This is an automated email from the ASF dual-hosted git repository. ramanathan1504 pushed a commit to branch fix-dependabot-blocks in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
commit 4607e325d56ad5b55dc9b9f3cb61d73eda5cc73d Author: Ramanathan <[email protected]> AuthorDate: Mon Sep 7 05:32:39 2026 +0530 Update Dependabot configuration to include new dependencies and version constraints --- .github/dependabot.yaml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index 721913acef..67587a9245 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -50,6 +50,8 @@ updates: # from the remaining artifacts - "log4j-mongodb4/**" - "log4j-slf4j-impl/**" + # Cassandra pins Guava, JNR and Snappy for reproducibility + - "log4j-cassandra/**" schedule: interval: "monthly" cooldown: @@ -82,9 +84,9 @@ updates: # Tomcat Juli 10.1.x requires Java 11 - dependency-name: "org.apache.tomcat:*" versions: [ "[10.1,)" ] - # Keep Logback version 1.2.x + # Logback 1.4+ binds SLF4J 2.0; 2.x stays on the 1.3.x line - dependency-name: "ch.qos.logback:*" - versions: [ "[1.3,)" ] + versions: [ "[1.4,)" ] # Mockito 5.x requires Java 11 - dependency-name: "org.mockito:*" versions: [ "[5,)" ] @@ -152,6 +154,12 @@ updates: # We must also ignore the old Group ID so Dependabot doesn't try to auto-migrate it. - dependency-name: "com.github.tomakehurst:wiremock*" versions: [ "[3,)" ] + # cassandra-driver-core v4 relocated to com.datastax.oss:java-driver-core + - dependency-name: "com.datastax.cassandra:*" + versions: [ "[4,)" ] + # Groovy 5 breaks the JSR-223 script filters on 2.x + - dependency-name: "org.apache.groovy:*" + versions: [ "[5,)" ] - package-ecosystem: maven directories: @@ -206,6 +214,8 @@ updates: update-types: - "version-update:semver-major" - "version-update:semver-minor" + # elastic.version doubles as the Docker image tag; elasticsearch:8.17.11 does not exist + - dependency-name: "co.elastic.clients:*" # The `2.26.x` maintenance branch only receives patch-level Maven updates. - package-ecosystem: maven @@ -271,6 +281,8 @@ updates: # We must also ignore the old Group ID so Dependabot doesn't try to auto-migrate it. - dependency-name: "com.github.tomakehurst:wiremock*" versions: [ "[3,)" ] + # 0.18 is a 2.x-era plugin jar kept as a test fixture, not a dependency + - dependency-name: "com.vlkan.log4j2:*" - package-ecosystem: github-actions directory: "/" @@ -291,3 +303,7 @@ updates: npm-all-main: patterns: [ "*" ] target-branch: "main" + ignore: + # kroki 1.0 is incompatible with the pinned Antora 3.2 alpha + - dependency-name: "asciidoctor-kroki" + versions: [ "[1,)" ]
