[Maven] How to update related packages in lockstep?

[ablekhman]

Often we have a group of dependencies that share the same version. For example, JAXB related dependencies:

<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>${jaxb.version}</version>
</dependency>
<dependency>
    <groupId>org.glassfish.jaxb</groupId>
    <artifactId>jaxb-runtime</artifactId>
    <version>${jaxb.version}</version>
</dependency>

The version for all dependencies in such groups is controlled by one variable. In the example above, ${jaxb.version}.

Is it possible to configure Renovate bot to keep a group of dependencies on the same version? Say, only suggest update if all of the members of the group have newer - and the same - version available.
Or in other words, recommend an update only if it can be done via a single variable.

Thanks!

[viceice]

Renovate should detect the version variable and group all packages referencing the variable automatically.

[ablekhman]

Interesting. In my environment it didn't. Can it be the result of custom groups for the same components that interfere with this default behaviour?

Update: The dependencies in question are:

• com.sun.xml.bind:jaxb-impl: 2.3.0 -> 2.3.3
• com.sun.xml.bind:jaxb-core: 2.3.0 -> 2.3.0.1
• javax.xml.bind:jaxb-api: 2.3.0 -> 2.3.1

All of the above controlled via the same variable in pom.xml.

[viceice]

Yes, your custom rules override the default behavior. So you need to make sure to group them manually.

[rarkins]

There is regardless a problem if you use a shared variable but the dependencies don't have a common latest version

[ablekhman]

@rarkins , thanks for answering. Is there any way to configure Renovate bot to pick the latest common version for all of them?

[viceice]

@ablekhman nope, not yet supported. Would also very hard to implement.