.github/dependabot.yaml - logging-log4j2 - Git at Google

 #
 # Licensed to the Apache Software Foundation (ASF) under one or more
 # contributor license agreements.  See the NOTICE file distributed with
 # this work for additional information regarding copyright ownership.
 # The ASF licenses this file to you under the Apache License, Version 2.0
 # (the "License"); you may not use this file except in compliance with
 # the License.  You may obtain a copy of the License at
 #
 #      http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #

 #
 # ██     ██  █████  ██████  ███    ██ ██ ███    ██  ██████  ██
 # ██     ██ ██   ██ ██   ██ ████   ██ ██ ████   ██ ██       ██
 # ██  █  ██ ███████ ██████  ██ ██  ██ ██ ██ ██  ██ ██   ███ ██
 # ██ ███ ██ ██   ██ ██   ██ ██  ██ ██ ██ ██  ██ ██ ██    ██
 #  ███ ███  ██   ██ ██   ██ ██   ████ ██ ██   ████  ██████  ██
 #
 # `dependabot.yaml` must be stored in the `.github` directory of the default branch[1].
 #
 #  1. Make all your changes to this file!
 #     Don't create another `dependabot.yaml` – it will simply be discarded.
 #
 #  2. Always associate your entries to a branch!
 #     For instance, use `target-branch` in `updates` entries
 #
 # [1] https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 #

 version: 2

 # Fix the Maven Central to the ASF repository to work around: https://github.com/dependabot/dependabot-core/issues/8329
 registries:
   maven-central:
     type: maven-repository
     url: https://repo.maven.apache.org/maven2

 updates:

