This is an automated email from the ASF dual-hosted git repository.
ramanathan1504 pushed a commit to branch 2.x
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
The following commit(s) were added to refs/heads/2.x by this push:
new 7c4e7db2a2 Update Dependabot ignore rules for Logback, Cassandra,
Groovy, Elastic and Kroki (#4305)
7c4e7db2a2 is described below
commit 7c4e7db2a2d2be305a62f5d302fce97a6e68e967
Author: Ramanathan <[email protected]>
AuthorDate: Wed Sep 9 13:02:48 2026 +0530
Update Dependabot ignore rules for Logback, Cassandra, Groovy, Elastic and
Kroki (#4305)
* Update Dependabot configuration to include new dependencies and version
constraints
* Ignore `spring-cloud-context` 5.x on `2.x` and `main`
* Clarify comments in dependabot.yaml regarding dependency versioning and
legacy plugins
* Update version constraint for asciidoctor-kroki in dependabot.yaml
---
.github/dependabot.yaml | 29 +++++++++++++++++++++++++++--
1 file changed, 27 insertions(+), 2 deletions(-)
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 721913acef..718cfbe130 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -50,6 +50,8 @@ updates:
# from the remaining artifacts
- "log4j-mongodb4/**"
- "log4j-slf4j-impl/**"
+ # Cassandra pins Guava, JNR and Snappy for reproducibility
+ - "log4j-cassandra/**"
schedule:
interval: "monthly"
cooldown:
@@ -82,9 +84,9 @@ updates:
# Tomcat Juli 10.1.x requires Java 11
- dependency-name: "org.apache.tomcat:*"
versions: [ "[10.1,)" ]
- # Keep Logback version 1.2.x
+ # Logback 1.4+ binds SLF4J 2.0; 2.x stays on the 1.3.x line
- dependency-name: "ch.qos.logback:*"
- versions: [ "[1.3,)" ]
+ versions: [ "[1.4,)" ]
# Mockito 5.x requires Java 11
- dependency-name: "org.mockito:*"
versions: [ "[5,)" ]
@@ -152,6 +154,15 @@ updates:
# We must also ignore the old Group ID so Dependabot doesn't try to
auto-migrate it.
- dependency-name: "com.github.tomakehurst:wiremock*"
versions: [ "[3,)" ]
+ # cassandra-driver-core v4 relocated to com.datastax.oss:java-driver-core
+ - dependency-name: "com.datastax.cassandra:*"
+ versions: [ "[4,)" ]
+ # Groovy 5 breaks the JSR-223 script filters on 2.x
+ - dependency-name: "org.apache.groovy:*"
+ versions: [ "[5,)" ]
+ # spring-cloud 5.x is the Spring Boot 4 / Framework 7 generation
+ - dependency-name: "org.springframework.cloud:spring-cloud-context"
+ versions: [ "[5,)" ]
- package-ecosystem: maven
directories:
@@ -206,6 +217,10 @@ updates:
update-types:
- "version-update:semver-major"
- "version-update:semver-minor"
+ # `co.elastic.clients:elasticsearch-java` shares the `elastic.version`
property of
+ # `log4j-layout-template-json-test` with the `elasticsearch` and
`logstash` Docker image tags.
+ # The Java client gets patch releases the Docker images don't have, e.g.
`8.17.11`.
+ - dependency-name: "co.elastic.clients:*"
# The `2.26.x` maintenance branch only receives patch-level Maven updates.
- package-ecosystem: maven
@@ -271,6 +286,12 @@ updates:
# We must also ignore the old Group ID so Dependabot doesn't try to
auto-migrate it.
- dependency-name: "com.github.tomakehurst:wiremock*"
versions: [ "[3,)" ]
+ # `com.vlkan.log4j2:log4j2-logstash-layout:0.18` is pinned on the
`log4j-core-test` classpath
+ # as a legacy Log4j 2.x plugin JAR; the version is part of the fixture,
not something to bump.
+ - dependency-name: "com.vlkan.log4j2:*"
+ # spring-cloud 5.x is the Spring Boot 4 / Framework 7 generation
+ - dependency-name: "org.springframework.cloud:spring-cloud-context"
+ versions: [ "[5,)" ]
- package-ecosystem: github-actions
directory: "/"
@@ -291,3 +312,7 @@ updates:
npm-all-main:
patterns: [ "*" ]
target-branch: "main"
+ ignore:
+ # kroki 1.0 is incompatible with the pinned Antora 3.2 alpha
+ - dependency-name: "asciidoctor-kroki"
+ versions: [ ">=1.0.0" ]
