From fcc25c9083c05c95138a00a6649cd64e103581dd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 7 Oct 2025 02:04:24 +0000
Subject: [PATCH 1/2] Bump the build-dependencies group across 1 directory with
 8 updates

Bumps the build-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| org.ow2.asm:asm | `9.8` | `9.9` |
| [org.asciidoctor:asciidoctorj-pdf](https://github.com/asciidoctor/asciidoctorj-pdf) | `2.3.19` | `2.3.20` |
| [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) | `3.6.1` | `3.6.2` |
| [org.apache.maven.enforcer:enforcer-api](https://github.com/apache/maven-enforcer) | `3.6.1` | `3.6.2` |
| [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) | `3.8.1` | `3.9.0` |
| [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.5.1` | `3.6.1` |
| [de.thetaphi:forbiddenapis](https://github.com/policeman-tools/forbidden-apis) | `3.9` | `3.10` |
| [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) | `0.23.1` | `0.24.1` |

Updates `org.ow2.asm:asm` from 9.8 to 9.9

Updates `org.asciidoctor:asciidoctorj-pdf` from 2.3.19 to 2.3.20
- [Release notes](https://github.com/asciidoctor/asciidoctorj-pdf/releases)
- [Changelog](https://github.com/asciidoctor/asciidoctorj-pdf/blob/main/CHANGELOG.adoc)
- [Commits](https://github.com/asciidoctor/asciidoctorj-pdf/compare/v2.3.19...v2.3.20)

Updates `org.apache.maven.plugins:maven-enforcer-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.6.1...enforcer-3.6.2)

Updates `org.apache.maven.enforcer:enforcer-api` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.6.1...enforcer-3.6.2)

Updates `org.apache.maven.plugins:maven-dependency-plugin` from 3.8.1 to 3.9.0
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases)
- [Commits](https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.8.1...maven-dependency-plugin-3.9.0)

Updates `org.codehaus.mojo:exec-maven-plugin` from 3.5.1 to 3.6.1
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases)
- [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/3.5.1...3.6.1)

Updates `de.thetaphi:forbiddenapis` from 3.9 to 3.10
- [Commits](https://github.com/policeman-tools/forbidden-apis/compare/3.9...3.10)

Updates `com.github.siom79.japicmp:japicmp-maven-plugin` from 0.23.1 to 0.24.1
- [Release notes](https://github.com/siom79/japicmp/releases)
- [Changelog](https://github.com/siom79/japicmp/blob/master/release.py)
- [Commits](https://github.com/siom79/japicmp/compare/japicmp-base-0.23.1...japicmp-base-0.24.1)

Updates `org.apache.maven.enforcer:enforcer-api` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.6.1...enforcer-3.6.2)

---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
  dependency-version: '9.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: build-dependencies
- dependency-name: org.asciidoctor:asciidoctorj-pdf
  dependency-version: 2.3.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: build-dependencies
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: build-dependencies
- dependency-name: org.apache.maven.enforcer:enforcer-api
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: build-dependencies
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
  dependency-version: 3.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: build-dependencies
- dependency-name: org.codehaus.mojo:exec-maven-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: build-dependencies
- dependency-name: de.thetaphi:forbiddenapis
  dependency-version: '3.10'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: build-dependencies
- dependency-name: com.github.siom79.japicmp:japicmp-maven-plugin
  dependency-version: 0.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: build-dependencies
- dependency-name: org.apache.maven.enforcer:enforcer-api
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: build-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index 37ee0a396e7..f7420ebc9d2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -271,9 +271,9 @@
         <!-- Plugin versions -->
         <version.clean.plugin>3.5.0</version.clean.plugin>
         <version.install.plugin>3.1.4</version.install.plugin>
-        <version.enforcer.plugin>3.6.1</version.enforcer.plugin>
+        <version.enforcer.plugin>3.6.2</version.enforcer.plugin>
         <version.project-info.plugin>3.9.0</version.project-info.plugin>
-        <version.japicmp.plugin>0.23.1</version.japicmp.plugin>
+        <version.japicmp.plugin>0.24.1</version.japicmp.plugin>
         <version.deploy.plugin>3.1.4</version.deploy.plugin>
         <version.flatten-maven-plugin>1.7.3</version.flatten-maven-plugin>
         <version.assembly.plugin>3.7.1</version.assembly.plugin>
@@ -281,11 +281,11 @@
         <version.checkstyle.plugin>3.6.0</version.checkstyle.plugin>
         <version.bundle.plugin>6.0.0</version.bundle.plugin>
         <version.compiler.plugin>3.14.1</version.compiler.plugin>
-        <version.dependency.plugin>3.8.1</version.dependency.plugin>
+        <version.dependency.plugin>3.9.0</version.dependency.plugin>
         <!-- Check dependencies for security vulnerabilities -->
         <version.dependency-check.plugin>12.1.6</version.dependency-check.plugin>
-        <version.exec.plugin>3.5.1</version.exec.plugin>
-        <version.forbiddenapis.plugin>3.9</version.forbiddenapis.plugin>
+        <version.exec.plugin>3.6.1</version.exec.plugin>
+        <version.forbiddenapis.plugin>3.10</version.forbiddenapis.plugin>
         <!-- Make sure that upgraded Jandex plugin aligns with the Jandex version imported from the ORM platform pom -->
         <version.jandex.plugin>3.5.0</version.jandex.plugin>
         <version.maven.injection.plugin>1.0.2</version.maven.injection.plugin>
@@ -298,7 +298,7 @@
         <version.source.plugin>3.3.1</version.source.plugin>
         <!-- Surefire versions are a minefield of bugs: be careful with upgrades -->
         <version.surefire.plugin>3.5.4</version.surefire.plugin>
-        <version.surefire.plugin.java-version.asm>9.8</version.surefire.plugin.java-version.asm>
+        <version.surefire.plugin.java-version.asm>9.9</version.surefire.plugin.java-version.asm>
         <version.jacoco.plugin>0.8.13</version.jacoco.plugin>
         <version.com.buschmais.jqassistant.plugin>2.7.1</version.com.buschmais.jqassistant.plugin>
         <version.moditect.plugin>1.3.0.Final</version.moditect.plugin>
@@ -360,7 +360,7 @@
         <version.org.hibernate.infra.hibernate-asciidoctor-theme>6.0.2.Final</version.org.hibernate.infra.hibernate-asciidoctor-theme>
         <version.org.hibernate.infra.hibernate-asciidoctor-extensions>3.2.0.Final</version.org.hibernate.infra.hibernate-asciidoctor-extensions>
         <version.org.asciidoctor.asciidoctorj>3.0.0</version.org.asciidoctor.asciidoctorj>
-        <version.org.asciidoctor.asciidoctorj-pdf>2.3.19</version.org.asciidoctor.asciidoctorj-pdf>
+        <version.org.asciidoctor.asciidoctorj-pdf>2.3.20</version.org.asciidoctor.asciidoctorj-pdf>
 
         <!--
             Defines what to do with dependency management section of the flattened pom.

From 5d049b52078571a9fecdf6baee6c6da98966de92 Mon Sep 17 00:00:00 2001
From: marko-bekhta <marko.prykladna@gmail.com>
Date: Tue, 7 Oct 2025 10:42:25 +0200
Subject: [PATCH 2/2] Limit JUnit updates to match ORM version

---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5a357119407..1cdb99f4565 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -133,6 +133,10 @@ updates:
       - dependency-name: "org.skyscreamer:jsonassert"
       - dependency-name: "org.eclipse.jdt:ecj"
         versions: [ "3.42.0", "3.43.0" ]
+      # We depend on the JUnit version in ORM, hence we cannot just bump to a next major/minor
+      - dependency-name: "org.junit:*"
+        update-types: [ "version-update:semver-minor", "version-update:semver-major" ]
+
   - package-ecosystem: "docker"
     registries:
       - dockerhub