   - package-ecosystem: maven
     directory: "/"
     exclude-paths:
       # These use versions of MongoDB and SLF4J different
       # from the remaining artifacts
       - "log4j-mongodb4/**"
       - "log4j-slf4j-impl/**"
     schedule:
       interval: "monthly"
     cooldown:
       default-days: 7
     groups:
       # Groups all non-major updates in a single PR.
       # No group matches major updates, so each one gets a separate PR.
       maven-minor-updates:
         update-types: [ "minor", "patch" ]
     target-branch: "2.x"
     registries:
       - maven-central
     ignore:
       # Jetty 10.x does not have an internal logging API
       - dependency-name: "org.eclipse.jetty:*"
         versions: [ "[10,)" ]
       # EclipseLink 3.x is Jakarta EE 9
       - dependency-name: "org.eclipse.persistence:*"
         versions: [ "[3,)" ]
       # Spring 6.x is Jakarta EE 9
       - dependency-name: "org.springframework:*"
         versions: [ "[6,)" ]
       # Spring Boot 3.x is Jakarta EE 9
       - dependency-name: "org.springframework.boot:*"
         versions: [ "[3,)" ]
       # Spring Cloud 2022.x is Jakarta EE 9
       - dependency-name: "org.springframework.cloud:*"
         versions: [ "[2021,)" ]
       # Tomcat Juli 10.1.x requires Java 11
       - dependency-name: "org.apache.tomcat:*"
         versions: [ "[10.1,)" ]
       # Keep Logback version 1.2.x
       - dependency-name: "ch.qos.logback:*"
         versions: [ "[1.3,)" ]
       # Mockito 5.x requires Java 11
       - dependency-name: "org.mockito:*"
         versions: [ "[5,)" ]
       # JUnit Pioneer 2.x requires Java 11
       - dependency-name: "org.junit-pioneer:*"
         versions: [ "[2,)" ]
       # Apache Cassandra: keep version 3.x
       - dependency-name: "org.apache.cassandra:*"
         versions: [ "[4,)" ]
       # Kubernetes: keep version 5.x
       - dependency-name: "io.fabric8:*"
         versions: [ "[6,)" ]
       # `com.conversantmedia:disruptor` 1.2.16 requires Java 9
       - dependency-name: "com.conversantmedia:disruptor"
         versions: [ "[1.2.16,)" ]
       # Keep Jakarta EE at version 9.0
       - dependency-name: "jakarta.platform:*"
         versions: [ "[10,)" ]
       # OpenRewrite is quite noisy. Let us skip patch and minor updates:
       - dependency-name: "org.openrewrite:*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
       - dependency-name: "org.openrewrite.maven:*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
       - dependency-name: "org.openrewrite.recipe:*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
       # Json Unit 3.x requires Java 17
       - dependency-name: "net.javacrumbs.json-unit:*"
         versions: [ "[3,)" ]
       # Update both `disruptor.version` to latest 3.x version
       # and `disruptor4.version` to latest 4.x version
       - dependency-name: "com.lmax:disruptor"
         update-types: [ "version-update:semver-major" ]
       # WebCompere System Stubs requires Java 11
       - dependency-name: "uk.org.webcompere:*"
         versions: [ "[2.1,)" ]
       # Plexus Utils 4.x are for Maven 4.x
       - dependency-name: "org.codehaus.plexus:plexus-utils"
         versions: [ "[4,)" ]
       # H2 version 2.3.x requires Java 11
       - dependency-name: "com.h2database:h2"
         versions: [ "[2.3,)" ]
       # The Console Appender only support JANSI 1.x for now
       # see https://github.com/apache/logging-log4j2/issues/1736
       - dependency-name: "org.fusesource.jansi:jansi"
         update-types: [ "version-update:semver-major" ]
       # SLF4J should not perform major version upgrades
       - dependency-name: "org.slf4j:slf4j-api"
         update-types: [ "version-update:semver-major" ]
       # Kafka 4.x is not compatible with our appender
       - dependency-name: "org.apache.kafka:*"
         versions: [ "[4,)" ]
       # Keep JUnit below 6.x on 2.x: JUnit 6+ requires Java 17 and breaks Java 8 test runs
       - dependency-name: "org.junit:junit-bom"
         versions: [ "[6,)" ]
       - dependency-name: "org.junit.jupiter:*"
         versions: [ "[6,)" ]
       - dependency-name: "org.junit.platform:*"
         versions: [ "[6,)" ]
       - dependency-name: "org.junit.vintage:*"
         versions: [ "[6,)" ]
       # WireMock 3.x requires Java 11 and Jakarta EE (Jetty 11)
       - dependency-name: "org.wiremock:*"
         versions: [ "[3,)" ]
       # WireMock changed its Group ID from com.github.tomakehurst to org.wiremock in v3.
       # We must also ignore the old Group ID so Dependabot doesn't try to auto-migrate it.
       - dependency-name: "com.github.tomakehurst:wiremock*"
         versions: [ "[3,)" ]

   - package-ecosystem: maven
     directories:
       - "/log4j-mongodb4"
     schedule:
       interval: "monthly"
     cooldown:
       default-days: 7
     groups:
       # Groups all non-major updates in a single PR.
       # No group matches major updates, so each one gets a separate PR.
       maven-minor-updates:
         update-types: [ "minor", "patch" ]
     target-branch: "2.x"
     registries:
       - maven-central
     ignore:
       # MongoDB 4.x should only upgrade to 4.x
       - dependency-name: "org.mongodb:*"
         versions: [ "[5,)" ]

   - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: "monthly"
     groups:
       dependencies:
         patterns: [ "*" ]
     target-branch: "2.x"

   # The `2.26.x` maintenance branch only receives patch-level Maven updates.
   - package-ecosystem: maven
     directory: "/"
     schedule:
       interval: "monthly"
     cooldown:
       default-days: 7
     groups:
       # "Bump the Maven patch updates group across N directories with M updates"
       Maven patch updates:
         patterns: [ "*" ]
     target-branch: "2.26.x"
     registries:
       - maven-central
     ignore:
       # Only allow patch-level upgrades on this maintenance branch
       - dependency-name: "*"
         update-types:
           - "version-update:semver-major"
           - "version-update:semver-minor"

