[tonygermano]

Summary

This PR simplifies Renovate's grouping to one rule: each [versions] ref in gradle/libs.versions.toml is updated as one PR, and nothing else is grouped. renovate.json ignores Renovate's built-in group:monorepos preset and drops every groupName rule. CONTRIBUTING.md documents the rule, and the catalog comment points to it.

The first version of this PR removed some groups and added a Guava versioning rule. @pacmano1's review showed both were wrong, and I've replaced them with this change.

Why the groups were a problem

Renovate's Gradle manager records each catalog entry's version.ref and uses it as the group name when no rule sets one, so a ref already updates as one branch. Two other behaviors interfere with that:

• config:recommended includes group:monorepos, which puts Jetty, Jackson, Netty, Log4j2, Jersey, Mockito, jaxb-ri and slf4j into "… monorepo" groups.
• Vulnerability-alert updates reset groupName to null and fall back to the ref name.

So whenever a family's normal updates get a group name that differs from the ref name, a jar with an OSV advisory lands on renovate/<ref> and the rest of the family on renovate/<group>, and both branches rewrite the same catalog line. Renovate logs "Found sourceUrl with multiple branches that should probably be combined into a group" when this happens.

Our jetty, jackson, netty and log4j groups only avoided this because their names happen to equal the refs. That doesn't work for refs with a dash, whose branch names become dotted (jaxb-ri → renovate/jaxb.ri). It also can't work for a group that spans several refs. Before this PR, these were exposed to the split:

• jaxb-ri and slf4j, through group:monorepos.
• awssdk (in aws-sdk), mockito and byte-buddy (in test-tooling), hk2 (in jersey) and jaxws-ri (in sun-xml), through our own multi-ref groups.
• openhtmltopdf: the pdfbox group's *pdfbox* pattern pulled openhtmltopdf-pdfbox away from openhtmltopdf-core.

Trade-off

Artifacts on literal versions, such as the Apache Commons and Metro jars that apache-commons and sun-xml bundled, now get one PR each. Grouping never kept those compatible anyway: each update in a group moves to its own latest version. If artifacts really must move together, they belong on one ref.

In the local run below, PR-producing branches went from 59 to 82, and major-only branches (which wait for dashboard approval) from 31 to 40. That's the initial backlog. prConcurrentLimit, prHourlyLimit and the monthly schedule still pace them.

Guava

#522's -android problem is already fixed in Renovate: config:recommended includes workarounds:guavaVariants since Renovate 44.195.0, so #522 should switch to 33.7.2-jre on its next run without any change from us.

Conflict with #507

#507 edits the netty group, which this PR removes. Whichever merges second needs a rebase. Resolving it means deleting the group.

Testing

Claude ran Renovate 44.199.0 locally (--platform=local, OSV alerts on, as in @pacmano1's review) against main and against this branch, and compared the branches:

• On this branch, every ref goes to exactly one branch plus its major- branch, and no branch updates more than one ref.
• jetty-http's advisory update lands on renovate/jetty with the other Jetty jars. Jackson, Netty and Log4j go to renovate/jackson, renovate/netty and renovate/log4j.
• On main, the pdfbox branch also updates the openhtmltopdf ref, as described above.
• The only remaining "multiple branches" warnings are for javax.json-api/javax.json and policy/jaxws-tools, which are on different versions and so can't share a ref.
• Dockerfile and Gradle wrapper branches are the same as on main. GitHub Actions updates didn't appear in the local run (it had no GitHub token), so those weren't compared.

Also:

• renovate-config-validator --strict --no-global renovate.json passes.
• ./gradlew clean build -PdisableSigning=true passes.

---

🤖 Drafted with Claude Code

[github-actions]

Test Results

  141 files  ±0    141 suites  ±0   4m 6s ⏱️ +39s
  919 tests ±0    919 ✅ ±0  0 💤 ±0  0 ❌ ±0 
1 051 runs  ±0  1 045 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit c979cda. ± Comparison against base commit 991ed69.

♻️ This comment has been updated with latest results.

[pacmano1]

Ran Renovate locally (--platform=local, which still runs the OSV alerts this config turns on) on this branch and its base, with 44.188.2 (the version that opened #522) and 44.199.0.

The Guava rule doesn't change #522. On 44.188.2 this branch offers 33.7.2-android, same as the base. On 44.199.0 both offer 33.7.2-jre because of Renovate's built-in workarounds:guavaVariants (renovatebot/renovate#47554, first in 44.195.0), which config:recommended pulls in. With that preset ignored, both are back to -android. I'd drop the Guava commit.

Dropping the groups splits jars with advisories off from the rest. Without the jetty, jackson, netty and log4j groups, those jars go to renovate/*-monorepo branches, except jars with an OSV advisory, which fall back to the catalog ref name. Jetty does it today: jetty-http goes to renovate/jetty and the other 12 with a 9.4.58 update to renovate/jetty-monorepo, both bumping the same jetty line. Renovate warns "Found sourceUrl with multiple branches that should probably be combined into a group". With OSV alerts off, all of Jetty stays in jetty-monorepo. With older Jackson, Netty and Log4j in a scratch copy (2.12.0, 4.1.42.Final, 2.14.1), each splits the same way on this branch and not on the base, where the groups are named like the refs. Keep those four groups.

pdfbox and Bouncy Castle came out as described.

Co-authored with Claude Code.

[tonygermano]

@pacmano1 Thanks, you're right on both counts, and running Renovate locally was the right way to check this. Claude reproduced both results with 44.199.0.

• Guava: with workarounds:guavaVariants ignored, the regex rule still lands on 33.7.2-android. Since the preset already handles it, I've dropped the Guava change. However, I still have no idea why the regex rule didn't work, as it was pulled directly from renovate docs and the named capture groups worked correctly on regex101.com
• Groups: I'd missed group:monorepos in config:recommended, and that vulnerability updates fall back to the ref name.

Following that through, the four groups only worked because their names happened to equal the refs. That doesn't hold for refs with a dash (jaxb-ri becomes renovate/jaxb.ri), nor for the multi-ref groups. So jaxb-ri, slf4j, awssdk, mockito, byte-buddy, hk2 and jaxws-ri could all split the same way.

Rather than restore the four groups, I've force-pushed a different approach: ignore group:monorepos and drop every groupName rule, so each catalog ref is exactly one branch, vulnerability updates included. The updated description has the details and the local Renovate results. The cost is one PR per literal-version artifact (Apache Commons, Metro). Could you rerun your check against the new head?

---

🤖 Drafted with Claude Code