disableRenovate in your preset.
also i think using :disableRenovate preset will completly disable renovate.

[rarkins]

{
  "extends": [
    "config:base",
    ":automergeMinor",
    ":automergePatch",
    ":pinDevDependencies",
    ":semanticCommitsDisabled",
    ":skipStatusChecks"
  ],
  "enabledManagers": ["npm"],
  "packageRules": [
    {
      "matchPackagePatterns": ["*"],
      "enabled": false
    },
    {
      "matchFiles": ["package.json"],
      "enabled": true
    },
    {
      "matchDepTypes": ["dependencies"],
      "rangeStrategy": "bump"
    }
  ]
}

[rarkins]

If in doubt, always use packageRules

[gremo]

You have a typo ::disableRenovate in your preset.
also i think using :disableRenovate preset will completly disable renovate.

Oh you right, I'm going to test it without the typo 👍

EDIT: it doesn't work

[gremo]

{
  "extends": [
    "config:base",
    ":automergeMinor",
    ":automergePatch",
    ":pinDevDependencies",
    ":semanticCommitsDisabled",
    ":skipStatusChecks"
  ],
  "enabledManagers": ["npm"],
  "packageRules": [
    {
      "matchPackagePatterns": ["*"],
      "enabled": false
    },
    {
      "matchFiles": ["package.json"],
      "enabled": true
    },
    {
      "matchDepTypes": ["dependencies"],
      "rangeStrategy": "bump"
    }
  ]
}

Thanks, going to test it. So verbose!

EDIT: works OK thanks, I changed the fist package rule to matchPaths (seems more appropriate)