Repository navigation
Conversation
master now carries the Maven 3 line after the apache/maven-sources#57 branch switch. The default Dependabot block had no upper bound on the org.apache.maven resolver/core artifacts, so it proposes Maven 4 dependencies (maven-resolver 2.x, and maven-core 4.0.0 once GA ships) onto the Maven 3 line. Pin them below the 4.x boundary, mirroring the existing SLF4J/Mockito ignores. The *-4.x target-branch block is untouched, so the Maven 4 line keeps tracking 4.x. Refs: apache/maven-sources#57 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
gnodet-bot
approved these changes
Oct 25, 2026
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
LGTM. Clean, correct Dependabot ignore rules that pin the Maven 3 line (master) to Resolver 1.x and Maven core 3.x, consistent with the existing SLF4J/Mockito ignores. The version boundaries (>= 2.0.0 for Resolver, >= 4.0.0 for Maven core) are correct for the Maven 3/4 split, and org.apache.maven:* does not accidentally block the plugin itself (which lives under org.apache.maven.plugins).
This review was generated by an AI agent, Hermès on behalf of @gnodet.
slawekjaranowski
requested changes
Oct 25, 2026
Comment on lines
+37
to
+39
| # Maven 3 line stays on Resolver 1.x (2.x is Maven 4) | ||
| - dependency-name: "org.apache.maven.resolver:*" | ||
| versions: [">= 2.0.0"] |
Member
There was a problem hiding this comment.
It is not true 3.10.x use resolver 2.x
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
master now carries the Maven 3 line after the apache/maven-sources#57 branch switch. The default Dependabot block had no upper bound on the
org.apache.mavenresolver/core artifacts, so it proposes Maven 4 dependencies (maven-resolver 2.x, and maven-core 4.0.0 once GA ships) onto the Maven 3 line.This pins them below the 4.x boundary, mirroring the existing SLF4J/Mockito ignores. The
*-4.xtarget-branch block is untouched, so the Maven 4 line keeps tracking 4.x (incl. RCs).Refs: apache/maven-sources#57