   - package-ecosystem: maven
     directory: "/"
     schedule:
       interval: "monthly"
     cooldown:
       default-days: 7
     groups:
       # Groups all non-major updates in a single PR.
       # No group matches major updates, so each one gets a separate PR.
       maven-minor-updates:
         update-types: [ "minor", "patch" ]
     target-branch: "main"
     registries:
       - maven-central
     ignore:
       # Keep Jakarta EE at version 9.0
       - dependency-name: "jakarta.platform:*"
         versions: [ "[10,)" ]
       # OpenRewrite is quite noisy. Let us skip patch and minor updates:
       - dependency-name: "org.openrewrite:*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
       - dependency-name: "org.openrewrite.maven:*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
       - dependency-name: "org.openrewrite.recipe:*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
       # Plexus Utils 4.x are for Maven 4.x
       - dependency-name: "org.codehaus.plexus:plexus-utils"
         versions: [ "[4,)" ]
       # Don't upgrade to 3.x
       - dependency-name: "org.apache.logging.log4j:log4j-api"
         versions: [ "[3,)" ]
       # The Console Appender only support JANSI 1.x for now
       # see https://github.com/apache/logging-log4j2/issues/1736
       - dependency-name: "org.fusesource.jansi:jansi"
         update-types: [ "version-update:semver-major" ]
       # WireMock 3.x requires Java 11 and Jakarta EE (Jetty 11)
       - dependency-name: "org.wiremock:*"
         versions: [ "[3,)" ]
       # WireMock changed its Group ID from com.github.tomakehurst to org.wiremock in v3.
       # We must also ignore the old Group ID so Dependabot doesn't try to auto-migrate it.
       - dependency-name: "com.github.tomakehurst:wiremock*"
         versions: [ "[3,)" ]

   - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: "monthly"
     groups:
       dependencies:
         patterns: [ "*" ]
     target-branch: "main"

   - package-ecosystem: npm
     directory: "/"
     schedule:
       interval: "monthly"
     groups:
       dependencies:
         patterns: [ "*" ]
     target-branch: "main"
	#
	# Licensed to the Apache Software Foundation (ASF) under one or more
	# contributor license agreements. See the NOTICE file distributed with
	# this work for additional information regarding copyright ownership.
	# The ASF licenses this file to you under the Apache License, Version 2.0
	# (the "License"); you may not use this file except in compliance with
	# the License. You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.
	#

	#
	# ██ ██ █████ ██████ ███ ██ ██ ███ ██ ██████ ██
	# ██ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██ ██ ██
	# ██ █ ██ ███████ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██
	# ██ ███ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██
	# ███ ███ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██████ ██
	#
	# `dependabot.yaml` must be stored in the `.github` directory of the default branch[1].
	#
	# 1. Make all your changes to this file!
	# Don't create another `dependabot.yaml` – it will simply be discarded.
	#
	# 2. Always associate your entries to a branch!
	# For instance, use `target-branch` in `updates` entries
	#
	# [1] https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
	#

	version: 2

	# Fix the Maven Central to the ASF repository to work around: https://github.com/dependabot/dependabot-core/issues/8329
	registries:
	maven-central:
	type: maven-repository
	url: https://repo.maven.apache.org/maven2

	updates:

