Repository navigation
Conversation
master now carries the Maven 3 line after the apache/maven-sources#57 branch switch. The default Dependabot block had no upper bound on the org.apache.maven core artifacts, so once Maven 4 reaches GA Dependabot would bump mavenVersion to 4.0.0 on the Maven 3 line. Pin org.apache.maven below the 4.x boundary, mirroring the existing SLF4J/Mockito ignores. The *-4.x target-branch block is untouched, so the Maven 4 line keeps tracking 4.x. Refs: apache/maven-sources#57 Co-Authored-By: Claude Opus 4.8 <[email protected]>
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
LGTM. The change is correct and minimal — org.apache.maven:* with >= 4.0.0 correctly prevents Dependabot from bumping Maven core to 4.x on the Maven 3 line (master), mirroring the existing SLF4J/Mockito guards. The maven-resources-plugin-4.x block is untouched, so the 4.x line keeps tracking 4.x freely.
No issues found.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
Replace the broad `org.apache.maven:*` glob in the Maven 3 default ignore block with the specific core artifacts this module actually uses. Artifacts that share the groupId but follow their own release line (e.g. maven-archiver) are no longer caught. Addresses review feedback on the branch-switch Dependabot PR. Co-Authored-By: Claude Opus 4.8 <[email protected]>
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
Following up on my earlier review — the wildcard org.apache.maven:* from the initial commit has been scoped to the three concrete artifacts this plugin actually uses: maven-core, maven-model, and maven-plugin-api. This matches exactly what the POM declares under ${mavenVersion} and avoids over-constraining unrelated org.apache.maven.* sub-group artifacts that have their own release lines. The 4.x block is still untouched.
LGTM.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
The ASF minimum-prerequisite decision (dev@, Nov 2025, documented in compatibility-plan.md) keeps plugins on the Maven 3.9 baseline. Lower the core-artifact ignore from 4.0.0 to 3.10.0 so Dependabot no longer offers the 3.10 bump; 3.10 would also pull in Resolver 2.x. The open mavenVersion 3.10 PRs auto-close on the next Dependabot run once this merges. Co-Authored-By: Claude Opus 4.8 <[email protected]>
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
Following up on my earlier review — the 3rd commit lowers the Dependabot ignore bound from >= 4.0.0 to >= 3.10.0 for the three Maven core artifacts.
The reasoning is solid: the ASF minimum-prerequisite decision (dev@ Nov 2025) keeps plugins on the Maven 3.9 baseline, and 3.10 would pull in Resolver 2.x — an undesired jump. Capping at 3.10.0 means Dependabot will not offer the 3.10 bump (e.g. the currently open #548), and the Maven 4 line in the *-4.x block remains untouched.
The three artifacts scoped (maven-core, maven-model, maven-plugin-api) match what the plugin actually declares under ${mavenVersion} in its POM. No over-constraint. LGTM.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
master now carries the Maven 3 line after the apache/maven-sources#57 branch switch. The default Dependabot block had no upper bound on the
org.apache.mavencore artifacts, so once Maven 4 reaches GA Dependabot would bumpmavenVersionto 4.0.0 on the Maven 3 line.This pins
org.apache.mavenbelow the 4.x boundary, mirroring the existing SLF4J/Mockito ignores. The*-4.xtarget-branch block is untouched, so the Maven 4 line keeps tracking 4.x (incl. RCs).Refs: apache/maven-sources#57