.github/dependabot.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
version: 2
updates:
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
    ignore:
      # 1.7 is the last version to support Java 8.
      - dependency-name: "com.google.googlejavaformat:google-java-format"
        versions: ">= 1.8"
      - dependency-name: "com.sun.activation:jakarta.activation"
        versions: ">= 1.2.2"
      - dependency-name: "com.sun.mail:jakarta.mail"
        versions: ">= 2.0"
      - dependency-name: "com.sun.xml.messaging.saaj:saaj-impl"
        versions: ">= 2.0"
      - dependency-name: "com.sun.xml.ws:*"
        versions: ">= 3.0"
      # IO-734
      - dependency-name: "commons-io:commons-io"
        versions: "2.9.0"
      - dependency-name: "jakarta.activation:jakarta.activation-api"
        versions: ">= 1.2.2"
      - dependency-name: "jakarta.servlet.jsp:jakarta.servlet.jsp-api"
        versions: ">= 3.0"
      - dependency-name: "jakarta.xml.bind:jakarta.xml.bind-api"
        versions: ">= 3.0"
      - dependency-name: "jakarta.xml.soap:jakarta.xml.soap-api"
        versions: ">= 2.0"
      - dependency-name: "jakarta.xml.ws:jakarta.xml.ws-api"
        versions: ">= 3.0"
      # Jetty 9 supports Servlets 3.1.
      - dependency-name: "javax.servlet:javax.servlet-api"
        versions: "> 3.1.0"
      - dependency-name: "javax.xml.bind:jaxb-api"
        versions: ">= 3.0"
      # Embedding Qpid is a pain and APIs have changed a lot over time. We don't try to keep up with
      # these changes. It's only used for integration tests anyway.
      - dependency-name: "org.apache.qpid:*"
      - dependency-name: "org.eclipse.jetty:*"
        versions: ">= 10.0"
      - dependency-name: "org.glassfish.jaxb:*"
        versions: ">= 3.0"
      # Don't upgrade Rhino unless somebody is willing to figure out the necessary code changes.
      - dependency-name: "rhino:js"
    open-pull-requests-limit: 15