|
| 1 | +version: 2 |
| 2 | +registries: |
| 3 | + gradle-plugin-portal: |
| 4 | + type: maven-repository |
| 5 | + url: https://plugins.gradle.org/m2 |
| 6 | + username: dummy # Required by dependabot |
| 7 | + password: dummy # Required by dependabot |
| 8 | +updates: |
| 9 | + - package-ecosystem: github-actions |
| 10 | + directory: "/" |
| 11 | + schedule: |
| 12 | + interval: monthly |
| 13 | + groups: |
| 14 | + workflow-actions: |
| 15 | + patterns: |
| 16 | + - "*" |
| 17 | + allow: |
| 18 | + - dependency-name: "actions/*" |
| 19 | + - dependency-name: "redhat-actions/*" |
| 20 | + - package-ecosystem: "gradle" |
| 21 | + directory: "/" |
| 22 | + registries: |
| 23 | + - gradle-plugin-portal |
| 24 | + schedule: |
| 25 | + interval: "weekly" |
| 26 | + day: "wednesday" |
| 27 | + open-pull-requests-limit: 20 |
| 28 | + groups: |
| 29 | + # These are used in tooling we publish (Gradle, Ant, Maven plugins) |
| 30 | + # and thus must be treated as runtime dependencies, |
| 31 | + # which cannot be included in the build-dependencies group below. |
| 32 | + tooling-dependencies: |
| 33 | + patterns: |
| 34 | + # Note: Gradle tooling dependencies seem to be tied to the version of Gradle we use for building. |
| 35 | + - "org.apache.ant*" |
| 36 | + - "org.apache.maven:maven-plugin-api" |
| 37 | + - "org.apache.maven:maven-project" |
| 38 | + - "org.apache.maven.shared:file-management" |
| 39 | + - "org.apache.maven.plugin-tools:maven-plugin-annotations" |
| 40 | + # This group combines all build-only dependencies. Published artifacts do not depend on them. |
| 41 | + # Grouping such dependencies will make Dependabot create PRs with a branch name |
| 42 | + # following the pattern (`dependabot/maven/build-dependencies-.*`) |
| 43 | + # and with a title like `Bump the build-dependencies group with 8 updates` that we can easily |
| 44 | + # use for Hibernate Bot rules. |
| 45 | + build-dependencies: |
| 46 | + patterns: |
| 47 | + # Gradle plugins: |
| 48 | + - "com.gradle*" |
| 49 | + - "org.moditect*" |
| 50 | + - "de.thetaphi*" |
| 51 | + - "org.gradlex*" |
| 52 | + - "org.hibernate.build*" |
| 53 | + - "org.hibernate.orm.build*" |
| 54 | + - "org.hibernate.orm.database-service*" |
| 55 | + - "org.hibernate.orm.antlr*" |
| 56 | + - "io.github.gradle-nexus*" |
| 57 | + - "biz.aQute.bnd*" |
| 58 | + - "org.checkerframework*" |
| 59 | + - "org.jetbrains.gradle*" |
| 60 | + - "com.dorongold*" |
| 61 | + - "org.asciidoctor*" |
| 62 | + - "com.diffplug.spotless*" |
| 63 | + # Local build plugin dependencies: |
| 64 | + - "org.apache.maven*" |
| 65 | + - "org.apache.httpcomponents*" |
| 66 | + # DB drivers: |
| 67 | + - "com.h2database:h2" |
| 68 | + - "org.orbisgis:h2gis" |
| 69 | + - "org.hsqldb:hsqldb" |
| 70 | + - "org.apache.derby*" |
| 71 | + - "org.postgresql:*" |
| 72 | + - "com.enterprisedb:*" |
| 73 | + - "com.mysql:mysql-connector-j" |
| 74 | + - "org.mariadb.jdbc:mariadb-java-client" |
| 75 | + - "com.oracle.database.*" |
| 76 | + - "com.microsoft.sqlserver:mssql-jdbc" |
| 77 | + - "com.ibm.db2:jcc" |
| 78 | + - "com.sap.cloud.db.jdbc:ngdbc" |
| 79 | + - "net.sourceforge.jtds:jtds" |
| 80 | + - "com.ibm.informix:jdbc" |
| 81 | + - "org.firebirdsql.jdbc:jaybird" |
| 82 | + - "com.altibase:altibase-jdbc" |
| 83 | + # Other test dependencies |
| 84 | + - "org.apache.groovy:groovy-jsr223" # used for scripting maven plugin |
