Is it possible for Renovate to wait for "stable release" of a package? Can minimumReleaseAge be used for that?

[bzakdd]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Github / Renovate latest from dockerhub

Please tell us more about your question or problem

Imagine following example:

• there is a package we update
• it has newest version 1.9.0 for a long time.
• then 2.0.0 is published on Monday, but it has some critical bug that is soon discovered
• patch release 2.0.1 is released 2 days later on Wednesday

Renovate is running daily. I want to configure it to "distrust fresh releases" for example for 3 days, and if there are newer releases Renovate should ignore older ones, assuming that those are buggy. Logic I would like it to apply in the example above:

• Component is in version 1.9.0.
• On Monday version 2.0.0 is released. It has too low age (less than 3 days), so update is not done.
• On Tuesday nothing changes.
• On Wednesday version 2.0.1 is released. It has too low age (less than 3 days), so update is not done.
• On Thursday and Friday nothing changes. Renovate stopped tracking version 2.0.0, so it doesn't execute the version bump
• On Saturday version 2.0.1 reaches age 3 days, so Renovate bumps version 1.9.0 -> 2.0.1

If I understand correctly, then stabilityDays/minimumReleaseAge feature doesn't work this way. Considering example above, if I understand it correctly then setting minimumReleaseAge=3 would end with following situation:
On Thursday 2.0.1 is of age "1 day", but 2.0.0 is of age "3 days", so Renovate updates version 1.9.0 -> 2.0.0 which is bad.

Is there a way to apply logic that I mentioned -> "wait for period of no releases to update"? Or does minimumReleaseAge do that and I just misunderstood it?

Logs (if relevant)

No response

[RahulGautamSingh]

Note: Renovate will wait for the set duration to pass for each separate version. Renovate does not wait until the package has seen no releases for x time-duration(minimumReleaseAge).

As state in the docs, that is not currently possible.

[bzakdd]

Thank you!
I wonder now, what is the intended use of minimumReleaseAge parameter? Apart from the npm case described in the manual I don't understand what would be the usecase for it. What is the point of delaying your update by several days?

[rarkins]

1. Waiting some days decreases the chance that the update might be malicious (they are typically taken down in the first day or two)
2. On registries like npm it's allowed to yank/remove a release within the first week. The more you delay towards 7 days the less chance of this happening and breaking your application