Skip to content

Infra: Create more targeted groups for gradle and group all the action upgrades #1542

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yeikel wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Infra: Create more targeted groups for gradle and group all the action upgrades #1542

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ac246d6
Infra: Create more sensible Dependabot groups
yeikel Nov 29, 2025
a334ab7
Remove com.gorylenko.gradle-git-properties from the testing group
yeikel Dec 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 46 additions & 12 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,25 +16,54 @@ updates:
# In general, our Netty references are temporary overrides, usually applied to address transitive Spring vulnerabilities, and should be configured with caution
# In general, having conflicting Netty versions in the classpath is not recommended
- dependency-name: "io.netty:*"
# We will handle major upgrades manually
Copy link
Member

@Haarolean Haarolean Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i don't mind having PRs for these if they don't hog up the total amount of open PRs. Otherwise nobody will ever check if there's a new spring boot out

Copy link
Collaborator Author

@yeikel yeikel Dec 8, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The challenge with Dependabot is that you can enable either major or minor upgrades, but not both at the same time. If we enable major upgrades, only those will appear, and the smaller, more manageable minor upgrades will no longer be shown.

In the case of Spring Boot, we will see Spring Boot 4.x immediately but no minor versions like 3.5.8. So while we wait to allocate capacity for the 4.x bump, we will need to manage minor versions manually

- dependency-name: "*"
update-types:
- "version-update:semver-major"
groups:
spring-boot-dependencies:
patterns:
- "org.springframework.boot:*"
- "io.spring.dependency-management"
# We will handle major upgrades manually
update-types:
- "patch"
- "minor"
other-dependencies:
exclude-patterns:
- "org.springframework.boot:*"
- "io.spring.dependency-management"
- "io.modelcontextprotocol.sdk:mcp-spring-webflux"
Copy link
Member

@Haarolean Haarolean Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is this suddently a spring boot dependency?

Copy link
Collaborator Author

@yeikel yeikel Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not, but I deducted from the name that it is probably a good idea to test these together as mcp-spring-webflux depends on Spring Webflux

Copy link
Collaborator Author

@yeikel yeikel Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think it should be separate?

# We defined this dependency explicitly because Spring uses an older version
- "com.nimbusds:nimbus-jose-jwt"
testing:
# TODO: Consider using dependency-type when https://github.com/dependabot/dependabot-core/issues/13122 is supported
patterns:
- "org.testcontainers:*"
- "org.junit.jupiter:*"
- "org.assertj:*"
- "com.bmuschko.docker-remote-api"
- "org.mockito:*"
# Bouncy Castle is only used for testing purposes
- "org.bouncycastle:bcpkix-jdk18on"
api-build-tools:
patterns:
- "org.openapitools:*"
- "com.github.java-json-tools:*"
- "com.github.victools:*"
# Update Apache Commons libraries together as these dependencies rarely introduce breaking changes
apache-commons:
patterns:
- "org.apache.commons:*"
kafka:
patterns:
- "org.apache.kafka:*"
- "io.confluent:*"
schema-tools:
patterns:
- "com.github.victools:jsonschema-generator"
- "com.github.java-json-tools:json-schema-validator"
- "org.openapitools.openapistylevalidator"
- "org.openapi.generator"
- "io.swagger.core.v3:*"
lucene:
patterns:
- "org.apache.lucene:*"
others:
patterns:
- "*"
update-types:
- "patch"
- "minor"

- package-ecosystem: docker
directory: "/api"
schedule:
Expand All @@ -43,6 +72,7 @@ updates:
timezone: Europe/London
open-pull-requests-limit: 10
ignore:
# We handle Major Java updates manually
- dependency-name: "azul/zulu-openjdk-alpine"
update-types: ["version-update:semver-major"]
labels:
Expand Down Expand Up @@ -75,6 +105,10 @@ updates:
time: "10:00"
timezone: Europe/London
open-pull-requests-limit: 10
groups:
github-actions:
patterns:
- "*"
labels:
- "type/dependencies"
- "scope/infra"
Loading