Only security bugs setup does not work with regex manager

[bh-tt]

What would you like help with?

I think I found a bug

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

I'm trying to get only security PRs to work using the regex manager, yet something appears to go wrong. The debug logs indicate it finds the packages and versions, yet it skips opening any python PR because all dependencies are disabled. I have a reproducer, which does open a PR for the requirements.txt dependency (aiohttp=3.8.3), but not for the regex manager based config (with tornado=6.2.0). The mend renovate app log clearly shows it has found vulnerabilities, yet it only opens a branch for the requirements.txt vulnerability.

Logs (if relevant)

Logs

DEBUG: Matched 1 file(s) for manager pip_requirements: requirements.txt
DEBUG: Matched 1 file(s) for manager regex: dmz/it/repositories/pypirepo/values-allowlist.yml
DEBUG: manager extract durations (ms)
{
  "managers": {
    "pip_requirements": 8,
    "regex": 8
  }
}

DEBUG: Found pip_requirements package files
DEBUG: Found regex package files
DEBUG: Found 2 package file(s)
INFO: Dependency extraction complete
{
  "baseBranch": "main"
  "stats": {
    "managers": {
      "pip_requirements": {
        "fileCount": 1,
        "depCount": 1
      },
      "regex": {
        "fileCount": 1,
        "depCount": 1
      }
    },
    "total": {
      "fileCount": 2,
      "depCount": 2
    }
  }
}

DEBUG: fetchVulnerabilities() - osvVulnerabilityAlerts=true
DEBUG: Vulnerability PYSEC-2024-24 affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-gfw2-4jvh-wgfg affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-qvrw-v9rv-5rjx affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-7gpw-8wmc-pm8g affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-q3qx-c6g2-7pw2 affects aiohttp 3.8.3
DEBUG: Vulnerability PYSEC-2024-26 affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-45c4-8wx5-qw6w affects aiohttp 3.8.3
DEBUG: Vulnerability PYSEC-2023-251 affects aiohttp 3.8.3
DEBUG: Vulnerability PYSEC-2023-246 affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-5m98-qgg9-wh84 affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-5h86-8mv2-jq9f affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-8qpw-xqxj-h4r2 affects aiohttp 3.8.3
DEBUG: Vulnerability PYSEC-2023-250 affects aiohttp 3.8.3
DEBUG: Vulnerability PYSEC-2023-120 affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-pjjw-qhg8-p2p9 affects aiohttp 3.8.3
DEBUG: Vulnerability GHSA-qppv-j76h-2rpx affects tornado 6.2.0
DEBUG: Vulnerability GHSA-hj3f-6gcp-jg8j affects tornado 6.2.0
DEBUG: Vulnerability PYSEC-2023-75 affects tornado 6.2.0
DEBUG: Setting allowed version ==3.9.2 to fix vulnerability PYSEC-2024-24 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.8.6 to fix vulnerability GHSA-gfw2-4jvh-wgfg in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.0 to fix vulnerability GHSA-qvrw-v9rv-5rjx in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.4 to fix vulnerability GHSA-7gpw-8wmc-pm8g in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.0 to fix vulnerability GHSA-q3qx-c6g2-7pw2 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.2 to fix vulnerability PYSEC-2024-26 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.8.5 to fix vulnerability GHSA-45c4-8wx5-qw6w in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.0 to fix vulnerability PYSEC-2023-251 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.8.6 to fix vulnerability PYSEC-2023-246 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.4 to fix vulnerability GHSA-5m98-qgg9-wh84 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.2 to fix vulnerability GHSA-5h86-8mv2-jq9f in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.2 to fix vulnerability GHSA-8qpw-xqxj-h4r2 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.9.0 to fix vulnerability PYSEC-2023-250 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.8.5 to fix vulnerability PYSEC-2023-120 in aiohttp 3.8.3
DEBUG: Setting allowed version ==3.8.6 to fix vulnerability GHSA-pjjw-qhg8-p2p9 in aiohttp 3.8.3
DEBUG: Setting allowed version ==6.3.3 to fix vulnerability GHSA-qppv-j76h-2rpx in tornado 6.2.0
DEBUG: Setting allowed version ==6.3.2 to fix vulnerability GHSA-hj3f-6gcp-jg8j in tornado 6.2.0
DEBUG: Setting allowed version ==6.3.2 to fix vulnerability PYSEC-2023-75 in tornado 6.2.0
DEBUG: Dependency: tornado, is disabled
DEBUG: PackageFiles.add() - Package file saved for base branch
{
  "baseBranch": "main"
}

DEBUG: Package releases lookups complete
{
  "baseBranch": "main"
}

DEBUG: branchifyUpgrades
DEBUG: detectSemanticCommits()
DEBUG: getCommitMessages
DEBUG: semanticCommits: detected "unknown"
DEBUG: semanticCommits: disabled
DEBUG: 1 flattened updates found: aiohttp
DEBUG: Returning 1 branch(es)
DEBUG: config.repoIsOnboarded=true
DEBUG: packageFiles with updates
{
  "baseBranch": "main"
  "config": {
    "pip_requirements": [
      {
        "deps": [
          {
            "depName": "aiohttp",
            "currentValue": "==3.8.3",
            "datasource": "pypi",
            "currentVersion": "3.8.3",
            "updates": [
              {
                "bucket": "non-major",
                "newVersion": "3.9.4",
                "newValue": "==3.9.4",
                "releaseTimestamp": "2024-04-11T19:13:03.000Z",
                "newMajor": 3,
                "newMinor": 9,
                "updateType": "minor",
                "isRange": true,
                "branchName": "renovate/pypi-aiohttp-vulnerability"
              }
            ],
            "packageName": "aiohttp",
            "versioning": "pep440",
            "warnings": [],
            "sourceUrl": "https://github.com/aio-libs/aiohttp",
            "registryUrl": "https://pypi.org/pypi",
            "currentVersionTimestamp": "2022-09-21T14:40:05.000Z",
            "isSingleVersion": true,
            "fixedVersion": "3.8.3"
          }
        ],
        "packageFile": "requirements.txt"
      }
    ],
    "regex": [
      {
        "deps": [
          {
            "depName": "tornado",
            "currentValue": "6.2.0",
            "datasource": "pypi",
            "replaceString": "pypi.allowlist.\"tornado\".min=6.2.0\n",
            "updates": [],
            "packageName": "tornado",
            "skipReason": "disabled"
          }
        ],
        "matchStrings": [
          "pypi\\.allowlist\\.\"(?<depName>.+?)\"\\.min=(?<currentValue>.+?)\\n"
        ],
        "datasourceTemplate": "pypi",
        "packageFile": "dmz/it/repositories/pypirepo/values-allowlist.yml"
      }
    ]
  }
}

DEBUG: detectSemanticCommits()
DEBUG: semanticCommits: returning "disabled" from cache
DEBUG: processRepo()
DEBUG: Processing 1 branch: renovate/pypi-aiohttp-vulnerability
DEBUG: Calculating hourly PRs remaining
DEBUG: currentHourStart=2024-06-03T12:00:00.000+00:00
DEBUG: PR hourly limit remaining: 2
DEBUG: Calculating prConcurrentLimit (10)
DEBUG: getBranchPr(renovate/pypi-aiohttp-vulnerability)
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, undefined, open)
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, undefined, closed)
DEBUG: 0 PRs are currently open
DEBUG: PR concurrent limit remaining: 10
DEBUG: Calculated maximum PRs remaining this run: 2
DEBUG: PullRequests limit = 2
DEBUG: Calculating hourly PRs remaining
DEBUG: currentHourStart=2024-06-03T12:00:00.000+00:00
DEBUG: PR hourly limit remaining: 2
DEBUG: Calculating branchConcurrentLimit (10)
DEBUG: 0 already existing branches found: 
DEBUG: Branch concurrent limit remaining: 10
DEBUG: Calculated maximum branches remaining this run: 2
DEBUG: Branches limit = 2
DEBUG: syncBranchState() (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: syncBranchState(): Branch cache not found, creating minimal branchState (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: getBranchPr(renovate/pypi-aiohttp-vulnerability) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, undefined, open) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, undefined, closed) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: branchExists=false (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: dependencyDashboardCheck=undefined (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Check for closed PR because recreating closed PRs is disabled. (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, Update dependency aiohttp to v3.9.4 [SECURITY], !open) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: prAlreadyExisted=false (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Checking schedule(schedule=, tz=null, now=2024-06-03T12:50:06.275Z) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: No schedule defined (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Branch needs creating (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Using reuseExistingBranch: false (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Setting current branch to main (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: latest commit (branch="renovate/pypi-aiohttp-vulnerability")
{
  "branchName": "main"
  "latestCommitDate": "2024-06-03T14:49:20+02:00"
}

DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Starting search at index 7 (branch="renovate/pypi-aiohttp-vulnerability")
{
  "packageFile": "requirements.txt"
  "depName": "aiohttp"
}

DEBUG: Found match at index 7 (branch="renovate/pypi-aiohttp-vulnerability")
{
  "packageFile": "requirements.txt"
  "depName": "aiohttp"
}

DEBUG: Contents updated (branch="renovate/pypi-aiohttp-vulnerability")
{
  "packageFile": "requirements.txt"
  "depName": "aiohttp"
}

DEBUG: updateArtifacts for updatedPackageFiles (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: pip_requirements.updateArtifacts(requirements.txt) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: No hashin commands to run - returning (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Updated 1 package files (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: No updated lock files in branch (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: 1 file(s) to commit (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Preparing files for committing to branch renovate/pypi-aiohttp-vulnerability (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Setting git author name: renovate[bot] (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Setting git author email: 29139614+renovate[bot]@users.noreply.github.com (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: git commit (branch="renovate/pypi-aiohttp-vulnerability")
{
  "deletedFiles": []
  "ignoredFiles": []
  "result": {
    "author": null,
    "branch": "renovate/pypi-aiohttp-vulnerability",
    "commit": "cd73c33945392bfb0a5ee2a3b1153c2caed26aca",
    "root": false,
    "summary": {
      "changes": 1,
      "insertions": 1,
      "deletions": 1
    }
  }
}

DEBUG: HEAD https://api.github.com/repos/bh-tt/renovate-python-security-reproducer/git/refs/heads/renovate/pypi-aiohttp-vulnerability/ = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=97) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: HEAD https://api.github.com/repos/bh-tt/renovate-python-security-reproducer/git/refs/heads/renovate/pypi-aiohttp-vulnerability = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=139) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: resetToCommit(1750a51e8a61596e993c89d03c2f3d7fd94104cc) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Fetching branch renovate/pypi-aiohttp-vulnerability (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Setting current branch to main (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: latest commit (branch="renovate/pypi-aiohttp-vulnerability")
{
  "branchName": "main"
  "latestCommitDate": "2024-06-03T14:49:20+02:00"
}

INFO: Branch created (branch="renovate/pypi-aiohttp-vulnerability")
{
  "commitSha": "51a4b84ac684b1902717cd18f2157e4e742e0a37"
}

DEBUG: Ensuring PR (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: There are 0 errors and 0 warnings (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: getBranchPr(renovate/pypi-aiohttp-vulnerability) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, undefined, open) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, undefined, closed) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: getPrCache() (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Fetching changelog: https://github.com/aio-libs/aiohttp (3.8.3 -> 3.9.4) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Creating PR (branch="renovate/pypi-aiohttp-vulnerability")
{
  "prTitle": "Update dependency aiohttp to v3.9.4 [SECURITY]"
}

DEBUG: Creating PR (branch="renovate/pypi-aiohttp-vulnerability")
{
  "title": "Update dependency aiohttp to v3.9.4 [SECURITY]"
  "head": "bh-tt:renovate/pypi-aiohttp-vulnerability"
  "base": "main"
  "draft": false
}

DEBUG: PR created (branch="renovate/pypi-aiohttp-vulnerability")
{
  "pr": 2
  "draft": false
}

DEBUG: Adding labels '' to #2 (branch="renovate/pypi-aiohttp-vulnerability")
INFO: PR created (branch="renovate/pypi-aiohttp-vulnerability")
{
  "pr": 2
  "prTitle": "Update dependency aiohttp to v3.9.4 [SECURITY]"
}

DEBUG: addParticipants(pr=2) (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: setPrCache() (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: Created Pull Request #2 (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: PR is not configured for automerge (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: setBranchCommit() (branch="renovate/pypi-aiohttp-vulnerability")
DEBUG: getBranchPr(renovate/pypi-aiohttp-vulnerability)
DEBUG: findPr(renovate/pypi-aiohttp-vulnerability, undefined, open)
DEBUG: Found PR #2
DEBUG: getPrCache()
DEBUG: ensureDependencyDashboard()
DEBUG: Ensuring Dependency Dashboard
DEBUG: http cache: saving https://api.github.com/repos/bh-tt/renovate-python-security-reproducer/issues/1 (etag=W/"af4738827584813a8f41a0379cfa9e48fca3636e0ccea70412230f352c898273", lastModified=Mon, 03 Jun 2024 12:49:11 GMT)
DEBUG: http cache: saving https://api.github.com/repos/bh-tt/renovate-python-security-reproducer/issues/1 (etag=W/"af4738827584813a8f41a0379cfa9e48fca3636e0ccea70412230f352c898273", lastModified=Mon, 03 Jun 2024 12:49:11 GMT)
DEBUG: ensureIssue(Dependency Dashboard)
DEBUG: http cache: saving https://api.github.com/repos/bh-tt/renovate-python-security-reproducer/issues/1 (etag=W/"af4738827584813a8f41a0379cfa9e48fca3636e0ccea70412230f352c898273", lastModified=Mon, 03 Jun 2024 12:49:11 GMT)
DEBUG: Patching issue
DEBUG: Issue updated

[bh-tt]

Hey, this discussion is 3 weeks old and there has not been a single response. The repository asks you to create a discussion before creating a bug report, so I've done that. It would be nice if I could get a response as this situation appears to indicate a bug in renovate.

[github-actions[bot]]

Hi there,

Please remember that there are no Service Level Agreements (SLAs) or roadmap commitments in Open Source projects like Renovate. The maintainers and contributors work on bugs/features/docs at their own pace. This means that sometimes you will have to wait for things to happen, or to get a response.

Please avoid comments like: "Any update on this?" or "When will this be fixed?". Do not chase a maintainer to get answers quickly. We will block you if you nudge us frequently.

Please read our Code of Conduct, how we prioritize work to learn more about how we prioritize what to work on. If you are a paying Mend.io customer, please tell your support or customer contact that this issue is important to you.

Thanks, the Renovate team