renovatebot / renovate

Home of the Renovate CLI: Cross-platform Dependency Automation by Mend.io
https://mend.io/renovate
GNU Affero General Public License v3.0
17.73k stars 2.35k forks source link

fix(datasource/maven): make cache key extractedVersion specific #32658

Closed Shegox closed 4 days ago

Shegox commented 4 days ago

Changes

I think I found a small regression with https://github.com/renovatebot/renovate/pull/32540 with one of our internal package from an internal maven registry. It seem that if you use both the full version and extracted version of a dependency (e.g. 1.2.3-internal-5 & 1.2.3) there is a high chance (not on every run) that Renovate will use the same value for both updates (50/50 chance if it is the extracted one or the full one). My gut feeling is this is some caching & race-condition.

After making the cache key dependent on both version and versionOrig in https://github.com/renovatebot/renovate/pull/32540/files#diff-e51e63b36811d835c0f1a07638208603e43d5b223bf45b073b56cc8de7dccf10R257 I could no longer reproduce it with our internal repository

I wasn’t able to reproduce it yet with a public package (which is weird again), but will then make sure to open a discussion/issue. (This is my current testing PR, which for whatever reason behaves correctly: https://github.com/Shegox/spring-boot-pom/pull/2).

Context

This PR adds as an additional cache key the (extracted) version. While this will create a few more cache entries (and cache misses) it will ensure that we include both version and versionOrig (if available) in the cache key to ensure no mixup.

Documentation (please check one with an [x])

How I've tested my work (please select one)

I have verified these changes via:

renovate-release commented 4 days ago

:tada: This PR is included in version 39.25.3 :tada:

The release is available on:

Your semantic-release bot :package::rocket: