This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch feat/2.x/dependabot-2.25.x in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
commit 43f895e28738ac9efc890e7785605ba63392daba Author: Piotr P. Karwasz <[email protected]> AuthorDate: Wed Sep 2 22:36:17 2026 +0200 Add Dependabot configuration for `2.25.x` and rename update groups - Add a patch-only Maven entry for the `2.25.x` LTS branch. It uses a `yearly` schedule as a placeholder: updates are triggered manually. - Rename all update groups to `<ecosystem>-<level>-<branch>`, so that the target branch is visible in the title of Dependabot PRs. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01R7BoincUoL8YtZsf3xjvuf --- .github/dependabot.yaml | 45 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index 31bb293a59..721913acef 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -57,7 +57,8 @@ updates: groups: # Groups all non-major updates in a single PR. # No group matches major updates, so each one gets a separate PR. - maven-minor-updates: + # "Bump the maven-minor-2.x group across N directories with M updates" + maven-minor-2.x: update-types: [ "minor", "patch" ] target-branch: "2.x" registries: @@ -162,7 +163,8 @@ updates: groups: # Groups all non-major updates in a single PR. # No group matches major updates, so each one gets a separate PR. - maven-minor-updates: + # "Bump the maven-minor-2.x group in /log4j-mongodb4 with M updates" + maven-minor-2.x: update-types: [ "minor", "patch" ] target-branch: "2.x" registries: @@ -177,10 +179,34 @@ updates: schedule: interval: "monthly" groups: - dependencies: + # "Bump the actions-all-2.x group with M updates" + actions-all-2.x: patterns: [ "*" ] target-branch: "2.x" + # The `2.25.x` LTS branch only receives patch-level Maven updates. + # Dependabot is not expected to run on its own here: the `yearly` schedule is a placeholder + # and updates are triggered manually from the "Dependabot" tab of the "Insights" page. + - package-ecosystem: maven + directory: "/" + schedule: + interval: "yearly" + cooldown: + default-days: 7 + groups: + # "Bump the maven-patch-2.25.x group across N directories with M updates" + maven-patch-2.25.x: + patterns: [ "*" ] + target-branch: "2.25.x" + registries: + - maven-central + ignore: + # Only allow patch-level upgrades on this maintenance branch + - dependency-name: "*" + update-types: + - "version-update:semver-major" + - "version-update:semver-minor" + # The `2.26.x` maintenance branch only receives patch-level Maven updates. - package-ecosystem: maven directory: "/" @@ -189,8 +215,8 @@ updates: cooldown: default-days: 7 groups: - # "Bump the Maven patch updates group across N directories with M updates" - Maven patch updates: + # "Bump the maven-patch-2.26.x group across N directories with M updates" + maven-patch-2.26.x: patterns: [ "*" ] target-branch: "2.26.x" registries: @@ -211,7 +237,8 @@ updates: groups: # Groups all non-major updates in a single PR. # No group matches major updates, so each one gets a separate PR. - maven-minor-updates: + # "Bump the maven-minor-main group across N directories with M updates" + maven-minor-main: update-types: [ "minor", "patch" ] target-branch: "main" registries: @@ -250,7 +277,8 @@ updates: schedule: interval: "monthly" groups: - dependencies: + # "Bump the actions-all-main group with M updates" + actions-all-main: patterns: [ "*" ] target-branch: "main" @@ -259,6 +287,7 @@ updates: schedule: interval: "monthly" groups: - dependencies: + # "Bump the npm-all-main group with M updates" + npm-all-main: patterns: [ "*" ] target-branch: "main"
