Downgrade due to poetry branch reuse

[msw-kialo]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

If a poetry branch is not rebased, but otherwise updated (e.g. new version released), Renovate will probably reuse the existing branch (reuseExistingBranch = true).
poetry will be executed branched off earlier, but the output will be pushed with the newest base branch commit as parent (potentially due to enabled platform commit).

Demonstration: https://github.com/msw-kialo/renovate-push-rebase

Specifically msw-kialo/renovate-push-rebase#1

Way to reproduce:

1. Let renovate open PR for package (ideally that is frequently released, to make the bug surface quicker, i.e., boto3—released daily): Update dependency boto3 to v1.35.62 msw-kialo/renovate-push-rebase#1
2. Another PR is merged Update dependency idna to v3.7 msw-kialo/renovate-push-rebase#2 in this case
3. Update dependency boto3 to v1.35.62 msw-kialo/renovate-push-rebase#1 is updated to include the newest version: however, as renovate reused the branch it downgrades pyproject.toml / poetry.lock and therefore downgrades Update dependency idna to v3.7 msw-kialo/renovate-push-rebase#2

The branch update can be seen in https://github.com/msw-kialo/renovate-push-rebase/compare/a6b3d271f60a8dec3925e85dd2185e0012d67955..5c1ba312b5fa29e18900e53a06fb2339d8e48a29
The diff only displays the updated boto3 change. Not shown is the unintended downgrade due to the changed parent commit (that is visible in the PR diff view).

We initially observed with issue in the self-hosted version of renovate. We also use GitHub and enabled platform commits; this feature might be required to trigger this issue.

We are able to mitigate this issue by setting reuseExistingBranch = false:

renovate/lib/workers/repository/update/branch/reuse.ts

Line 120 in 8e6f89b

result.reuseExistingBranch = true;

Logs (if relevant)

Logs

DEBUG: Branch already exists (branch="renovate/boto3-1.x-lockfile")
DEBUG: GET https://api.github.com/repos/msw-kialo/renovate-push-rebase/branches/main/protection = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=403 retryCount=0, duration=66) (branch="renovate/boto3-1.x-lockfile")
DEBUG: Endpoint: repos/msw-kialo/renovate-push-rebase/branches/main/protection, needs paid GitHub plan (branch="renovate/boto3-1.x-lockfile")
DEBUG: Branch protection: Do not have permissions to detect branch protection (branch="renovate/boto3-1.x-lockfile")
DEBUG: Skipping behind base branch check due to rebaseWhen=auto (branch="renovate/boto3-1.x-lockfile")
DEBUG: isBranchConflicted(main, renovate/boto3-1.x-lockfile) (branch="renovate/boto3-1.x-lockfile")
DEBUG: branch.isConflicted(): using cached result "false" (branch="renovate/boto3-1.x-lockfile")
DEBUG: Branch does not need rebasing (branch="renovate/boto3-1.x-lockfile")
DEBUG: Using reuseExistingBranch: true (branch="renovate/boto3-1.x-lockfile")
DEBUG: Setting current branch to main (branch="renovate/boto3-1.x-lockfile")
DEBUG: Initializing git repository into /tmp/renovate/repos/github/msw-kialo/renovate-push-rebase (branch="renovate/boto3-1.x-lockfile")
DEBUG: Performing blobless clone (branch="renovate/boto3-1.x-lockfile")
DEBUG: git clone completed (branch="renovate/boto3-1.x-lockfile")
{
  "durationMs": 517
}

DEBUG: latest repository commit (branch="renovate/boto3-1.x-lockfile")
{
  "latestCommit": {
    "hash": "c76a43d14e751b566bd89d042666b7d40d7f0c1f",
    "date": "2024-05-24T18:29:02+02:00",
    "message": "Merge pull request #2 from msw-kialo/renovate/idna-3.x",
    "refs": "HEAD -> main, origin/main, origin/HEAD",
    "body": "Update dependency idna to v3.7",
    "author_name": "Malte Swart",
    "author_email": "msw@kialo.com"
  }
}

DEBUG: latest commit (branch="renovate/boto3-1.x-lockfile")
{
  "branchName": "main"
  "latestCommitDate": "2024-05-24T18:29:02+02:00"
}

DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=true (branch="renovate/boto3-1.x-lockfile")
DEBUG: poetry.updateLockedDependency: boto3@1.34.109 -> 1.34.113 [poetry.lock] (branch="renovate/boto3-1.x-lockfile")
DEBUG: updateArtifacts for nonUpdatedPackageFiles (branch="renovate/boto3-1.x-lockfile")
DEBUG: poetry.updateArtifacts(pyproject.toml) (branch="renovate/boto3-1.x-lockfile")
DEBUG: Updating poetry.lock (branch="renovate/boto3-1.x-lockfile")
DEBUG: Using python version from pyproject.toml (branch="renovate/boto3-1.x-lockfile")
DEBUG: Using poetry version 1.8.2 from poetry.lock header (branch="renovate/boto3-1.x-lockfile")
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (branch="renovate/boto3-1.x-lockfile")
DEBUG: Using containerbase dynamic installs (branch="renovate/boto3-1.x-lockfile")
DEBUG: Resolved stable matching version (branch="renovate/boto3-1.x-lockfile")
{
  "toolName": "python"
  "constraint": ">=3.10"
  "resolvedVersion": "3.12.3"
}

DEBUG: Executing command (branch="renovate/boto3-1.x-lockfile")
{
  "command": "install-tool python 3.12.3"
}

DEBUG: exec completed (branch="renovate/boto3-1.x-lockfile")
{
  "durationMs": 21641
  "stdout": "[22:21:44.541] INFO (67): Installing tool python@3.12.3...\ninstalling v2 tool python v3.12.3\nlinking tool python v3.12.3\nPython 3.12.3\npip 24.0 from /opt/containerbase/tools/python/3.12.3/lib/python3.12/site-packages/pip (python 3.12)\n[22:22:04.895] INFO (67): Installed tool python in 20.3s.\n"
  "stderr": ""
}

DEBUG: Executing command (branch="renovate/boto3-1.x-lockfile")
{
  "command": "install-tool poetry 1.8.2"
}

DEBUG: exec completed (branch="renovate/boto3-1.x-lockfile")
{
  "durationMs": 25984
  "stdout": "[22:22:06.505] INFO (229): Installing tool poetry@1.8.2...\ninstalling v2 tool poetry v1.8.2\nlinking tool poetry v1.8.2\nPoetry (version 1.8.2)\n[22:22:31.014] INFO (229): Installed tool poetry in 24.5s.\n"
  "stderr": ""
}

DEBUG: Executing command (branch="renovate/boto3-1.x-lockfile")
{
  "command": "poetry update --lock --no-interaction boto3"
}

DEBUG: exec completed (branch="renovate/boto3-1.x-lockfile")
{
  "durationMs": 4196
  "stdout": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
  "stderr": "Creating virtualenv msw-Be_y1VtG-py3.12 in /home/ubuntu/.cache/pypoetry/virtualenvs\n"
}

DEBUG: Returning updated poetry.lock (branch="renovate/boto3-1.x-lockfile")
DEBUG: Updated 1 package files (branch="renovate/boto3-1.x-lockfile")
DEBUG: Updated 1 lock files (branch="renovate/boto3-1.x-lockfile")
{
  "updatedArtifacts": [
    "poetry.lock"
  ]
}

DEBUG: Getting comments for #1 (branch="renovate/boto3-1.x-lockfile")
DEBUG: http cache: saving https://api.github.com/repos/msw-kialo/renovate-push-rebase/issues/1/comments?per_page=100 (etag="4abcb53f92f716d6f23a8fbd926847f05da16f952642ad8291a436389ef03769", lastModified=undefined) (branch="renovate/boto3-1.x-lockfile")
DEBUG: Found 0 comments (branch="renovate/boto3-1.x-lockfile")
DEBUG: Getting comments for #1 (branch="renovate/boto3-1.x-lockfile")
DEBUG: http cache: saving https://api.github.com/repos/msw-kialo/renovate-push-rebase/issues/1/comments?per_page=100 (etag="4abcb53f92f716d6f23a8fbd926847f05da16f952642ad8291a436389ef03769", lastModified=undefined) (branch="renovate/boto3-1.x-lockfile")
DEBUG: Found 0 comments (branch="renovate/boto3-1.x-lockfile")
DEBUG: 2 file(s) to commit (branch="renovate/boto3-1.x-lockfile")
DEBUG: Preparing files for committing to branch renovate/boto3-1.x-lockfile (branch="renovate/boto3-1.x-lockfile")
DEBUG: Setting git author name: renovate[bot] (branch="renovate/boto3-1.x-lockfile")
DEBUG: Setting git author email: 29139614+renovate[bot]@users.noreply.github.com (branch="renovate/boto3-1.x-lockfile")
DEBUG: git commit (branch="renovate/boto3-1.x-lockfile")
{
  "deletedFiles": []
  "ignoredFiles": []
  "result": {
    "author": null,
    "branch": "renovate/boto3-1.x-lockfile",
    "commit": "cbcb16bf6a494b9f860a48210b19b9769d1039f0",
    "root": false,
    "summary": {
      "changes": 2,
      "insertions": 13,
      "deletions": 13
    }
  }
}