	- package-ecosystem: maven
	directory: "/"
	exclude-paths:
	# These use versions of MongoDB and SLF4J different
	# from the remaining artifacts
	- "log4j-mongodb4/**"
	- "log4j-slf4j-impl/**"
	schedule:
	interval: "monthly"
	cooldown:
	default-days: 7
	groups:
	# Groups all non-major updates in a single PR.
	# No group matches major updates, so each one gets a separate PR.
	maven-minor-updates:
	update-types: [ "minor", "patch" ]
	target-branch: "2.x"
	registries:
	- maven-central
	ignore:
	# Jetty 10.x does not have an internal logging API
	- dependency-name: "org.eclipse.jetty:*"
	versions: [ "[10,)" ]
	# EclipseLink 3.x is Jakarta EE 9
	- dependency-name: "org.eclipse.persistence:*"
	versions: [ "[3,)" ]
	# Spring 6.x is Jakarta EE 9
	- dependency-name: "org.springframework:*"
	versions: [ "[6,)" ]
	# Spring Boot 3.x is Jakarta EE 9
	- dependency-name: "org.springframework.boot:*"
	versions: [ "[3,)" ]
	# Spring Cloud 2022.x is Jakarta EE 9
	- dependency-name: "org.springframework.cloud:*"
	versions: [ "[2021,)" ]
	# Tomcat Juli 10.1.x requires Java 11
	- dependency-name: "org.apache.tomcat:*"
	versions: [ "[10.1,)" ]
	# Keep Logback version 1.2.x
	- dependency-name: "ch.qos.logback:*"
	versions: [ "[1.3,)" ]
	# Mockito 5.x requires Java 11
	- dependency-name: "org.mockito:*"
	versions: [ "[5,)" ]
	# JUnit Pioneer 2.x requires Java 11
	- dependency-name: "org.junit-pioneer:*"
	versions: [ "[2,)" ]
	# Apache Cassandra: keep version 3.x
	- dependency-name: "org.apache.cassandra:*"
	versions: [ "[4,)" ]
	# Kubernetes: keep version 5.x
	- dependency-name: "io.fabric8:*"
	versions: [ "[6,)" ]
	# `com.conversantmedia:disruptor` 1.2.16 requires Java 9
	- dependency-name: "com.conversantmedia:disruptor"
	versions: [ "[1.2.16,)" ]
	# Keep Jakarta EE at version 9.0
	- dependency-name: "jakarta.platform:*"
	versions: [ "[10,)" ]
	# OpenRewrite is quite noisy. Let us skip patch and minor updates:
	- dependency-name: "org.openrewrite:*"
	update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
	- dependency-name: "org.openrewrite.maven:*"
	update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
	- dependency-name: "org.openrewrite.recipe:*"
	update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
	# Json Unit 3.x requires Java 17
	- dependency-name: "net.javacrumbs.json-unit:*"
	versions: [ "[3,)" ]
	# Update both `disruptor.version` to latest 3.x version
	# and `disruptor4.version` to latest 4.x version
	- dependency-name: "com.lmax:disruptor"
	update-types: [ "version-update:semver-major" ]
	# WebCompere System Stubs requires Java 11
	- dependency-name: "uk.org.webcompere:*"
	versions: [ "[2.1,)" ]
	# Plexus Utils 4.x are for Maven 4.x
	- dependency-name: "org.codehaus.plexus:plexus-utils"
	versions: [ "[4,)" ]
	# H2 version 2.3.x requires Java 11
	- dependency-name: "com.h2database:h2"
	versions: [ "[2.3,)" ]
	# The Console Appender only support JANSI 1.x for now
	# see https://github.com/apache/logging-log4j2/issues/1736
	- dependency-name: "org.fusesource.jansi:jansi"
	update-types: [ "version-update:semver-major" ]
	# SLF4J should not perform major version upgrades
	- dependency-name: "org.slf4j:slf4j-api"
	update-types: [ "version-update:semver-major" ]
	# Kafka 4.x is not compatible with our appender
	- dependency-name: "org.apache.kafka:*"
	versions: [ "[4,)" ]
	# Keep JUnit below 6.x on 2.x: JUnit 6+ requires Java 17 and breaks Java 8 test runs
	- dependency-name: "org.junit:junit-bom"
	versions: [ "[6,)" ]
	- dependency-name: "org.junit.jupiter:*"
	versions: [ "[6,)" ]
	- dependency-name: "org.junit.platform:*"
	versions: [ "[6,)" ]
	- dependency-name: "org.junit.vintage:*"
	versions: [ "[6,)" ]
	# WireMock 3.x requires Java 11 and Jakarta EE (Jetty 11)
	- dependency-name: "org.wiremock:*"
	versions: [ "[3,)" ]
	# WireMock changed its Group ID from com.github.tomakehurst to org.wiremock in v3.
	# We must also ignore the old Group ID so Dependabot doesn't try to auto-migrate it.
	- dependency-name: "com.github.tomakehurst:wiremock*"
	versions: [ "[3,)" ]

