Sync release/v5 with main - #263
Merged
Merged
Conversation
The dependency dashboard reports "Error executing gradle wrapper update command" under Repository Problems, and the "all non-major dependencies" rule has no matchManagers, so it swept gradle-wrapper into the same branch as everything else. Updating the wrapper makes Renovate run ./gradlew inside its container, that fails here, and one failing member errors the whole batch. The effect is visible in the PR history: the last successful all-minor-patch PR was #242 on 2025-11-03, nine months ago, while individual major updates on their own branches kept working fine. So lombok, gson, lettuce, HikariCP, snakeyaml, slf4j, commons-text, httpclient5, amqp-client and the rest have all been frozen without anything looking obviously broken. gradle-wrapper now gets its own branch, so its failure is contained and the rest of the batch can land. automerge is off for it since it is currently failing and should be looked at rather than merged blind. Note this only takes effect once it reaches main: Renovate reads its config from the default branch, and this repo works on release/v5 with main updated periodically. Co-Authored-By: Claude Code <[email protected]> (cherry picked from commit 6e60a6e)
Renovate reads its config from the DEFAULT branch. This repo works on release/v5 while main is the default, so every renovate.json change made today landed somewhere Renovate never looks. That means none of it was live here: the rules pinning the version ladder, the switch to matchDepTypes for Gradle plugins, and grouping the wrapper with the plugins. It explains why this repo kept producing the pre-fix PR shape while the sibling picked the changes up immediately. Same trap as the gradle-wrapper fix nine months ago, which also had to be cherry-picked to main for the same reason.
main is the continuous timeline and release/v5 is the working line for this release, so main should absorb it rather than receive individual files. The two commits main had that release/v5 did not were both single-file cherry-picks of renovate.json, made because Renovate reads its config from the default branch. Each one bought a working Renovate config at the cost of drift, which is the thing that made this merge necessary. A real merge fixes both: the config is current AND the branches reconcile.
Renovate opened a pull request for slf4j-nop 2.0.19 twenty three minutes after the artifact appeared on Maven Central, against a configuration that auto-merges minor and patch updates. Only a repository setting stood between a one hour old dependency and a published release, and consumers shade this library, so a bad version would reach all of them before anyone read the diff. Seven days is long enough for a compromised release to be reported and yanked, and short enough that ordinary updates still land promptly. The github-actions rule sets its own zero day age and is unaffected. That exemption is deliberate and is left for a separate decision. Co-Authored-By: Claude Code <[email protected]>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs
release/v5withmain.The whole content difference is one line in
renovate.json:The 42 commits behind this are 39 merges plus three
renovate.jsoncommits, two of which(
219e0a0c,1de71938) already have their content onrelease/v5. One of them isBring the Renovate config on main up to date with release/v5, so that reconciliation already ranin the other direction. Nothing else has drifted.
Why the line matters
Renovate opened a pull request for
slf4j-nop2.0.19 twenty three minutes after the artifactappeared on Maven Central, against a configuration that auto-merges minor and patch updates.
Consumers shade this library, so a bad version would reach all of them before anyone read the diff.
Worth knowing before merging
Renovate reads its configuration from the repository's default branch, which is
main, and thisrepository does not set
baseBranches. The rule is already in force. This branch does not needthe line for Renovate to honour it; merging only keeps
release/v5from reading as though itdisagrees.
A cherry-pick of
479a31a7is the alternative, and it leavesrelease/v5with one commit insteadof 39 merges.