ascheman commented on code in PR #480:
URL:
https://github.com/apache/maven-install-plugin/pull/480#discussion_r4498522944
##########
.github/dependabot.yml:
##########
@@ -33,6 +33,12 @@ updates:
# Maven 3 so use SLF4J 1.7.x
- dependency-name: "org.slf4j:*"
versions: [">= 2.0.0"]
+ # Maven 3 line stays on Resolver 1.x (2.x is Maven 4)
+ - dependency-name: "org.apache.maven.resolver:*"
+ versions: [">= 2.0.0"]
Review Comment:
You're right, thanks — 3.10.x does use Resolver 2.x, so my comment ("2.x is
Maven 4") was wrong. The ignore entry itself is intentional, though: this
plugin's Maven 3 line stays on 3.9.16, which compiles against the
maven-resolver-api 1.x surface (`resolverVersion` 1.9.27, `provided`), so I
keep Dependabot off Resolver 2.x to match that baseline. I've reworded the
comment to say exactly that instead of citing a Maven version boundary that
doesn't hold.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
