Hi all, Thanks Jacques and Chandan for the feedback. As there were no objections, I went ahead with this in OFBIZ-13716: Dependabot now proposes major-version updates for Gradle dependencies on trunk in both repositories ( https://github.com/apache/ofbiz-framework/pull/2395 and https://github.com/apache/ofbiz-plugins/pull/455), while release24.09 keeps ignoring them. Following Jacopo's suggestion, the plugins configuration now also checks weekly and groups minor and patch updates, as the framework one does.
Dependabot opened the first batch of major-version PRs on trunk. The ones that were simple version bumps are merged (owasp-java-html-sanitizer, hamcrest, Develocity, with libphonenumber to follow), and the migrations are being handled one at a time: Gradle 9 ( https://github.com/apache/ofbiz-framework/pull/2411) and Tika 4 ( https://github.com/apache/ofbiz-framework/pull/2412) are open for review, and the rest will follow. One correction to my earlier message: activiti-juel-jakarta 9, Lucene 10, Solr 10 and CAS 7 need Java 21 or above, so they are explicitly ignored for now and will come back when we raise the Java baseline. Thanks, Mridul Pathak On Fri, Oct 23, 2026 at 3:30 PM Chandan Khandelwal < [email protected]> wrote: > +1 Mridul, makes sense to remove the rule on trunk and keep it on > release24.09. > > > Kind Regards, > Chandan Khandelwal > > > > On Fri, Oct 16, 2026 at 2:21 PM Jacques Le Roux via dev < > [email protected]> wrote: > > > Hi Mridul, > > > > That sounds good to me > > > > Thanks > > > > Jacques > > > > Le 15/10/2026 à 14:28, Mridul Pathak a écrit : > > > Hi all, > > > > > > Our .github/dependabot.yml currently tells Dependabot to ignore > > > major-version updates for Gradle dependencies (update-types: > > > version-update:semver-major). The rule was added in April, when many of > > our > > > dependencies were far behind and the Dependabot setup needed a lot of > > > catching up, and it served its purpose well: we are now current on > minor > > > and patch versions. Now that we are in that position, I would like to > > > propose removing the rule for trunk, while keeping it on release24.09, > > > where major upgrades don't belong anyway. > > > > > > I had a look at what removing it would bring in on trunk. The upgrades > > fall > > > into three groups: > > > > > > - Libraries that don't follow semver, so the rule effectively freezes > > them > > > today: owasp-java-html-sanitizer (date-based versions, now about 2.5 > > years > > > behind), icu4j, libphonenumber, and probably hamcrest and CodeNarc > > > - Real migrations: Tomcat 11, Spring 7, Jersey 4, Groovy 6, Gradle 9, > > Tika > > > 4, Axis2 2, Shiro 3, geronimo-transaction 4 > > > - Deliberate pins: asciidoctor, and openpdf, which I have proposed > > > replacing with PDFBox (already a dependency) in OFBIZ-13684 ( > > > https://github.com/apache/ofbiz-framework/pull/2314) so we can drop it > > > > > > I also checked the latest versions against our Java 17 baseline, and > all > > of > > > them run on 17 except openpdf, which needs Java 21 from 2.1.0. > > > > > > Removing the rule means Dependabot will open PRs for these major > > versions, > > > and we would then work through the migrations in steps rather than all > at > > > once. When we are not ready for a given major version, we can close its > > PR > > > with "@dependabot ignore this major version" and come back to it later, > > and > > > for deliberate pins like asciidoctor I would add an explicit ignore > entry > > > in dependabot.yml so they don't keep coming back. > > > > > > Comments and concerns are very welcome. > > > > > > Thanks, > > > Mridul Pathak > > >
