From 2a754a71ea0622a2566f12303afd328b96b0e816 Mon Sep 17 00:00:00 2001
From: Tony Germano <tony@germano.name>
Date: Sun, 1 Nov 2026 09:59:09 -0500
Subject: [PATCH 1/2] Drop Renovate groups the version catalog already provides

Renovate's Gradle manager records each version catalog entry's
version.ref as its sharedVariableName and uses that as the group
name when no groupName is configured, so every [versions] entry in
gradle/libs.versions.toml already updates as one PR. The jetty,
bouncycastle, jackson and log4j groups add nothing beyond their
catalog refs, and netty only adds the netty-reactive-streams ref,
which is being removed. Drop all five.

The pdfbox group's *pdfbox* pattern also matched
com.openhtmltopdf:openhtmltopdf-pdfbox, which shares the
openhtmltopdf ref with openhtmltopdf-core. That split one version
line across two branches, which would produce conflicting PRs.
Match only org.apache.pdfbox and de.rototor.pdfbox instead.

The remaining groups each span more than one ref or artifacts on
literal versions: aws-sdk (eventstream), jersey (hk2,
osgi-resource-locator), sun-xml, apache-commons and test-tooling.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Tony Germano <tony@germano.name>
---
 renovate.json | 34 ++--------------------------------
 1 file changed, 2 insertions(+), 32 deletions(-)

diff --git a/renovate.json b/renovate.json
index 9b71c32a3..393941be1 100644
--- a/renovate.json
+++ b/renovate.json
@@ -53,18 +53,6 @@
         "software.amazon.eventstream:*"
       ]
     },
-    {
-      "groupName": "jetty",
-      "matchPackageNames": [
-        "org.eclipse.jetty*"
-      ]
-    },
-    {
-      "groupName": "bouncycastle",
-      "matchPackageNames": [
-        "org.bouncycastle*"
-      ]
-    },
     {
       "groupName": "jersey",
       "matchPackageNames": [
@@ -75,7 +63,8 @@
     {
       "groupName": "pdfbox",
       "matchPackageNames": [
-        "*pdfbox*"
+        "org.apache.pdfbox:*",
+        "de.rototor.pdfbox:*"
       ]
     },
     {
@@ -84,25 +73,6 @@
         "com.sun.xml*"
       ]
     },
-    {
-      "groupName": "jackson",
-      "matchPackageNames": [
-        "com.fasterxml.jackson*"
-      ]
-    },
-    {
-      "groupName": "netty",
-      "matchPackageNames": [
-        "io.netty*",
-        "com.typesafe.netty*"
-      ]
-    },
-    {
-      "groupName": "log4j",
-      "matchPackageNames": [
-        "org.apache.logging.log4j*"
-      ]
-    },
     {
       "groupName": "apache-commons",
       "matchPackageNames": [

From 7eaee0507d2d78de5447a40a9bdd3b0d88a08958 Mon Sep 17 00:00:00 2001
From: Tony Germano <tony@germano.name>
Date: Sun, 1 Nov 2026 09:59:09 -0500
Subject: [PATCH 2/2] Keep Renovate on Guava's current -jre flavor

Guava publishes each release in -jre and -android flavors. With
Maven versioning, Renovate treats the suffix as an ordinary
qualifier and proposed 32.0.1-jre -> 33.7.2-android in the
vulnerability PR. Use the regex versioning recommended in
Renovate's docs, which puts the suffix in the compatibility group;
Renovate only offers versions whose compatibility matches the
current one.

See: https://docs.renovatebot.com/modules/versioning/regex/
See: https://github.com/OpenIntegrationEngine/engine/pull/522

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Tony Germano <tony@germano.name>
---
 renovate.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/renovate.json b/renovate.json
index 393941be1..1c93bfadd 100644
--- a/renovate.json
+++ b/renovate.json
@@ -89,6 +89,13 @@
         "org.hamcrest:*",
         "junit:*"
       ]
+    },
+    {
+      "description": "Only offer Guava versions with the same flavor suffix (-jre or -android) as the current one; see https://docs.renovatebot.com/modules/versioning/regex/",
+      "matchPackageNames": [
+        "com.google.guava:guava"
+      ],
+      "versioning": "regex:^(?<major>\\d+)(\\.(?<minor>\\d+))?(\\.(?<patch>\\d+))?(-(?<compatibility>.*))?$"
     }
   ]
 }