Purposefully downgrading dependencies

[dblane-digicatapult]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

Due to a dependency upgrade causing unforeseen silent errors, I have been forced to try and downgrade this dependency across all my repos.

I am not certain this is a bug but I have been unable to find any information about downgrades being supported or not.

We are using npm manager, the dependency is typescript. I have tried downgrading using the following config snippet as a package rule.

{
	"description": "Downgrade TypeScript to version 5.5.4",
	"matchPackageNames": [
		"typescript"
	],
	"allowedVersions": "5.5.4",
	"rangeStrategy": "pin"
}

Other pertinent parts of our config as as follows.

"extends": [
	"config:recommended",
	":rebaseStalePrs",
	":timezone(Europe/London)"
],
"enabledManagers": [
	"npm",
	"dockerfile",
	"docker-compose",
	"github-actions",
	"cargo"
],
"npm": {
	"labels": [
		"dependencies",
		"npm"
	],
	"extends": [
		"npm:unpublishSafe",
		"helpers:disableTypesNodeMajor"
	],
	"rangeStrategy": "bump",
	"bumpVersion": "patch",
	"automergeType": "pr",
	"updateLockFiles": true,
	"major": {
		"automerge": false
	},
        packageRules: [...

Expected behaviour

Renovate creates a PR downgrading the dependency to the version specified e.g. "typescript": "5.5.4"

Actual Behaviour

Renovate changes the version in package.json from "typescript": "~5.6.2" to "typescript": "5.6.2"

Logs (if relevant)

Logs

          {
            "currentValue": "~5.6.2",
            "currentVersion": "5.6.2",
            "currentVersionTimestamp": "2024-09-09T16:16:40.226Z",
            "datasource": "npm",
            "depName": "typescript",
            "depType": "devDependencies",
            "fixedVersion": "5.6.2",
            "homepage": "https://www.typescriptlang.org/",
            "lockedVersion": "5.6.2",
            "packageName": "typescript",
            "prettyDepType": "devDependency",
            "registryUrl": "https://registry.npmjs.org",
            "sourceUrl": "https://github.com/microsoft/TypeScript",
            "versioning": "npm",
            "warnings": [],
            "updates": [
              {
                "updateType": "pin",
                "isPin": true,
                "newValue": "5.6.2",
                "newVersion": "5.6.2",
                "newMajor": 5,
                "branchName": "renovate/pin-dependencies"
              }

[github-actions[bot]]

Hi there,

A maintainer decided this is not a bug, and behaving as designed. The maintainer will explain why this behavior is correct. To avoid confusing future readers, we will close this Discussion.

We want Bug-type Discussions to be about things that we rate as bugs. For more details, please read our development docs about bug handling.

If this bug report makes you think of an idea for a new feature, or how to improve a current feature, feel free to create a new Suggest an Idea Discussion.

Thanks, the Renovate team

[rarkins]

Downgrades are not supported in this manner, so this behavior is as expected

[dblane-digicatapult]

Thank you for the swift reply. Is this something that is likely to be accepted as a feature request or is there additional rationale behind why it would not be?

[rarkins]

You can "Suggest an idea" (which unlike "I think I found a bug" can remain open indefinitely), but:

• allowedVersions is not the way
• something like this which can complicate the lookup process is unlikely to be accepted unless it turns out to be widely applicable to more users

[dennisameling]

We're running into a similar issue now where the Terraform AWS provider had to remove their most recent version 5.71.0, while Renovate had already updated it across many of our repos. This is now causing errors like this:

│ Error: Failed to query available provider packages
│
│ Could not retrieve the list of available versions for provider hashicorp/aws: the previously-selected version 5.71.0 is no longer available

We now have to manually downgrade to 5.70.0 in many places. @dblane-digicatapult did you end up creating a feature request anywhere? Otherwise we may create one.

allowedVersions is not the way

Makes sense. Maybe something like pinnedVersion or forcedVersion would make sense for this use case.

[dblane-digicatapult]

Kind of...
We forked the dependency, fixed it ourselves then did a replacement dependency and version.

We then found a replacement for the dep and instituted that manually.

Unfortunately no solution for downgrading unless the maintainer pulls it.