.github/dependabot.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
version: 2
updates:
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
    ignore:
      # IO-734
      - dependency-name: "commons-io:commons-io"
        versions:
        - "2.9.0"
      # Don't upgrade Rhino unless somebody is willing to figure out the necessary code changes.
      - dependency-name: "rhino:js"
      # maven-plugin-plugin 3.6.2 is affected by MPLUGIN-384
      - dependency-name: "org.apache.maven.plugins:maven-plugin-plugin"
        versions:
        - "3.6.2"
      # Recent versions of google-java-format access internal Java APIs and adding the required JVM
      # flags isn't an option because the code needs to run in Ant.
      - dependency-name: "com.google.googlejavaformat:google-java-format"
        versions:
        - ">= 1.8"
    open-pull-requests-limit: 15
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"