This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new e2c7f5a611f ci: Fix stale Dependabot ignore rules for Maven (#20590)
e2c7f5a611f is described below
commit e2c7f5a611f93ac43452764695f0be56bfa086fa
Author: Andreas Maechler <[email protected]>
AuthorDate: Fri Oct 16 23:12:09 2026 -0600
ci: Fix stale Dependabot ignore rules for Maven (#20590)
* Fix stale Dependabot ignore rules for Maven
Remove the ZooKeeper, Jetty and TestNG ignore rules. Dependabot matches
dependency-name against the full groupId:artifactId, so the bare groupIds
never matched, and their pins (ZooKeeper 3.5.x, Jetty 9.4.x, TestNG 7.3.0)
no longer reflect master.
Ignore major updates for Vert.x, pac4j, javacc-maven-plugin, Checkstyle
and Guice, whose major-version PRs have been closed repeatedly as
incompatible. Minor and patch updates still open, and update-type ignores
do not apply to security updates.
* Move the zstd-jni ignore into dependabot.yml
zstd-jni was ignored with an @dependabot comment, which is stored
server-side and hard to find. Cap it below 1.5.7-13 in the config
instead: 1.5.7-13 and later dropped decoding of legacy (pre-1.0) zstd
frames, while 1.5.7-12 still decodes them.
Reword the Checkstyle comment so it does not name specific versions.
* Let security updates through for zstd-jni
A versions range in an ignore rule also suppresses security updates.
Ignore zstd-jni by name only, which skips all version updates but still
lets Dependabot open security updates.
* Drop the Checkstyle ignore now that master is on Checkstyle 14
---
.github/dependabot.yml | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9cb738e8704..c9c164ac63a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,18 +18,28 @@ updates:
patterns:
- "org.apache.maven.resolver:*"
ignore:
- # pin ZooKeeper dependencies to 3.5.x
- - dependency-name: "org.apache.zookeeper"
- versions: "[3.6,)"
- # pin Jetty dependencies to 9.4.x
- - dependency-name: "org.eclipse.jetty"
- versions: "[9.5,)"
- # pin Testng dependencies to 7.3.0
- - dependency-name: "org.testng"
- versions: "[7.4.0,)"
+ # zstd-jni 1.5.7-13 and later cannot decode legacy (pre-1.0) zstd frames
in .zst batch input.
+ # Version updates are ignored; security updates still open PRs.
+ - dependency-name: "com.github.luben:zstd-jni"
# skip AWS SDK v2 patch releases, which ship almost daily; minor bumps
still come through
- dependency-name: "software.amazon.awssdk:*"
update-types: ["version-update:semver-patch"]
+ # Major upgrades of the following dependencies need code or build
changes, so they are done by hand.
+ # Dependabot still proposes their minor and patch updates.
+ # Vert.x must stay on the major version used by the Fabric8 Kubernetes
client
+ - dependency-name: "io.vertx:*"
+ update-types: ["version-update:semver-major"]
+ # pac4j 6 breaks source compatibility and changes session serialization
+ - dependency-name: "org.pac4j:*"
+ update-types: ["version-update:semver-major"]
+ # javacc-maven-plugin 3 generates a Druid SQL parser that does not
compile
+ - dependency-name: "org.codehaus.mojo:javacc-maven-plugin"
+ update-types: ["version-update:semver-major"]
+ # Guice 7 requires migrating from javax to jakarta packages
+ - dependency-name: "com.google.inject:*"
+ update-types: ["version-update:semver-major"]
+ - dependency-name: "com.google.inject.extensions:*"
+ update-types: ["version-update:semver-major"]
# Don't run dependabot on website
- package-ecosystem: "npm"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
