+1 Mridul, makes sense to remove the rule on trunk and keep it on release24.09.
Kind Regards, Chandan Khandelwal On Fri, Oct 16, 2026 at 2:21 PM Jacques Le Roux via dev < [email protected]> wrote: > Hi Mridul, > > That sounds good to me > > Thanks > > Jacques > > Le 15/10/2026 à 14:28, Mridul Pathak a écrit : > > Hi all, > > > > Our .github/dependabot.yml currently tells Dependabot to ignore > > major-version updates for Gradle dependencies (update-types: > > version-update:semver-major). The rule was added in April, when many of > our > > dependencies were far behind and the Dependabot setup needed a lot of > > catching up, and it served its purpose well: we are now current on minor > > and patch versions. Now that we are in that position, I would like to > > propose removing the rule for trunk, while keeping it on release24.09, > > where major upgrades don't belong anyway. > > > > I had a look at what removing it would bring in on trunk. The upgrades > fall > > into three groups: > > > > - Libraries that don't follow semver, so the rule effectively freezes > them > > today: owasp-java-html-sanitizer (date-based versions, now about 2.5 > years > > behind), icu4j, libphonenumber, and probably hamcrest and CodeNarc > > - Real migrations: Tomcat 11, Spring 7, Jersey 4, Groovy 6, Gradle 9, > Tika > > 4, Axis2 2, Shiro 3, geronimo-transaction 4 > > - Deliberate pins: asciidoctor, and openpdf, which I have proposed > > replacing with PDFBox (already a dependency) in OFBIZ-13684 ( > > https://github.com/apache/ofbiz-framework/pull/2314) so we can drop it > > > > I also checked the latest versions against our Java 17 baseline, and all > of > > them run on 17 except openpdf, which needs Java 21 from 2.1.0. > > > > Removing the rule means Dependabot will open PRs for these major > versions, > > and we would then work through the migrations in steps rather than all at > > once. When we are not ready for a given major version, we can close its > PR > > with "@dependabot ignore this major version" and come back to it later, > and > > for deliberate pins like asciidoctor I would add an explicit ignore entry > > in dependabot.yml so they don't keep coming back. > > > > Comments and concerns are very welcome. > > > > Thanks, > > Mridul Pathak >
