gnodet-bot commented on code in PR #382:
URL:
https://github.com/apache/maven-clean-plugin/pull/382#discussion_r4386019227
##########
.github/dependabot.yml:
##########
@@ -40,6 +40,16 @@ updates:
# Mockito 5 requires Java 11; the build still runs on JDK 8
- dependency-name: "org.mockito:*"
versions: [">= 5.0.0"]
+ # Maven 3 line stays on Resolver 1.x (2.x is Maven 4)
+ - dependency-name: "org.apache.maven.resolver:*"
+ versions: [">= 2.0.0"]
Review Comment:
⚠️ The comment `# Maven 3 line stays on Resolver 1.x (2.x is Maven 4)` is
inaccurate: **Maven 3.10.0 ships Resolver 2.0.24** — Resolver 2.x is used by
both Maven 3.10 and Maven 4. The ignore entry may still be pragmatically
correct (the pom explicitly pins `maven-resolver-api` at `1.9.27`), but the
comment should explain *why* the explicit 1.x pin exists rather than stating a
falsehood. Consider updating the comment to clarify this is a deliberate choice
to keep the resolver at 1.x for compatibility, independently of what Maven 3.10
bundles — and also consider whether `mavenVersion=3.10.0` in the pom should be
accompanied by a matching Resolver 2.x dependency.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
