slachiewicz commented on issue #247: URL: https://github.com/apache/maven-gh-actions-shared/issues/247#issuecomment-5233656593
Correction to my comment above: I listed `maven-plugin-testing` as a default branch still on `v4` and "worth a look separately". That was wrong. That component has been merged into the Maven core repository, and its `master` is a tombstone — the README says so, and points at `maven-plugin-testing-3.x` as the branch still alive for Maven 3.x. Its `dependabot.yml` targeting only `maven-plugin-testing-3.x` is therefore correct and deliberate, not a misconfiguration, and `master` remaining on `@v4` is not something to fix. I opened apache/maven-plugin-testing#279 against it and have closed that as invalid. So the tail is smaller than I said: **Default branches** — the four with the missing `github-actions` ecosystem, all merged now. Nothing else. **Maintenance branches (11)** — unchanged, still the real remainder: ``` maven-resolver-1.9.x maven-help-plugin-3.4.x wagon-3.x jxr-3.4.x maven-dependency-plugin-3.7.x maven-plugin-tools-3.14.x maven-invoker-plugin-3.7.x maven-pmd-plugin-3.24.x maven-javadoc-plugin-3.8.x maven-project-info-reports-plugin-3.6.x surefire-3.4.x ``` Worth noting the `maven-plugin-testing` case is a useful precedent for those: Dependabot maintains its 3.x branch through a `target-branch` entry, and that branch is fully on `@v5` as a result. So the mechanism works — the question for the other eleven is whether continuous action updates are wanted on maintenance lines, or whether a one-time bump is a better fit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
