|
14 | 14 | # See the License for the specific language governing permissions and |
15 | 15 | # limitations under the License. |
16 | 16 | # |
| 17 | + |
| 18 | +# |
| 19 | +# ██ ██ █████ ██████ ███ ██ ██ ███ ██ ██████ ██ |
| 20 | +# ██ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██ ██ ██ |
| 21 | +# ██ █ ██ ███████ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██ |
| 22 | +# ██ ███ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ |
| 23 | +# ███ ███ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██████ ██ |
| 24 | +# |
| 25 | +# `dependabot.yaml` must be stored in the `.github` directory of the default branch[1]. |
| 26 | +# |
| 27 | +# 1. Make all your changes to this file! |
| 28 | +# Don't create another `dependabot.yaml` – it will simply be discarded. |
| 29 | +# |
| 30 | +# 2. Always associate your entries to a branch! |
| 31 | +# For instance, use `target-branch` in `updates` entries |
| 32 | +# |
| 33 | +# [1] https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file |
| 34 | +# |
| 35 | + |
17 | 36 | version: 2 |
18 | | -# Add Maven Central explicitly to work around: |
19 | | -# https://github.com/dependabot/dependabot-core/issues/8329 |
| 37 | + |
| 38 | +# Fix the Maven Central to the ASF repository to work around: https://github.com/dependabot/dependabot-core/issues/8329 |
20 | 39 | registries: |
21 | 40 | maven-central: |
22 | 41 | type: maven-repository |
23 | 42 | url: https://repo.maven.apache.org/maven2 |
24 | 43 |
|
25 | 44 | updates: |
26 | | -- package-ecosystem: maven |
27 | | - directory: "/" |
28 | | - open-pull-requests-limit: 10 |
29 | | - schedule: |
30 | | - interval: "daily" |
31 | | - target-branch: "2.x" |
32 | | - registries: |
33 | | - - maven-central |
34 | | - ignore: |
35 | | - # Jetty 10.x does not have an internal logging API |
36 | | - - dependency-name: "org.eclipse.jetty:*" |
37 | | - update-types: ["version-update:semver-major"] |
38 | | - # EclipseLink 3.x is Jakarta EE 9 |
39 | | - - dependency-name: "org.eclipse.persistence:*" |
40 | | - update-types: ["version-update:semver-major"] |
41 | | - # Spring 6.x is Jakarta EE 9 |
42 | | - - dependency-name: "org.springframework:*" |
43 | | - update-types: ["version-update:semver-major"] |
44 | | - # Spring Boot 3.x is Jakarta EE 9 |
45 | | - - dependency-name: "org.springframework.boot:*" |
46 | | - update-types: ["version-update:semver-major"] |
47 | | - # Spring Cloud 2022.x is Jakarta EE 9 |
48 | | - - dependency-name: "org.springframework.cloud:*" |
49 | | - update-types: ["version-update:semver-major"] |
50 | | - # Tomcat Juli 10.1.x requires Java 11 |
51 | | - - dependency-name: "org.apache.tomcat:*" |
52 | | - update-types: ["version-update:semver-major", "version-update:semver-minor"] |
53 | | - # Keep Logback version 1.2.x |
54 | | - - dependency-name: "ch.qos.logback:*" |
55 | | - update-types: ["version-update:semver-major", "version-update:semver-minor"] |
56 | | - # Mockito 5.x requires Java 11 |
57 | | - - dependency-name: "org.mockito:*" |
58 | | - update-types: ["version-update:semver-major"] |
59 | | - # JUnit Pioneer 2.x requires Java 11 |