DEBUG: HEAD https://api.github.com/repos/msw-kialo/renovate-push-rebase/git/refs/heads/renovate/boto3-1.x-lockfile/ = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=101) (branch="renovate/boto3-1.x-lockfile")
DEBUG: resetToCommit(c76a43d14e751b566bd89d042666b7d40d7f0c1f) (branch="renovate/boto3-1.x-lockfile")
DEBUG: Fetching branch renovate/boto3-1.x-lockfile (branch="renovate/boto3-1.x-lockfile")
DEBUG: Setting current branch to main (branch="renovate/boto3-1.x-lockfile")
DEBUG: latest commit (branch="renovate/boto3-1.x-lockfile")
{
  "branchName": "main"
  "latestCommitDate": "2024-05-24T18:29:02+02:00"
}

INFO: Branch updated (branch="renovate/boto3-1.x-lockfile")
{
  "commitSha": "5c1ba312b5fa29e18900e53a06fb2339d8e48a29"
}

DEBUG: Ensuring PR (branch="renovate/boto3-1.x-lockfile")
DEBUG: There are 0 errors and 0 warnings (branch="renovate/boto3-1.x-lockfile")
DEBUG: getBranchPr(renovate/boto3-1.x-lockfile) (branch="renovate/boto3-1.x-lockfile")
DEBUG: findPr(renovate/boto3-1.x-lockfile, undefined, open) (branch="renovate/boto3-1.x-lockfile")
DEBUG: Found PR #1 (branch="renovate/boto3-1.x-lockfile")
DEBUG: getPrCache() (branch="renovate/boto3-1.x-lockfile")
DEBUG: Found existing PR (branch="renovate/boto3-1.x-lockfile")
DEBUG: PR fingerprints mismatch, processing PR (branch="renovate/boto3-1.x-lockfile")
DEBUG: Fetching changelog: https://github.com/boto/boto3 (1.34.109 -> 1.34.113) (branch="renovate/boto3-1.x-lockfile")
DEBUG: Processing existing PR (branch="renovate/boto3-1.x-lockfile")
DEBUG: PR title changed (branch="renovate/boto3-1.x-lockfile")
{
  "branchName": "renovate/boto3-1.x-lockfile"
  "oldPrTitle": "Update dependency boto3 to v1.34.112"
  "newPrTitle": "Update dependency boto3 to v1.34.113"
}

DEBUG: updatePr(1, Update dependency boto3 to v1.34.113, body) (branch="renovate/boto3-1.x-lockfile")
DEBUG: PR updated...prNo: 1 (branch="renovate/boto3-1.x-lockfile")
INFO: PR updated (branch="renovate/boto3-1.x-lockfile")
{
  "pr": 1
  "prTitle": "Update dependency boto3 to v1.34.113"
}

[rarkins]

How is the "frequently released package" part related? I thought based on your description that it might apply to any package.

It also seems specifically related to you having one update which is lockfile-only, and the other update is package file-based.

[msw-kialo]

I will rephrase it: the issue will only surface if the PR is updated that isn't a forced / requested rebase (i.e. new released version). So one would potentially need to wait a long time if the package is rarely released.

It could be this is related to package-only updates (at least for poetry it would be unlikely to trigger otherwise as the content-hash in poetry.lock frequently causes merge conflicts: the main reason we try to avoid it).

However, the bug just “reverts” pyproject.toml and poetry.lock changes from the base branch. I just choose other renovate PRs as illustration (they are the most realistic case). However, also manual changes will be reverted (as renovate will commit an old version).

