.github/dependabot.yaml

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

version: 2

# Fix the Maven Central to the ASF repository to work around: https://github.com/dependabot/dependabot-core/issues/8329
registries:
  maven-central:
    type: maven-repository
    url: https://repo.maven.apache.org/maven2

updates:

  - package-ecosystem: maven
    directory: "/"
    schedule:
      interval: monthly
    groups:
      dependencies:
        patterns: [ "*" ]
    target-branch: "main"
    registries:
      - maven-central
    ignore:
      # Keep at version 3.6.x
      - dependency-name: "org.apache.maven:maven-plugin-api"
        update-types: ["version-update:semver-major", "version-update:semver-minor"]
      # Jakarta Dependency Injection 2.0 uses `jakarta.*` namespace
      - dependency-name: "jakarta.inject:jakarta.inject-api"
        versions: ["[2,)"]

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: monthly
    groups:
      dependencies:
        patterns: [ "*" ]
    target-branch: "main"

  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: monthly
    groups:
      dependencies:
        patterns: [ "*" ]
    target-branch: "main"