60 | | - - dependency-name: "org.junit-pioneer:*" |
61 | | - update-types: ["version-update:semver-major"] |
62 | | - # Apache Cassandra: keep version 3.x |
63 | | - - dependency-name: "org.apache.cassandra:*" |
64 | | - versions: ["[4.0.0,)"] |
65 | | - # Kubernetes: keep version 5.x |
66 | | - - dependency-name: "io.fabric8:*" |
67 | | - versions: ["[6.0.0,)"] |
68 | | - # `com.conversantmedia:disruptor` 1.2.16 requires Java 9 |
69 | | - - dependency-name: "com.conversantmedia:disruptor" |
70 | | - versions: ["[1.2.16,)"] |
71 | | - # Keep Jakarta EE at version 9.0 |
72 | | - - dependency-name: "jakarta.platform:*" |
73 | | - versions: ["[10.0.0,)"] |
74 | | - # OpenRewrite is quite noisy. Let us skip patch and minor updates: |
75 | | - - dependency-name: "org.openrewrite:*" |
76 | | - update-types: ["version-update:semver-minor", "version-update:semver-patch"] |
77 | | - - dependency-name: "org.openrewrite.maven:*" |
78 | | - update-types: ["version-update:semver-minor", "version-update:semver-patch"] |
79 | | - - dependency-name: "org.openrewrite.recipe:*" |
80 | | - update-types: ["version-update:semver-minor", "version-update:semver-patch"] |
81 | | - # Json Unit 3.x requires Java 17 |
82 | | - - dependency-name: "net.javacrumbs.json-unit:*" |
83 | | - versions: ["[3.0.0,)"] |
84 | | - # Update both `disruptor.version` to latest 3.x version |
85 | | - # and `disruptor4.version` to latest 4.x version |
86 | | - - dependency-name: "com.lmax:disruptor" |
87 | | - update-types: ["version-update:semver-major"] |
88 | | - # WebCompere System Stubs requires Java 11 |
89 | | - - dependency-name: "uk.org.webcompere:*" |
90 | | - versions: ["2.1.0,)"] |
91 | | - # SLF4J 1.7.x should only upgrade to 1.7.x and |
92 | | - # SLF4J 2.x should only upgrade to 2.x. |
93 | | - - dependency-name: "org.slf4j:slf4j-api" |
94 | | - update-types: ["version-update:semver-major"] |
95 | | - # Plexus Utils 4.x are for Maven 4.x |
96 | | - - dependency-name: "org.codehaus.plexus:plexus-utils" |
97 | | - versions: ["4,)"] |
98 | 45 |
|
99 | | -- package-ecosystem: github-actions |
100 | | - directory: "/" |
101 | | - schedule: |
102 | | - interval: "daily" |
103 | | - target-branch: "2.x" |
| 46 | + - package-ecosystem: maven |
| 47 | + directory: "/" |
| 48 | + open-pull-requests-limit: 10 |
| 49 | + schedule: |
| 50 | + interval: "daily" |
| 51 | + target-branch: "2.x" |
| 52 | + registries: |
| 53 | + - maven-central |
| 54 | + ignore: |
| 55 | + # Jetty 10.x does not have an internal logging API |
| 56 | + - dependency-name: "org.eclipse.jetty:*" |
| 57 | + update-types: [ "version-update:semver-major" ] |
| 58 | + # EclipseLink 3.x is Jakarta EE 9 |
| 59 | + - dependency-name: "org.eclipse.persistence:*" |
| 60 | + update-types: [ "version-update:semver-major" ] |
| 61 | + # Spring 6.x is Jakarta EE 9 |
| 62 | + - dependency-name: "org.springframework:*" |
| 63 | + update-types: [ "version-update:semver-major" ] |
| 64 | + # Spring Boot 3.x is Jakarta EE 9 |
| 65 | + - dependency-name: "org.springframework.boot:*" |
| 66 | + update-types: [ "version-update:semver-major" ] |
| 67 | + # Spring Cloud 2022.x is Jakarta EE 9 |
