Support Gradle strictly dependencies

[jamietanna]

Tell us more.

Within Gradle projects, it's possible to specify a "strict" dependency on a given dependency.

For instance:

dependencies {
    implementation('org.slf4j:slf4j-api') {
        version {
            strictly '[1.7, 1.8['
            prefer '1.7.25'
        }
    }
}

Per the docs:

strictly or !!

This is the strongest version declaration. Any version not matching this notation will be excluded. If used on a declared dependency, strictly can downgrade a version. For transitive dependencies, if no acceptable version is found, dependency resolution will fail.

Dynamic versions are supported.

When defined, it overrides any previous require declaration and clears any previous reject already declared on that dependency.

However, it is still the case where some users would appreciate their strictly dependency pins to receive updates, for instance if there is a security update available for the package.

Currently, Renovate does not extract, and therefore will not sugggest any updates to the strictly or prefer versions, as they aren't known to Renovate.

We should make it possible to update these, but similar to recent discussions around how Renovate has a default rangeStrategy=bump for Nuget (#44010), we should be cautious around introducing a behaviour change that may be surprising, while also making it so folks can start to get updates, if they so wish.

I propose that:

• we support extracting strictly and prefer
  • via a change to @renovatebot/good-enough-parser
  • which is then updated in the Renovate CLI
  • Renovate will extract this as i.e. depType: strictly and depType: prefer
• depType: strictly and depType: prefer never receive "regular" dependency updates by default
  • similar to how manager/gomod works, where transitive (depType: indirect) dependencies don't receive updates unless explicitly opted in via a package rule
• depType: strictly and depType: prefer do receive dependency updates for vulnerability alerts, by default
  • if a prefer is set, we'll bump that to the minimum version that fixes the vulnerability

How does this sound?

[viceice]

sounds plausible