From 22c7dcb9d1d878504a64b2ed2c87eb982a59d7e9 Mon Sep 17 00:00:00 2001
From: Felipe Zipitria <felipe.zipitria@owasp.org>
Date: Thu, 25 Jun 2026 09:10:54 +0200
Subject: [PATCH] fix: use matchDepNames instead of matchPackageNames in
 Renovate rules

matchPackageNames matches the registry packageName ("coreruleset/coreruleset"),
not the depName set by depNameTemplate. This meant the allowedVersions: "<4.0.0"
constraint was never applied to prev_major_version, allowing Renovate to propose
v4 updates for that field.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 renovate.json | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/renovate.json b/renovate.json
index 3db464b3..b97d7e85 100644
--- a/renovate.json
+++ b/renovate.json
@@ -8,13 +8,12 @@
   },
   "packageRules": [
     {
-      "matchPackageNames": ["coreruleset-v3"],
-      "rangeStrategy": "bump-minor",
+      "matchDepNames": ["coreruleset-v3"],
       "allowedVersions": "<4.0.0",
       "groupName": "CRS v3 updates"
     },
     {
-      "matchPackageNames": ["coreruleset-v4"],
+      "matchDepNames": ["coreruleset-v4"],
       "allowedVersions": ">=4.0.0",
       "groupName": "CRS v4 updates"
     }