From c94a06138849d9b4356da9793149ce641d2a290e Mon Sep 17 00:00:00 2001 From: Gerd Aschemann Date: Sun, 25 Oct 2026 14:05:57 +0100 Subject: [PATCH 1/3] Keep Dependabot off Maven 4 deps on the 3.x line master now carries the Maven 3 line after the apache/maven-sources#57 branch switch. The default Dependabot block had no upper bound on the org.apache.maven resolver/core artifacts, so it proposes Maven 4 dependencies (maven-resolver 2.x, and maven-core 4.0.0 once GA ships) onto the Maven 3 line. Pin them below the 4.x boundary, mirroring the existing SLF4J/Mockito ignores. The *-4.x target-branch block is untouched, so the Maven 4 line keeps tracking 4.x. Refs: apache/maven-sources#57 Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 135c85d..e5b35e8 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -34,6 +34,12 @@ updates: # Maven 3 so use SLF4J 1.7.x - dependency-name: "org.slf4j:*" versions: [">= 2.0.0"] + # Maven 3 line stays on Resolver 1.x (2.x is Maven 4) + - dependency-name: "org.apache.maven.resolver:*" + versions: [">= 2.0.0"] + # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch) + - dependency-name: "org.apache.maven:*" + versions: [">= 4.0.0"] - package-ecosystem: "github-actions" directory: "/" From 30aee21b3215ff5ca1f53f8322fdd76eb2d869ff Mon Sep 17 00:00:00 2001 From: Gerd Aschemann Date: Tue, 27 Oct 2026 08:13:07 +0100 Subject: [PATCH 2/3] Scope Maven 3 core ignore to concrete artifacts Replace the broad `org.apache.maven:*` glob in the Maven 3 default ignore block with the specific core artifacts this module actually uses. Artifacts that share the groupId but follow their own release line (e.g. maven-archiver) are no longer caught. Addresses review feedback on the branch-switch Dependabot PR. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e5b35e8..d03c9bb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -37,8 +37,16 @@ updates: # Maven 3 line stays on Resolver 1.x (2.x is Maven 4) - dependency-name: "org.apache.maven.resolver:*" versions: [">= 2.0.0"] - # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch) - - dependency-name: "org.apache.maven:*" + # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch). + # Scoped to the core artifacts this plugin actually uses, so other + # org.apache.maven:* artifacts with their own release line are untouched. + - dependency-name: "org.apache.maven:maven-artifact" + versions: [">= 4.0.0"] + - dependency-name: "org.apache.maven:maven-core" + versions: [">= 4.0.0"] + - dependency-name: "org.apache.maven:maven-model" + versions: [">= 4.0.0"] + - dependency-name: "org.apache.maven:maven-plugin-api" versions: [">= 4.0.0"] - package-ecosystem: "github-actions" From 6ccf497f49b036a3201d011995d857fd210944d2 Mon Sep 17 00:00:00 2001 From: Gerd Aschemann Date: Tue, 27 Oct 2026 08:36:09 +0100 Subject: [PATCH 3/3] Cap Maven 3 core ignore at 3.10 (stay on 3.9 baseline) The ASF minimum-prerequisite decision (dev@, Nov 2025, documented in compatibility-plan.md) keeps plugins on the Maven 3.9 baseline. Lower the core-artifact ignore from 4.0.0 to 3.10.0 so Dependabot no longer offers the 3.10 bump; 3.10 would also pull in Resolver 2.x. The open mavenVersion 3.10 PRs auto-close on the next Dependabot run once this merges. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d03c9bb..cba49a0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -37,17 +37,18 @@ updates: # Maven 3 line stays on Resolver 1.x (2.x is Maven 4) - dependency-name: "org.apache.maven.resolver:*" versions: [">= 2.0.0"] - # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch). - # Scoped to the core artifacts this plugin actually uses, so other + # ASF plugins stay on the Maven 3.9 baseline (min-prerequisite + # decision, dev@ 2025-11; 3.10 would pull in Resolver 2.x). + # Scoped to the core artifacts this plugin uses; other # org.apache.maven:* artifacts with their own release line are untouched. - dependency-name: "org.apache.maven:maven-artifact" - versions: [">= 4.0.0"] + versions: [">= 3.10.0"] - dependency-name: "org.apache.maven:maven-core" - versions: [">= 4.0.0"] + versions: [">= 3.10.0"] - dependency-name: "org.apache.maven:maven-model" - versions: [">= 4.0.0"] + versions: [">= 3.10.0"] - dependency-name: "org.apache.maven:maven-plugin-api" - versions: [">= 4.0.0"] + versions: [">= 3.10.0"] - package-ecosystem: "github-actions" directory: "/"