This is an automated email from the ASF dual-hosted git repository.
FrankChen021 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new dc77ea95e73 ci: run Maven Dependabot updates weekly and group them
(#20733)
dc77ea95e73 is described below
commit dc77ea95e7337bca1e598122542a4c648cda259b
Author: Andreas Maechler <[email protected]>
AuthorDate: Tue Oct 27 20:23:08 2026 -0600
ci: run Maven Dependabot updates weekly and group them (#20733)
* Run Maven Dependabot updates weekly and group them
Maven version updates now run once a week instead of daily. All minor
and patch updates go into one grouped PR; major updates still get one
PR each. Security updates are grouped per ecosystem (Maven, website,
web-console, GitHub Actions), with zstd-jni kept out of the Maven
security group.
* Group npm security updates across website and web-console
Merge the two npm entries into one with `directories`, so a security fix
for a package used in both directories opens one PR instead of two.
Explain why zstd-jni is kept out of the Maven security group.
* Drop the maven-resolver Dependabot group
All org.apache.maven.resolver artifacts share the maven.resolver.version
property, so Dependabot already bumps them together in one PR, and their
minor and patch updates now go into maven-minor-patch.
---
.github/dependabot.yml | 47 ++++++++++++++++++++++++++---------------------
1 file changed, 26 insertions(+), 21 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ba8fd0988f2..988025ad9d4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,7 +3,7 @@ updates:
- package-ecosystem: "maven"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
open-pull-requests-limit: 20
cooldown:
# Protect against not-yet-discovered regressions or security issues in
new releases of dependencies
@@ -12,14 +12,20 @@ updates:
commit-message:
prefix: "build"
include: "scope"
+ # Major version updates match no group, so each one still gets its own PR.
groups:
- # The individual org.apache.maven.resolver:* artifacts must move
together: they are all
- # pinned to the same version in services/pom.xml and server/pom.xml, and
a 1.x -> 2.x major
- # bump also requires coordinated source/bootstrap changes in
PullDependencies (see the
- # 2.0.23 upgrade PR). A single-artifact bump breaks the build with a
mixed 1.x/2.x graph.
- maven-resolver:
+ maven-minor-patch:
+ update-types: ["minor", "patch"]
+ patterns:
+ - "*"
+ # Security updates skip the schedule and cooldown; batch them so an
advisory burst opens one PR.
+ maven-security:
+ applies-to: security-updates
patterns:
- - "org.apache.maven.resolver:*"
+ - "*"
+ # zstd-jni fixes need manual review (see its ignore entry), so they
must not hold up the other security updates.
+ exclude-patterns:
+ - "com.github.luben:zstd-jni"
ignore:
# zstd-jni 1.5.7-13 and later cannot decode legacy (pre-1.0) zstd frames
in .zst batch input.
# Version updates are ignored; security updates still open PRs.
@@ -44,21 +50,11 @@ updates:
- dependency-name: "com.google.inject.extensions:*"
update-types: ["version-update:semver-major"]
- # Don't run dependabot on website
+ # Security updates only for website and web-console: every version update is
ignored.
- package-ecosystem: "npm"
- directory: "/website/"
- schedule:
- interval: "weekly"
- commit-message:
- prefix: "build"
- include: "scope"
- ignore:
- - dependency-name: "*"
- update-types: ["version-update:semver-patch",
"version-update:semver-minor", "version-update:semver-major"]
-
- # Don't run dependabot on web-console
- - package-ecosystem: "npm"
- directory: "/web-console/"
+ directories:
+ - "/website/"
+ - "/web-console/"
schedule:
interval: "weekly"
commit-message:
@@ -67,6 +63,11 @@ updates:
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-patch",
"version-update:semver-minor", "version-update:semver-major"]
+ groups:
+ npm-security:
+ applies-to: security-updates
+ patterns:
+ - "*"
- package-ecosystem: "github-actions"
directory: "/"
@@ -80,3 +81,7 @@ updates:
github-actions:
patterns:
- "*"
+ github-actions-security:
+ applies-to: security-updates
+ patterns:
+ - "*"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
