Skip to content

Commit 8908092

Browse files
authored
Fix duplicate Dependabot PRs (#3367)
Since Dependabot cannot handle multiple versions of the same artifact at once, our Dependabot configuration for `2.x` is split into two runs: - One Dependabot run handles the dependency upgrades for the `log4j-slf4j-impl` (based on SLF4J 1.x) and `log4j-mongodb4` (based on MongoDB client 4.x). - A second Dependabot run handles the dependency upgrades for the remaining modules (which use SLF4J 2.x and MongoDB client 5.x). Unfortunately, due to the way Maven multi-module support is implemented in Dependabot (see dependabot/dependabot-core#222), the second Dependabot configuration also tries to upgrade the dependencies of `log4j-slf4j-impl` and `log4j-mongodb4`. This is due to the inclusion of the aggregator POM `/pom.xml`, which causes Dependabot to also include all the remaining Log4j modules. The easiest solution to this problem is to remove "/" from the second configuration. Pros: - 99% of our managed dependencies are in "/log4j-parent" or the individual modules, so we will not miss many upgrades. - No more duplicate PRs. Cons: - "pom.xml" contains some dummy managed dependencies to upgrade the version number of `commons-csv` and similar artifacts for **site-only** purposes. IMHO we should find a different way to upgrade these.
1 parent e99f1cb commit 8908092

File tree

1 file changed

+0
-5
lines changed

1 file changed

+0
-5
lines changed

.github/dependabot.yaml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ updates:
4545

4646
- package-ecosystem: maven
4747
directories:
48-
- "/"
4948
- "/log4j-1.2-api"
5049
- "/log4j-api-test"
5150
- "/log4j-api"
@@ -164,7 +163,6 @@ updates:
164163
- package-ecosystem: maven
165164
directories:
166165
- "/log4j-mongodb4"
167-
- "/log4j-slf4j-impl"
168166
open-pull-requests-limit: 10
169167
schedule:
170168
interval: "daily"
@@ -175,9 +173,6 @@ updates:
175173
# MongoDB 4.x should only upgrade to 4.x
176174
- dependency-name: "org.mongodb:*"
177175
versions: [ "[5,)" ]
178-
# SLF4J 1.7.x should only upgrade to 1.7.x and
179-
- dependency-name: "org.slf4j:slf4j-api"
180-
versions: [ "[1,)" ]
181176

182177
- package-ecosystem: github-actions
183178
directory: "/"

0 commit comments

Comments
 (0)