	- package-ecosystem: maven
	directories:
	- "/log4j-mongodb4"
	schedule:
	interval: "monthly"
	cooldown:
	default-days: 7
	groups:
	# Groups all non-major updates in a single PR.
	# No group matches major updates, so each one gets a separate PR.
	maven-minor-updates:
	update-types: [ "minor", "patch" ]
	target-branch: "2.x"
	registries:
	- maven-central
	ignore:
	# MongoDB 4.x should only upgrade to 4.x
	- dependency-name: "org.mongodb:*"
	versions: [ "[5,)" ]

	- package-ecosystem: github-actions
	directory: "/"
	schedule:
	interval: "monthly"
	groups:
	dependencies:
	patterns: [ "*" ]
	target-branch: "2.x"

	# The `2.26.x` maintenance branch only receives patch-level Maven updates.
	- package-ecosystem: maven
	directory: "/"
	schedule:
	interval: "monthly"
	cooldown:
	default-days: 7
	groups:
	# "Bump the Maven patch updates group across N directories with M updates"
	Maven patch updates:
	patterns: [ "*" ]
	target-branch: "2.26.x"
	registries:
	- maven-central
	ignore:
	# Only allow patch-level upgrades on this maintenance branch
	- dependency-name: "*"
	update-types:
	- "version-update:semver-major"
	- "version-update:semver-minor"

	- package-ecosystem: maven
	directory: "/"
	schedule:
	interval: "monthly"
	cooldown:
	default-days: 7
	groups:
	# Groups all non-major updates in a single PR.
	# No group matches major updates, so each one gets a separate PR.
	maven-minor-updates:
	update-types: [ "minor", "patch" ]
	target-branch: "main"
	registries:
	- maven-central
	ignore:
	# Keep Jakarta EE at version 9.0
	- dependency-name: "jakarta.platform:*"
	versions: [ "[10,)" ]
	# OpenRewrite is quite noisy. Let us skip patch and minor updates:
	- dependency-name: "org.openrewrite:*"
	update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
	- dependency-name: "org.openrewrite.maven:*"
	update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
	- dependency-name: "org.openrewrite.recipe:*"
	update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
	# Plexus Utils 4.x are for Maven 4.x
	- dependency-name: "org.codehaus.plexus:plexus-utils"
	versions: [ "[4,)" ]
	# Don't upgrade to 3.x
	- dependency-name: "org.apache.logging.log4j:log4j-api"
	versions: [ "[3,)" ]
	# The Console Appender only support JANSI 1.x for now
	# see https://github.com/apache/logging-log4j2/issues/1736
	- dependency-name: "org.fusesource.jansi:jansi"
	update-types: [ "version-update:semver-major" ]
	# WireMock 3.x requires Java 11 and Jakarta EE (Jetty 11)
	- dependency-name: "org.wiremock:*"
	versions: [ "[3,)" ]
	# WireMock changed its Group ID from com.github.tomakehurst to org.wiremock in v3.
	# We must also ignore the old Group ID so Dependabot doesn't try to auto-migrate it.
	- dependency-name: "com.github.tomakehurst:wiremock*"
	versions: [ "[3,)" ]

	- package-ecosystem: github-actions
	directory: "/"
	schedule:
	interval: "monthly"
	groups:
	dependencies:
	patterns: [ "*" ]
	target-branch: "main"

	- package-ecosystem: npm
	directory: "/"
	schedule:
	interval: "monthly"
	groups:
	dependencies:
	patterns: [ "*" ]
	target-branch: "main"