Possible Bug / Needed Feature: minimumReleaseAge is ignored when updating an already open PR
#42643
Unanswered
smirowstanitzok
asked this question in
Request Help
Possible Bug / Needed Feature: `minimumReleaseAge` is ignored when updating an already open PR
#42643
Replies: 1 comment 4 replies
-
|
Yes, I think that's fair - I think we have seen this affect a small percentage of cases, but it's still good for us to ensure this doesn't happen Can you confirm your config for |
Beta Was this translation helpful? Give feedback.
4 replies
-
|
@RahulGautamSingh are you able to take a look after the Ant work? 👀 |
Beta Was this translation helpful? Give feedback.
-
|
Yes, exactly. It generally works. However, when updating a PR that’s currently active, Here is the relevant configuration block from our {
"packageRules": [
{
"matchDatasources": ["npm"],
"minimumReleaseAge": "3 days",
"matchPackageNames": ["^(?!@frnde/|@freenet-group/).+"]
}
]
}To give you a bit more context: |
Beta Was this translation helpful? Give feedback.
-
|
Can you share your |
Beta Was this translation helpful? Give feedback.
-
|
Yes, of cause. And sorry for the delay. Full DEBUG Log |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
How are you running Renovate?
A Mend.io-hosted app
Which platform you running Renovate on?
GitHub.com
Which version of Renovate are you using?
43.110.2
Please tell us more about your question or problem
Description
We are using
minimumReleaseAge(set to 3 days) in our configuration to comply with our security pipeline (Aikido safe-chain). This pipeline requires a package release to be at least 3 days old before it can be merged and deployed.This setting works perfectly for the creation of new Pull Requests. However, we've encountered an issue with how Renovate handles existing, open PRs:
If there is an open PR for a dependency and a newer version of that dependency is published, Renovate updates the existing PR immediately with the brand-new version.
In this specific scenario,
minimumReleaseAgeis bypassed. ThenewVersionAgeInDaysis0, the PR is updated instantly, and consequently, our safe-chain check fails.Expected Behavior
Renovate should respect the
minimumReleaseAgesetting even when updating an already open PR. It should wait until the new version meets the required age before pushing the new update to the existing branch.Actual Behavior
The open PR is updated immediately with the newest release, ignoring the configured
minimumReleaseAge.Relevant Debug Logs
Here is the extracted dataset showing
newVersionAgeInDaysis0when updatingprettierto3.8.3:JSON Dataset
{ "currentValue": "3.8.2", "currentVersion": "3.8.2", "currentVersionAgeInDays": 4, "currentVersionTimestamp": "2026-04-10T02:30:00.024Z", "datasource": "npm", "depName": "prettier", "depType": "dependencies", "fixedVersion": "3.8.2", "homepage": "[https://prettier.io](https://prettier.io)", "lockedVersion": "3.8.2", "packageName": "prettier", "prettyDepType": "dependency", "registryUrl": "[https://registry.npmjs.org](https://registry.npmjs.org)", "sourceUrl": "[https://github.com/prettier/prettier](https://github.com/prettier/prettier)", "versioning": "npm", "warnings": [], "updates": [ { "bucket": "non-major", "newVersion": "3.8.3", "newValue": "3.8.3", "hasAttestation": false, "releaseTimestamp": "2026-04-15T00:55:25.573Z", "newVersionAgeInDays": 0, "newMajor": 3, "newMinor": 8, "newPatch": 3, "updateType": "patch", "isBreaking": false, "libYears": 0.013518694476154237, "branchName": "renovate/prettier-3.x" } ], "isSingleVersion": true }Logs (if relevant)
Logs
Beta Was this translation helpful? Give feedback.
All reactions