This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 4c507382ee Fixed: Dependabot repeatedly reopening a commons-imaging
alpha-to-alpha bump
4c507382ee is described below
commit 4c507382eeb052663ec1b8b4e53d7ffbd0fa22d7
Author: Mridul Pathak <[email protected]>
AuthorDate: Sun Aug 30 12:24:58 2026 +0530
Fixed: Dependabot repeatedly reopening a commons-imaging alpha-to-alpha bump
commons-imaging has been alpha-only since 2019 (currently 1.0.0-alpha6,
spanning six years with no GA in sight), and its API changed starting with
1.0.0-alpha4 in a way that would require real adaptation work in OFBiz, so
we're deliberately staying pinned to 1.0-alpha3 until a stable 1.0.0 ships. The
existing dependabot.yml only ignores semver-major bumps, which doesn't catch
alpha-to-alpha updates within the nominal 1.0.0 line, so Dependabot kept
reopening PR #1116 proposing a bump t [...]
---
.github/dependabot.yml | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7de6169cbc..4c2c74e22b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,6 +33,14 @@ updates:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
+ # commons-imaging has been alpha-only since 2019 (alpha1..1.0.0-alpha6,
+ # see the version catalog comment) with no stable release in sight;
+ # we've deliberately deferred adapting to its post-alpha3 API changes
+ # until it ships an actual 1.0.0. This keeps Dependabot from reopening
+ # an alpha-to-alpha bump PR forever, while still surfacing a real 1.0.0
+ # (or later) release when one finally happens.
+ - dependency-name: "org.apache.commons:commons-imaging"
+ versions: ["< 1.0.0"]
- package-ecosystem: "gradle"
directory: "/"
@@ -48,6 +56,9 @@ updates:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
+ # See the same rule in the trunk gradle block above.
+ - dependency-name: "org.apache.commons:commons-imaging"
+ versions: ["< 1.0.0"]
- package-ecosystem: "npm"
directory: "themes/common-theme/webapp/common-theme/js"
