Hi Mridul, That sounds good to me
Thanks Jacques Le 15/10/2026 à 14:28, Mridul Pathak a écrit :
Hi all, Our .github/dependabot.yml currently tells Dependabot to ignore major-version updates for Gradle dependencies (update-types: version-update:semver-major). The rule was added in April, when many of our dependencies were far behind and the Dependabot setup needed a lot of catching up, and it served its purpose well: we are now current on minor and patch versions. Now that we are in that position, I would like to propose removing the rule for trunk, while keeping it on release24.09, where major upgrades don't belong anyway. I had a look at what removing it would bring in on trunk. The upgrades fall into three groups: - Libraries that don't follow semver, so the rule effectively freezes them today: owasp-java-html-sanitizer (date-based versions, now about 2.5 years behind), icu4j, libphonenumber, and probably hamcrest and CodeNarc - Real migrations: Tomcat 11, Spring 7, Jersey 4, Groovy 6, Gradle 9, Tika 4, Axis2 2, Shiro 3, geronimo-transaction 4 - Deliberate pins: asciidoctor, and openpdf, which I have proposed replacing with PDFBox (already a dependency) in OFBIZ-13684 ( https://github.com/apache/ofbiz-framework/pull/2314) so we can drop it I also checked the latest versions against our Java 17 baseline, and all of them run on 17 except openpdf, which needs Java 21 from 2.1.0. Removing the rule means Dependabot will open PRs for these major versions, and we would then work through the migrations in steps rather than all at once. When we are not ready for a given major version, we can close its PR with "@dependabot ignore this major version" and come back to it later, and for deliberate pins like asciidoctor I would add an explicit ignore entry in dependabot.yml so they don't keep coming back. Comments and concerns are very welcome. Thanks, Mridul Pathak