| 68 | + - dependency-name: "org.springframework.cloud:*" |
| 69 | + update-types: [ "version-update:semver-major" ] |
| 70 | + # Tomcat Juli 10.1.x requires Java 11 |
| 71 | + - dependency-name: "org.apache.tomcat:*" |
| 72 | + update-types: [ "version-update:semver-major", "version-update:semver-minor" ] |
| 73 | + # Keep Logback version 1.2.x |
| 74 | + - dependency-name: "ch.qos.logback:*" |
| 75 | + update-types: [ "version-update:semver-major", "version-update:semver-minor" ] |
| 76 | + # Mockito 5.x requires Java 11 |
| 77 | + - dependency-name: "org.mockito:*" |
| 78 | + update-types: [ "version-update:semver-major" ] |
| 79 | + # JUnit Pioneer 2.x requires Java 11 |
| 80 | + - dependency-name: "org.junit-pioneer:*" |
| 81 | + update-types: [ "version-update:semver-major" ] |
| 82 | + # Apache Cassandra: keep version 3.x |
| 83 | + - dependency-name: "org.apache.cassandra:*" |
| 84 | + versions: [ "[4.0.0,)" ] |
| 85 | + # Kubernetes: keep version 5.x |
| 86 | + - dependency-name: "io.fabric8:*" |
| 87 | + versions: [ "[6.0.0,)" ] |
| 88 | + # `com.conversantmedia:disruptor` 1.2.16 requires Java 9 |
| 89 | + - dependency-name: "com.conversantmedia:disruptor" |
| 90 | + versions: [ "[1.2.16,)" ] |
| 91 | + # Keep Jakarta EE at version 9.0 |
| 92 | + - dependency-name: "jakarta.platform:*" |
| 93 | + versions: [ "[10.0.0,)" ] |
| 94 | + # OpenRewrite is quite noisy. Let us skip patch and minor updates: |
| 95 | + - dependency-name: "org.openrewrite:*" |
| 96 | + update-types: [ "version-update:semver-minor", "version-update:semver-patch" ] |
| 97 | + - dependency-name: "org.openrewrite.maven:*" |
| 98 | + update-types: [ "version-update:semver-minor", "version-update:semver-patch" ] |
| 99 | + - dependency-name: "org.openrewrite.recipe:*" |
| 100 | + update-types: [ "version-update:semver-minor", "version-update:semver-patch" ] |
| 101 | + # Json Unit 3.x requires Java 17 |
| 102 | + - dependency-name: "net.javacrumbs.json-unit:*" |
| 103 | + versions: [ "[3.0.0,)" ] |
| 104 | + # Update both `disruptor.version` to latest 3.x version |
| 105 | + # and `disruptor4.version` to latest 4.x version |
| 106 | + - dependency-name: "com.lmax:disruptor" |
| 107 | + update-types: [ "version-update:semver-major" ] |
| 108 | + # WebCompere System Stubs requires Java 11 |
| 109 | + - dependency-name: "uk.org.webcompere:*" |
| 110 | + versions: [ "2.1.0,)" ] |
| 111 | + # SLF4J 1.7.x should only upgrade to 1.7.x and |
| 112 | + # SLF4J 2.x should only upgrade to 2.x. |
| 113 | + - dependency-name: "org.slf4j:slf4j-api" |
| 114 | + update-types: [ "version-update:semver-major" ] |
| 115 | + # Plexus Utils 4.x are for Maven 4.x |
| 116 | + - dependency-name: "org.codehaus.plexus:plexus-utils" |
| 117 | + versions: [ "4,)" ] |
| 118 | + # MongoDB 3.x should only upgrade to 3.x and |
| 119 | + # MongoDB 4.x should only upgrade to 4.x |
| 120 | + - dependency-name: "org.mongodb:*" |
| 121 | + update-types: [ "version-update:semver-major" ] |
| 122 | + |
| 123 | + - package-ecosystem: github-actions |
| 124 | + directory: "/" |
| 125 | + schedule: |
| 126 | + interval: "daily" |
