From 23e8c4ad3319012c39355c38ea8a20e1785285ec Mon Sep 17 00:00:00 2001 From: Gerd Aschemann Date: Sun, 25 Oct 2026 14:05:58 +0100 Subject: [PATCH 1/3] Keep Dependabot off Maven 4 deps on the 3.x line master now carries the Maven 3 line after the apache/maven-sources#57 branch switch. The default Dependabot block had no upper bound on the org.apache.maven core artifacts, so once Maven 4 reaches GA Dependabot would bump mavenVersion to 4.0.0 on the Maven 3 line. Pin org.apache.maven below the 4.x boundary, mirroring the existing SLF4J/Mockito ignores. The *-4.x target-branch block is untouched, so the Maven 4 line keeps tracking 4.x. Refs: apache/maven-sources#57 Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0193a6e..780d54e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -33,6 +33,9 @@ updates: # Maven 3 so use SLF4J 1.7.x - dependency-name: "org.slf4j:*" versions: [">= 2.0.0"] + # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch) + - dependency-name: "org.apache.maven:*" + versions: [">= 4.0.0"] - package-ecosystem: "github-actions" directory: "/" From 10efcfe3eef5e15d067b352c0c02377ed4f64aa1 Mon Sep 17 00:00:00 2001 From: Gerd Aschemann Date: Tue, 27 Oct 2026 08:13:07 +0100 Subject: [PATCH 2/3] Scope Maven 3 core ignore to concrete artifacts Replace the broad `org.apache.maven:*` glob in the Maven 3 default ignore block with the specific core artifacts this module actually uses. Artifacts that share the groupId but follow their own release line (e.g. maven-archiver) are no longer caught. Addresses review feedback on the branch-switch Dependabot PR. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 780d54e..5611dc0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -33,8 +33,14 @@ updates: # Maven 3 so use SLF4J 1.7.x - dependency-name: "org.slf4j:*" versions: [">= 2.0.0"] - # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch) - - dependency-name: "org.apache.maven:*" + # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch). + # Scoped to the core artifacts this plugin actually uses, so other + # org.apache.maven:* artifacts with their own release line are untouched. + - dependency-name: "org.apache.maven:maven-core" + versions: [">= 4.0.0"] + - dependency-name: "org.apache.maven:maven-model" + versions: [">= 4.0.0"] + - dependency-name: "org.apache.maven:maven-plugin-api" versions: [">= 4.0.0"] - package-ecosystem: "github-actions" From 49427390528b947110a9244ba9874e1b01f6c3d9 Mon Sep 17 00:00:00 2001 From: Gerd Aschemann Date: Tue, 27 Oct 2026 08:36:15 +0100 Subject: [PATCH 3/3] Cap Maven 3 core ignore at 3.10 (stay on 3.9 baseline) The ASF minimum-prerequisite decision (dev@, Nov 2025, documented in compatibility-plan.md) keeps plugins on the Maven 3.9 baseline. Lower the core-artifact ignore from 4.0.0 to 3.10.0 so Dependabot no longer offers the 3.10 bump; 3.10 would also pull in Resolver 2.x. The open mavenVersion 3.10 PRs auto-close on the next Dependabot run once this merges. Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5611dc0..6d3ed58 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -33,15 +33,16 @@ updates: # Maven 3 so use SLF4J 1.7.x - dependency-name: "org.slf4j:*" versions: [">= 2.0.0"] - # Maven 3 line: stay on Maven 3 core (4.x lives on the -4.x branch). - # Scoped to the core artifacts this plugin actually uses, so other + # ASF plugins stay on the Maven 3.9 baseline (min-prerequisite + # decision, dev@ 2025-11; 3.10 would pull in Resolver 2.x). + # Scoped to the core artifacts this plugin uses; other # org.apache.maven:* artifacts with their own release line are untouched. - dependency-name: "org.apache.maven:maven-core" - versions: [">= 4.0.0"] + versions: [">= 3.10.0"] - dependency-name: "org.apache.maven:maven-model" - versions: [">= 4.0.0"] + versions: [">= 3.10.0"] - dependency-name: "org.apache.maven:maven-plugin-api" - versions: [">= 4.0.0"] + versions: [">= 3.10.0"] - package-ecosystem: "github-actions" directory: "/"