fix(maven): Disable all parent packages by default

[zharinov]

Changes

In most cases (if not all), parent POM is used to define some common variables and isn't published to Maven.

This PR fixes lookups for 2 and more levels of POM parent files.

Context

• Ref: Maven Parent lookup error #25758

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[viceice]

so if required a user can enable if required?

[zharinov]

Yes, it's optional and can be reverted to current behavior

[zharinov]

But I think in reality nobody will want it

[Churro]

May I ask why the solution suggested in #25758 (reply in thread) wouldn't be enough to solve this?

Disabling updates for all deps with depType = "parent" will also prevent updates to regular deps that are not locally defined. An example for this can be found in the reproduction repo:

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.6.2</version>
    </parent>

With this PR merged, this dep won't see updates anymore, unless the workaround is disabled.

[renovate-release]

🎉 This PR is included in version 37.60.1 🎉

The release is available on:

• GitHub release
• 37.60.1

Your semantic-release bot 📦🚀

[zharinov]

Your solution is correct, maybe if these two presets work for everyone, we later could just remove parent-root dependency type and prevent lookups for all parent deps.

[zharinov]

Oh, I see actually some packages publish their parent POMs

[zharinov]

@Churro Now I'm not sure I understand your solution. The if-clause you propose to remove makes depType = "parent-root" from those deps which are already marked as parents. My premise is that parent packages generally aren't used outside of monorepo, so we don't need to lookup them. But in the monorepo itself, while they're being used in children POMs, we can't use those versions which are published in Maven. Therefore, both parent and parent-root could be safely disabled.

[Churro]

@zharinov, Yes, making them all parent-root also seemed a bit fishy to me and I agree that we wouldn't want to look up dependencies if they are defined locally in parent POMs.

For others that are not locally defined, such as spring-boot-starter-parent in the example above, shouldn't it still be possible to receive updates out-of-the box? This seems to be a very frequent use-case in practice, see here.

Perhaps I'm overlooking something but isn't the root cause that the maven manager impl doesn't properly distinguish between locally and remotely defined parent POMs? It caused org.owasp.webgoat.lesson:webgoat-lessons-parent to be looked up, even though it was defined locally. This PR now disabled updates for any parent deps, regardless of where they are defined.

[breun]

If @Churro is correct that remotely defined parent POMs are now ignored by default, then I can think of many projects that will no longer get their application frameworks updated by Renovate, indeed like application that use Spring Boot for instance, because those applications generally use a framework artifact as the parent to inherit Maven plugin configuration, dependency management, etc. These parents will come typically come from a remote Maven repository. Ignoring parent updates by default sounds like a bad idea to me.

[zharinov]

Now I think maybe we need to disable only known set of packages which are generating error messages

[zharinov]

@rarkins What do you think, should we stick to more targeted solution: #18117 (comment)?