| 127 | + target-branch: "2.x" |
| 128 | + |
| 129 | + - package-ecosystem: npm |
| 130 | + directory: "/" |
| 131 | + schedule: |
| 132 | + interval: "daily" |
| 133 | + target-branch: "2.x" |
| 134 | + |
| 135 | + - package-ecosystem: maven |
| 136 | + directory: "/" |
| 137 | + open-pull-requests-limit: 10 |
| 138 | + schedule: |
| 139 | + interval: "daily" |
| 140 | + target-branch: "main" |
| 141 | + registries: |
| 142 | + - maven-central |
| 143 | + ignore: |
| 144 | + # Jetty 10.x does not have an internal logging API |
| 145 | + - dependency-name: "org.eclipse.jetty:*" |
| 146 | + update-types: [ "version-update:semver-major" ] |
| 147 | + # EclipseLink 3.x is Jakarta EE 9 |
| 148 | + - dependency-name: "org.eclipse.persistence:*" |
| 149 | + update-types: [ "version-update:semver-major" ] |
| 150 | + # Spring 6.x is Jakarta EE 9 |
| 151 | + - dependency-name: "org.springframework:*" |
| 152 | + update-types: [ "version-update:semver-major" ] |
| 153 | + # Spring Boot 3.x is Jakarta EE 9 |
| 154 | + - dependency-name: "org.springframework.boot:*" |
| 155 | + update-types: [ "version-update:semver-major" ] |
| 156 | + # Spring Cloud 2022.x is Jakarta EE 9 |
| 157 | + - dependency-name: "org.springframework.cloud:*" |
| 158 | + update-types: [ "version-update:semver-major" ] |
| 159 | + # Keep Logback version 1.2.x |
| 160 | + - dependency-name: "ch.qos.logback:*" |
| 161 | + update-types: [ "version-update:semver-major", "version-update:semver-minor" ] |
| 162 | + # Apache Cassandra: keep version 3.x |
| 163 | + - dependency-name: "org.apache.cassandra:*" |
| 164 | + versions: [ "[4.0.0,)" ] |
| 165 | + # Kubernetes: keep version 5.x |
| 166 | + - dependency-name: "io.fabric8:*" |
| 167 | + versions: [ "[6.0.0,)" ] |
| 168 | + # Keep Jakarta EE at version 9.0 |
| 169 | + - dependency-name: "jakarta.platform:*" |
| 170 | + versions: [ "[10.0.0,)" ] |
| 171 | + # OpenRewrite is quite noisy. Let us skip patch and minor updates: |
| 172 | + - dependency-name: "org.openrewrite:*" |
| 173 | + update-types: [ "version-update:semver-minor", "version-update:semver-patch" ] |
| 174 | + - dependency-name: "org.openrewrite.maven:*" |
| 175 | + update-types: [ "version-update:semver-minor", "version-update:semver-patch" ] |
| 176 | + - dependency-name: "org.openrewrite.recipe:*" |
| 177 | + update-types: [ "version-update:semver-minor", "version-update:semver-patch" ] |
| 178 | + # Json Unit 3.x requires Java 17 |
| 179 | + - dependency-name: "net.javacrumbs.json-unit:*" |
| 180 | + versions: [ "[3.0.0,)" ] |
| 181 | + # SLF4J 1.7.x should only upgrade to 1.7.x and |
| 182 | + # SLF4J 2.x should only upgrade to 2.x. |
| 183 | + - dependency-name: "org.slf4j:slf4j-api" |
| 184 | + update-types: [ "version-update:semver-major" ] |
| 185 | + # Plexus Utils 4.x are for Maven 4.x |
| 186 | + - dependency-name: "org.codehaus.plexus:plexus-utils" |
| 187 | + versions: [ "[4,)" ] |
| 188 | + # Don't upgrade to 3.x |
| 189 | + - dependency-name: "org.apache.logging.log4j:log4j-api" |
| 190 | + versions: [ "[3,)" ] |
104 | 191 |
|
105 | | -- package-ecosystem: maven |
106 | | - directory: "/" |
