Ambiguous behaviour of respectLatest for maven dependencies

[acote-coveo]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.101.1

Please tell us more about your question or problem

Expected behaviour

According to the documentation, respectLatest should be set to false for maven dependencies:

https://docs.renovatebot.com/configuration-options/#respectlatest

We have run into a situation where the <latest> tag in our maven registry was outdated. We were expecting renovate to ignore this tag and pickup latest releases.

Actual behaviour

We saw in the logs that respectLatest appeared to be false:

DEBUG: Setting respectLatest=false for 

That said:

• Renovate was not seeing any updates for the particular dependency.
• Passing the CLI option --respect-latest=false allowed us to see the updates.
• Fixing the maven-metadata.xml file allowed us to see the updates.

We've also run renovate locally with a debugger and were able to confirm that:

1. respectLatest was set to false for the release result

renovate/lib/modules/datasource/maven/index.ts

Lines 144 to 150 in 4cc9819

	if (metadata.tags) {
	result.tags = metadata.tags;
	if (result.tags.latest) {
	logger.debug(`Setting respectLatest=false for maven ${packageName}`);
	result.respectLatest = false;
	}
	}

2. Later on, the respectLatest would be read in the filter.ts file:

renovate/lib/workers/repository/process/lookup/filter.ts

Lines 174 to 182 in 4cc9819

	if (
	respectLatest &&
	latestVersion &&
	!versioningApi.isGreaterThan(currentVersion, latestVersion)
	) {
	filteredReleases = filteredReleases.filter(
	(r) => !versioningApi.isGreaterThan(r.version, latestVersion),
	);
	}

Warning

At this point, the value is set to true (the default for this config property) even tho it was set to false earlier.

Investigation

If we do a git-blame on the maven datasource module, we can see that this respectLatest = false behaviour was introduced here in this commit: c0bdd1c

The two main changes:

On this last screenshot, we can see that the respectLatest property is getting copied into res but it doesn't look like res.respectLatest is considered in the filtering method causing respectLatest=true.

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks