You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@activemq.apache.org by Jean-Baptiste Onofré <jb...@nanthrax.net> on 2026/09/10 17:37:08 UTC

Should we keep dependabot enabled on activemq-5.19.x branch?

Hi everyone,

A while ago, I configured Dependabot to run on the 5.19.x, 6.3.x, and
main branches.

Given the recent discussion regarding 5.19.x and the fact that we do
not plan to make new releases on the activemq-5.19.x branch (unless
requested by the community), I am wondering if we should keep
Dependabot enabled for it.

What are your thoughts?

Regards,
JB

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
For additional commands, e-mail: dev-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact

Re: Should we keep dependabot enabled on activemq-5.19.x branch?

Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
Great!

Thanks! I will create a PR to set Dependabot to run weekly on the
activemq-5.19.x branch.

Regards,
JB

On Thu, Sep 10, 2026 at 9:37 PM Matt Pavlovich <ma...@apache.org> wrote:
>
> 0h, yeah. I think less would be good. I’d be in favor of running it weekly. Have it run on Monday night or something and then it’s an easy pass Tuesday morning over coffee.
>
> I like the automated over manual, as it does bubble up things that become larger modernization effort— such as qdox EOL, etc.
>
> Thanks!
> Matt
>
> > On Sep 10, 2026, at 1:38 PM, Jean-Baptiste Onofré <jb...@nanthrax.net> wrote:
> >
> > My point was more to run dependabot on demand or less frequent in order to
> > reduce the number of PRs and so the number of GH action jobs.
> >
> >
> >
> > Le jeu. 10 sept. 2026 à 20:37, Christopher Shannon <
> > christopher.l.shannon@gmail.com> a écrit :
> >
> >> Hi JB,
> >>
> >> I believe the outcome of the discuss thread (and also what Matt sent
> >> out by email) was that the plan was to support it for another 6 months
> >> and to backport important fixes (like security issues) so we should
> >> probably keep it enabled.
> >>
> >> There needs to be at least more release done or sure to fix a couple
> >> regressions found with MQTT and the advisory support that was found,
> >> and given all the AI generated security reports that have hit the open
> >> source world over the last several months I'd expect more releases.
> >>
> >> I think we could turn down the frequency of the updates, maybe run it
> >> once a week or something like that. It makes sense to stay up to date
> >> though, the best we can, if we are going to run releases.
> >>
> >> Chris
> >>
> >>
> >> On Thu, Sep 10, 2026 at 1:37 PM Jean-Baptiste Onofré <jb...@nanthrax.net>
> >> wrote:
> >>>
> >>> Hi everyone,
> >>>
> >>> A while ago, I configured Dependabot to run on the 5.19.x, 6.3.x, and
> >>> main branches.
> >>>
> >>> Given the recent discussion regarding 5.19.x and the fact that we do
> >>> not plan to make new releases on the activemq-5.19.x branch (unless
> >>> requested by the community), I am wondering if we should keep
> >>> Dependabot enabled for it.
> >>>
> >>> What are your thoughts?
> >>>
> >>> Regards,
> >>> JB
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
> >>> For additional commands, e-mail: dev-help@activemq.apache.org
> >>> For further information, visit: https://activemq.apache.org/contact
> >>>
> >>>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
> >> For additional commands, e-mail: dev-help@activemq.apache.org
> >> For further information, visit: https://activemq.apache.org/contact
> >>
> >>
> >>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
> For additional commands, e-mail: dev-help@activemq.apache.org
> For further information, visit: https://activemq.apache.org/contact
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
For additional commands, e-mail: dev-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact

Re: Should we keep dependabot enabled on activemq-5.19.x branch?

Posted by Matt Pavlovich <ma...@apache.org>.
0h, yeah. I think less would be good. I’d be in favor of running it weekly. Have it run on Monday night or something and then it’s an easy pass Tuesday morning over coffee.

I like the automated over manual, as it does bubble up things that become larger modernization effort— such as qdox EOL, etc.