[rarkins]

I've looked into this, and ultimately need to point you to this warning in the Poetry docs:

Poetry isn't used for libraries, so as far as I'm aware there is no functional need to use ranges instead of versions, particularly if you are expecting Renovate to update the lock file every time a new version is out anyway. If the dependency version was pinned to a single version in the pyproject.toml then I'm pretty sure this problem wouldn't occur.

[msw-kialo]

Poetry isn't used for libraries, so as far as I'm aware there is no functional need to use ranges instead of versions, particularly if you are expecting Renovate to update the lock file every time a new version is out anyway.

For us, it is the need to reduce merge conflicts: poetry puts a hash of its pyproject.toml content in its lock file; every renovate PR conflicts with each other as all change this hash (if the version is pinned in pyproject.toml).
This results in high CI load and more importantly it makes merging renovate PRs very slow: once one PR is merged, all others conflicts and must be rebased before another one can be approved/merge.

Poetry does not support updating to a specific/exact version with the update command, and the above update command may not even update at all sometimes.

This is the explanation that is given after this mentioned after this warning.
As this is a limitation from poetry I can understand that (we are aware of this warning) and thought this is the only limitation that is warned about:

If the behavior described in this discussion is still “expected”, I think the documentation should explicitly point out that renovate might inadvertently downgrade versions and other changes from pyproject.toml and poetry.lock.
However, I am surprised as this is clearly a renovate limitation (poetry runs fine it is just executed on an old branch content / the changes are incorrectly committed).
Is there a way to improve this? Sadly, I am not so familiar with the inner working of Renovate (especially regarding assumptions around updateLockedDependency) to know where to start.

[rarkins]

It could be improved if/once Poetry supports updating locked dependencies to exact versions. Until then, we recommend pinning dependencies in pyproject.toml, or manually choosing the Renovate rebase option in cases like this

[msw-kialo]

To prevent potential misunderstandings: the described and observed behavior here isn't due to a limitation in poetry itself. It upgraded the dependency as expected (and didn't downgrade anything). It was just run on an old branch; that is also the reason https://github.com/msw-kialo/renovate-push-rebase/pull/1/files downgrades the pyproject.toml entry.

It could be improved if/once Poetry supports updating locked dependencies to exact versions. Until then, we recommend pinning dependencies in pyproject.toml, or manually choosing the Renovate rebase option in cases like this

Why is this feature required here? It seems unrelated to this. I would be open to provide a PR to improve this (I just need a bit of guidance where to look in renovate's source code).

[vladimir-avinkin]

@msw-kialo Hey, I think we can clearly conclude it's a bug, can you please create an issue? :) Well done on the reproduction, i couldn't figure out why this happens to some of my PRs.

One other thing I also find puzzling is that if renovate thinks that poetry lockfile upgrades are unreliable, why is the default rangeStrategy for poetry when using auto update-lockfile then? Weird.

As a sidenote, this issue seriously demotivated me to ever use autoMerge with renovate, if those kinds of issues are possible it's hard to justify even with a fairly robust test suite.

Nevertheless, i appreciate what renovate is doing, when it works it feels like magic.

[rarkins]

I have created #30988 on the topic of rangeStategy=auto for poetry

[msw-kialo]

I agree the way renovate behaves here is clearly a bug and IMO unrelated to poetry limitations: poetry is only responsible for poetry.lock, but here does Renovate create PRs with e.g. pyproject.toml downgrades.

However, creating this discussion is the way to raise issues. So I don't know what to do otherwise.

[vladimir-avinkin]

That's the discussions page, for enhancement proposals and help requests. Issues are raised in the "issues" section usually. At least that's my understanding of the GitHub-land.

I've reposted this discussion in the umbrella issue that tracks multiple issues with downgrades here

I'll wait and hope that it will be fixed there, if it isn't i'll create a proper separate issue so at least it's reported and in a backlog.

[msw-kialo]

While this is the common approach on GitHub: it is not the outline process for renovate:
https://github.com/renovatebot/renovate/blob/main/.github/ISSUE_TEMPLATE/config.yml:

Our preferred starting point if you have any questions or suggestions about bot configuration, features or behavior.

[rarkins]

I've converted the branch reuse bug part of this to an issue here: #31042. This discussion can now be closed