107 | | - open-pull-requests-limit: 10 |
108 | | - schedule: |
109 | | - interval: "daily" |
110 | | - target-branch: "main" |
111 | | - registries: |
112 | | - - maven-central |
113 | | - ignore: |
114 | | - # Jetty 10.x does not have an internal logging API |
115 | | - - dependency-name: "org.eclipse.jetty:*" |
116 | | - update-types: ["version-update:semver-major"] |
117 | | - # EclipseLink 3.x is Jakarta EE 9 |
118 | | - - dependency-name: "org.eclipse.persistence:*" |
119 | | - update-types: ["version-update:semver-major"] |
120 | | - # Spring 6.x is Jakarta EE 9 |
121 | | - - dependency-name: "org.springframework:*" |
122 | | - update-types: ["version-update:semver-major"] |
123 | | - # Spring Boot 3.x is Jakarta EE 9 |
124 | | - - dependency-name: "org.springframework.boot:*" |
125 | | - update-types: ["version-update:semver-major"] |
126 | | - # Spring Cloud 2022.x is Jakarta EE 9 |
127 | | - - dependency-name: "org.springframework.cloud:*" |
128 | | - update-types: ["version-update:semver-major"] |
129 | | - # Keep Logback version 1.2.x |
130 | | - - dependency-name: "ch.qos.logback:*" |
131 | | - update-types: ["version-update:semver-major", "version-update:semver-minor"] |
132 | | - # Apache Cassandra: keep version 3.x |
133 | | - - dependency-name: "org.apache.cassandra:*" |
134 | | - versions: ["[4.0.0,)"] |
135 | | - # Kubernetes: keep version 5.x |
136 | | - - dependency-name: "io.fabric8:*" |
137 | | - versions: ["[6.0.0,)"] |
138 | | - # Keep Jakarta EE at version 9.0 |
139 | | - - dependency-name: "jakarta.platform:*" |
140 | | - versions: ["[10.0.0,)"] |
141 | | - # OpenRewrite is quite noisy. Let us skip patch and minor updates: |
142 | | - - dependency-name: "org.openrewrite:*" |
143 | | - update-types: ["version-update:semver-minor", "version-update:semver-patch"] |
144 | | - - dependency-name: "org.openrewrite.maven:*" |
145 | | - update-types: ["version-update:semver-minor", "version-update:semver-patch"] |
146 | | - - dependency-name: "org.openrewrite.recipe:*" |
147 | | - update-types: ["version-update:semver-minor", "version-update:semver-patch"] |
148 | | - # Json Unit 3.x requires Java 17 |
149 | | - - dependency-name: "net.javacrumbs.json-unit:*" |
150 | | - versions: ["[3.0.0,)"] |
151 | | - # SLF4J 1.7.x should only upgrade to 1.7.x and |
152 | | - # SLF4J 2.x should only upgrade to 2.x. |
153 | | - - dependency-name: "org.slf4j:slf4j-api" |
154 | | - update-types: ["version-update:semver-major"] |
155 | | - # Plexus Utils 4.x are for Maven 4.x |
156 | | - - dependency-name: "org.codehaus.plexus:plexus-utils" |
157 | | - versions: ["4,)"] |
| 192 | + - package-ecosystem: github-actions |
| 193 | + directory: "/" |
| 194 | + schedule: |
| 195 | + interval: "daily" |
| 196 | + target-branch: "main" |
158 | 197 |
|
159 | | -- package-ecosystem: github-actions |
160 | | - directory: "/" |
161 | | - schedule: |
162 | | - interval: "daily" |
163 | | - target-branch: "main" |
| 198 | + - package-ecosystem: npm |
| 199 | + directory: "/" |
| 200 | + schedule: |
| 201 | + interval: "daily" |
| 202 | + target-branch: "main" |
0 commit comments