slachiewicz opened a new issue, #623:
URL: https://github.com/apache/maven-parent/issues/623
Maven 3 exports `slf4j-api` 1.7.x to plugins and extensions, so components
that run inside Maven 3 stay on SLF4J 1.7.x. Dependabot keeps proposing 2.x
upgrades for them, for example apache/maven-jar-plugin#632 and
apache/maven-deploy-plugin#724. An `@dependabot ignore` comment covers only the
update entry that raised the PR, and Dependabot reads its config only from the
default branch, so each `maven` update entry in `.github/dependabot.yml` needs
the rule:
```yaml
# Maven 3 so use SLF4J 1.7.x
- dependency-name: "org.slf4j:*"
versions: [">= 2.0.0"]
```
Scope: repositories whose default branch targets Maven 3.x and declares an
`org.slf4j` artifact, including `target-branch` entries for 3.x maintenance
lines. Entries that target a Maven 4 line (`*-4.x`) are left alone, since Maven
4 ships SLF4J 2.x.
Not covered here, because the default branch is already on SLF4J 2.x and an
ignore would freeze it:
- maven-pmd-plugin: `slf4jVersion` 2.0.19 (compile scope).
- maven-clean-plugin: `slf4j-simple` 2.0.20 (test scope), next to an
existing ignore.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
