[
https://issues.apache.org/jira/browse/KAFKA-21056?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134316#comment-18134316
]
Ralph Ursprung commented on KAFKA-21056:
----------------------------------------
[~muralibasani]: dependabot only creates the PRs automatically, you still
review & merge them manually (unless you set up some GitHub action to automate
that, which i have seen before on other FOSS projects, e.g. for minor/patch
bumps which build fine - but the standard is that you do this manually)
> migrate to gradle version catalog
> ---------------------------------
>
> Key: KAFKA-21056
> URL: https://issues.apache.org/jira/browse/KAFKA-21056
> Project: Kafka
> Issue Type: Improvement
> Reporter: Ralph Ursprung
> Priority: Minor
>
> the kafka project currently has its own custom
> [{{dependencies.gradle}}|https://github.com/apache/kafka/blob/trunk/gradle/dependencies.gradle]
> mechanism to manage dependency versions.
> gradle nowadays has a standard way of dealing with this, the [version
> catalog|https://docs.gradle.org/current/userguide/version_catalogs.html],
> which is also clearly listed as part of their [best
> practices|https://docs.gradle.org/current/userguide/best_practices_dependencies.html#use_version_catalogs].
> i'd suggest to migrate the custom handling to version catalogs as this is
> known to most standard tooling. you can then e.g. also enable GitHub
> Dependabot for automated dependency update PRs, since it supports the version
> catalog.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