| 85 | + - "org.apache.commons:commons-lang3" # used in hibernate-search-util-common tests |
| 86 | + - "org.apache.commons:commons-math3" # used to solve dependency convergence for Wiremock |
| 87 | + - "org.openjdk.jmh:*" # performance testing dependency |
| 88 | + - "com.google.guava:guava" # Guava is used in our test utils |
| 89 | + - "org.asciidoctor:*" # Asciidoctor is used for rendering the documentation |
| 90 | + - "org.jboss.marshalling:jboss-marshalling" # JBeret IT dependency |
| 91 | + - "org.wildfly.security:wildfly-security-manager" # JBeret IT dependency |
| 92 | + - "org.springframework.boot:*" # Spring is only for ITs |
| 93 | + - "io.agroal:agroal-spring-boot-starter" # part of Spring dependencies, is only for ITs |
| 94 | + - "dev.snowdrop:narayana-spring-boot-starter" # part of Spring dependencies, is only for ITs |
| 95 | + - "org.mockito:*" |
| 96 | + - "org.hamcrest:*" |
| 97 | + - "org.apache.logging.log4j:*" |
| 98 | + - "org.assertj:*" |
| 99 | + - "org.jsoup:*" |
| 100 | + - "org.junit*" |
| 101 | + - "org.jboss.weld.se:*" |
| 102 | + - "org.jboss.narayana.*:*" |
| 103 | + - "org.wildfly.transaction:*" |
| 104 | + - "org.jboss:jboss-transaction-spi" |
| 105 | + - "org.jboss.shrinkwrap*" |
| 106 | + - "org.jboss.byteman*" |
| 107 | + hibernate: |
| 108 | + patterns: |
| 109 | + - "org.hibernate*" |
| 110 | + jakarta: |
| 111 | + patterns: |
| 112 | + - "jakarta.*" |
| 113 | + - "org.glassfish*" |
| 114 | + - "org.eclipse:yasson" |
| 115 | + ignore: |
| 116 | + # Avoid non-patch updates for complex dependencies and their implementation, even if we only use them for tests. |
| 117 | + - dependency-name: "org.hibernate*" |
| 118 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 119 | + - dependency-name: "jakarta.*" |
| 120 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 121 | + - dependency-name: "org.jboss.narayana*" |
| 122 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 123 | + - dependency-name: "org.jboss.weld*" |
| 124 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 125 | + - dependency-name: "org.wildfly*" |
| 126 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 127 | + - dependency-name: "org.glassfish*" |
| 128 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 129 | + - dependency-name: "org.eclipse:yasson" |
| 130 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 131 | + - dependency-name: "org.apache.maven*" |
| 132 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 133 | + - dependency-name: "org.apache.ant*" |
| 134 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 135 | + # Avoid non-patch updates for JUnit, because it is exposed in hibernate-testing, |
| 136 | + # which contains @BytecodeEnhanced, which is very sensitive to internal changes in JUnit. |
| 137 | + - dependency-name: "org.junit*" |
| 138 | + update-types: ["version-update:semver-major", "version-update:semver-minor"] |
| 139 | + # Sticking to SLF4J 1.x for now since later versions require upgrading providers |
| 140 | + # (Log4j, ... see https://www.slf4j.org/faq.html#changesInVersion200), |
| 141 | + # and also because we only need this dependency for Maven, |
| 142 | + # which is currently still on SLF4J 1.x |
| 143 | + # (see https://central.sonatype.com/artifact/org.apache.maven/maven-embedder/3.9.9/dependencies) |
| 144 | + - dependency-name: "org.slf4j:*" |
| 145 | + update-types: ["version-update:semver-major"] |
0 commit comments