Add a weekly grouped Dependabot configuration covering the Gradle sub-project build files and GitHub Actions, with major-version bumps left to be raised by hand, relates to github #883.

Author: dghgit

.github/dependabot.yml

@@ -0,0 +1,50 @@
+# Dependabot version updates.
+#
+# Key reference:
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+#
+# Notes specific to this repository:
+#
+#  * bcprov and the other published jars have no runtime dependencies. Everything
+#    Dependabot can see here is test-only, compileOnly, example (misc), or build
+#    tooling, so these updates are housekeeping rather than security work - hence
+#    the weekly cadence and the grouping into a single pull request per ecosystem.
+#  * The external dependencies live in the sub-project build files (prov, pkix, pg,
+#    mail, jmail, misc, mls, pgsc, ...), not just the root one, so "directories"
+#    with a glob is used - the singular "directory" key does not support globbing.
+#  * Major-version bumps are ignored deliberately. The Gradle modules compile with
+#    --release 8 (and src/main additionally has to stay inside the Java 4 source
+#    floor for the legacy Ant distributions), so a new major of the bnd builder,
+#    Error Prone, or a mail API is a judgement call about supported Java versions
+#    rather than something to merge on green CI. Raise those by hand.
+#  * The jars pulled in with files()/fileTree() from test/libs and libs (mls, prov)
+#    are invisible to Dependabot; they still have to be refreshed manually.
+
+version: 2
+updates:
+  - package-ecosystem: "gradle"
+    directories:
+      - "/"
+      - "/*"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      gradle-dependencies:
+        applies-to: version-updates
+        patterns:
+          - "*"
+    ignore:
+      # See the note above on --release 8 / the Java 4 source floor.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"

CONTRIBUTORS.html

@@ -606,6 +606,7 @@
 <li>Yu Bao &lt;yubao@paypal.com&gt; - reporting an API gap, on behalf of the PayPal Cyber Security Team, that the high-level OpenPGP message API (OpenPGPMessageProcessor / OpenPGPMessageInputStream) gave a caller no way to bound how far a compressed data packet expands, where the low-level PGPCompressedData it wraps has carried a bounded getDataStream(long) overload all along, and that OpenPGPPolicy exposed no equivalent property to set. Suggesting a protocol whitelist for CRL Distribution Point fetching, which is now the org.bouncycastle.x509.CRLDP_protocols property, and suggesting that an OCSP response was read up to the length the responder declared for itself, now capped by org.bouncycastle.ocsp.max_response_size, and suggesting bounds on the OpenPGP ASCII armor headers, now capped by org.bouncycastle.openpgp.max_armor_header_length and org.bouncycastle.openpgp.max_armor_headers.</li>
 <li>Arpan Sharma &lt;https://github.com/Arpan0995&gt; - initial audit of BCPQC provider consistency starting with HQC, which led to the exposure of a number of issues in the JCA provider service interfaces for other BCPQC algorithms.</li>
 <li>Flowdalic &lt;https://github.com/Flowdalic&gt; - initial implementation of an AnimalSniffer-based Android API-level compatibility check for the Gradle build (PR #336).</li>
+<li>hannesa2 &lt;https://github.com/hannesa2&gt; - initial Dependabot configuration for the Gradle and GitHub Actions ecosystems (PR #883).</li>
 </ul>
 </body>
 </html>