ascheman commented on code in PR #382:
URL:
https://github.com/apache/maven-clean-plugin/pull/382#discussion_r4458297818
##########
.github/dependabot.yml:
##########
@@ -40,6 +40,12 @@ updates:
# Mockito 5 requires Java 11; the build still runs on JDK 8
- dependency-name: "org.mockito:*"
versions: [">= 5.0.0"]
+ # Maven 3 line stays on Resolver 1.x (2.x is Maven 4)
+ - dependency-name: "org.apache.maven.resolver:*"
+ versions: [">= 2.0.0"]
Review Comment:
Follow-up: after settling the policy, I've narrowed the cap further — from
`>= 4.0.0` to `>= 3.11.0`. So instead of "block only Maven 4", the
core-artifact ignores now cap at the next minor: Dependabot keeps offering
3.10.x patches, but a Maven-baseline minor bump (a hypothetical 3.11) or the
jump to Maven 4 stays a deliberate decision. This matches the 3.9-line plugins,
which cap at `>= 3.10.0`. The same change is now out for jar
(apache/maven-jar-plugin#647) and source (apache/maven-source-plugin#364).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
