Renovate doesn't update any composer package

[geoffrey-brier]

Hi there,

I set up renovate with a friend a few weeks ago in a self hosted environment. We've configured a pipeline to run every week in GitlabCI and the dockerfile / docker-compose managers work like a charm but for some reason I can't get the composer manager to work 🤔

As you can see when I run composer outdated, I get a lot of upgradable vendors :

foo@2220749d177e:/srv $ composer outdated
match your Composer installation ("2.0.0"). You may need to run composer update with the "--no-plugins" option.
doctrine/dbal                       2.12.1  3.0.0   Powerful PHP database abstraction layer (DBAL) with many features for database schema introspection and management.
doctrine/doctrine-migrations-bundle 3.0.1   3.0.2   Symfony DoctrineMigrationsBundle
doctrine/migrations                 3.0.1   3.0.2   PHP Doctrine Migrations project offer additional functionality on top of the database abstraction layer (DBAL) for versioning your database schema and easily deploying changes to it. It is a very easy to use and a powerful tool.
friendsofphp/php-cs-fixer           v2.17.1 v2.17.3 A tool to automatically fix PHP code style
lexik/jwt-authentication-bundle     v2.10.3 v2.10.5 This bundle provides JWT authentication for your Symfony REST API
monolog/monolog                     2.1.1   2.2.0   Sends your logs to files, sockets, inboxes, databases and various web services
nikic/php-parser                    v4.10.3 v4.10.4 A PHP parser written in PHP
php-cs-fixer/diff                   v1.3.1  v2.0.2  sebastian/diff v2 backport support for PHP5.6
phpstan/phpstan                     0.12.59 0.12.64 PHPStan - PHP Static Analysis Tool
phpstan/phpstan-doctrine            0.12.25 0.12.26 Doctrine extensions for PHPStan
phpstan/phpstan-phpunit             0.12.16 0.12.17 PHPUnit extensions and rules for PHPStan
phpstan/phpstan-symfony             0.12.11 0.12.12 Symfony Framework extensions and rules for PHPStan
sentry/sdk                          2.2.0   3.1.0   This is a metapackage shipping sentry/sentry with a recommended HTTP client.
sentry/sentry                       2.5.0   3.1.1   A PHP SDK for Sentry (http://sentry.io)
symfony/browser-kit                 v5.2.0  v5.2.1  Symfony BrowserKit Component
symfony/cache                       v5.2.0  v5.2.1  Symfony Cache component with PSR-6, PSR-16, and tags
symfony/config                      v5.2.0  v5.2.1  Symfony Config Component
symfony/console                     v5.2.0  v5.2.1  Symfony Console Component
...

But unfortunately when I run renovate nothing happens :(

Here is how i ran renovate :

node /usr/src/app/dist/renovate.js
      --platform "gitlab"
      --endpoint "${CI_API_V4_URL}"
      --git-author "${RENOVATE_GIT_AUTHOR}"
      --dry-run "${RENOVATE_DRY_RUN}"
      --log-level "${RENOVATE_LOG_LEVEL}"
      "${CI_PROJECT_PATH}"

Here is my renovate config :

{
  "extends": [
    "group:allNonMajor"
  ],
  "enabledManagers": ["composer", "docker-compose", "dockerfile"],
  "major": {
    "enabled": false
  },
  "ignoreScripts": true,
  "composerIgnorePlatformReqs": true
}

Here are the debug logs :

logs-renovate.txt

If anyone could point me out what's wrong that would be really awesome 🙏

[viceice]

You need to pin your deps to fixed versions or enable lockfile maintenance. Renovate doesn't do in range updates by default. Another option is to configure range strategy.

Please check the docs.

[geoffrey-brier]

You're right, I wasn't aware of the pinning dependencies part thanks a lot for pointing that out 👍

I did try a few different methods as you suggested :

• enabling lock file maintenance: it worked but lacked information about what was updated
  

• setting rangeStrategy to bump : it worked but missed some updates (I guess it's the right behaviour)
  

• setting rangeStrategy to update-lockfile : it worked perfectly !
  

Here is my final configuration file for those interested:

{
  "extends": [
    "group:allNonMajor",
    ":disableMajorUpdates"
  ],
  "enabledManagers": ["composer", "docker-compose", "dockerfile"],
  "packageRules": [
    {
      "managers": ["composer"],
      "rangeStrategy": "update-lockfile"
    }
  ],
  "ignoreScripts": true
}