Renovate Allowed Versions

I was trying to figure out why my MongoDB Docker image is not getting upgraded by the Renovate bot in my homelab. In the Dependency Dashboard, I saw that it was detecting the upgrade:

docker.io/library/mongo 8.0.16@sha256:4b58ebcb1dc7a7b4e84cd8ce9098d48764ae4478876898ff9551acf2ac4a6a6d → [Updates: 8.3.4]

However, it was not the upgrade that I wanted. I wanted it to stick to the version 8 and only perform the patch upgrades. So my goal was to upgrade to version 8.0.26.

I misunderstood how renovate actually works, and in my renovate.json I had:

{
  "matchPackageNames": ["docker.io/library/mongo"],
  "matchUpdateTypes": ["minor", "major"],
  "enabled": false
}

My reasoning was that it would still try to update to the next patch version. But what was happening is that it was trying to upgrade to the latest available version (8.3.4 as of writing), seeing that it was a minor update, and not doing that because I disallowed it.

Poking around in the Renovate docs, and asking a couple of questions to GLM-5.2, I found a solution: packageRules.allowedVersions.

The solution was to set allowedVersions:

{
  "matchPackageNames": ["docker.io/library/mongo"],
  "allowedVersions": "/^{{major}}\\.{{minor}}\\./"
}

Basically, it extracts the current major and the minor versions of my current config (8.0.16), so major is 8, and minor is 0. Thus, I only allow versions, which are in 8.0 area. Next, renovate looks what’s the latest available version is (8.3.4), compares it to the allowed versions, and rejects the update. However, it also see that the version 8.0.26 is available, which matches the regex, and thus it updates to it.