Thanks!
Matt

> On Sep 10, 2026, at 1:38 PM, Jean-Baptiste Onofré <jb...@nanthrax.net> wrote:
> 
> My point was more to run dependabot on demand or less frequent in order to
> reduce the number of PRs and so the number of GH action jobs.
> 
> 
> 
> Le jeu. 10 sept. 2026 à 20:37, Christopher Shannon <
> christopher.l.shannon@gmail.com> a écrit :
> 
>> Hi JB,
>> 
>> I believe the outcome of the discuss thread (and also what Matt sent
>> out by email) was that the plan was to support it for another 6 months
>> and to backport important fixes (like security issues) so we should
>> probably keep it enabled.
>> 
>> There needs to be at least more release done or sure to fix a couple
>> regressions found with MQTT and the advisory support that was found,
>> and given all the AI generated security reports that have hit the open
>> source world over the last several months I'd expect more releases.
>> 
>> I think we could turn down the frequency of the updates, maybe run it
>> once a week or something like that. It makes sense to stay up to date
>> though, the best we can, if we are going to run releases.
>> 
>> Chris
>> 
>> 
>> On Thu, Sep 10, 2026 at 1:37 PM Jean-Baptiste Onofré <jb...@nanthrax.net>
>> wrote:
>>> 
>>> Hi everyone,
>>> 
>>> A while ago, I configured Dependabot to run on the 5.19.x, 6.3.x, and
>>> main branches.
>>> 
>>> Given the recent discussion regarding 5.19.x and the fact that we do
>>> not plan to make new releases on the activemq-5.19.x branch (unless
>>> requested by the community), I am wondering if we should keep
>>> Dependabot enabled for it.
>>> 
>>> What are your thoughts?
>>> 
>>> Regards,
>>> JB
>>> 
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
>>> For additional commands, e-mail: dev-help@activemq.apache.org
>>> For further information, visit: https://activemq.apache.org/contact
>>> 
>>> 
>> 
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
>> For additional commands, e-mail: dev-help@activemq.apache.org
>> For further information, visit: https://activemq.apache.org/contact
>> 
>> 
>> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
For additional commands, e-mail: dev-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact

Re: Should we keep dependabot enabled on activemq-5.19.x branch?

Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
My point was more to run dependabot on demand or less frequent in order to
reduce the number of PRs and so the number of GH action jobs.



Le jeu. 10 sept. 2026 à 20:37, Christopher Shannon <
christopher.l.shannon@gmail.com> a écrit :

> Hi JB,
>
> I believe the outcome of the discuss thread (and also what Matt sent
> out by email) was that the plan was to support it for another 6 months
> and to backport important fixes (like security issues) so we should
> probably keep it enabled.
>
> There needs to be at least more release done or sure to fix a couple
> regressions found with MQTT and the advisory support that was found,
> and given all the AI generated security reports that have hit the open
> source world over the last several months I'd expect more releases.
>
> I think we could turn down the frequency of the updates, maybe run it
> once a week or something like that. It makes sense to stay up to date
> though, the best we can, if we are going to run releases.
>
> Chris
>
>
> On Thu, Sep 10, 2026 at 1:37 PM Jean-Baptiste Onofré <jb...@nanthrax.net>
> wrote:
> >
> > Hi everyone,
> >
> > A while ago, I configured Dependabot to run on the 5.19.x, 6.3.x, and
> > main branches.
> >
> > Given the recent discussion regarding 5.19.x and the fact that we do
> > not plan to make new releases on the activemq-5.19.x branch (unless
> > requested by the community), I am wondering if we should keep
> > Dependabot enabled for it.
> >
> > What are your thoughts?
> >
> > Regards,
> > JB
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
> > For additional commands, e-mail: dev-help@activemq.apache.org
> > For further information, visit: https://activemq.apache.org/contact
> >
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
> For additional commands, e-mail: dev-help@activemq.apache.org
> For further information, visit: https://activemq.apache.org/contact
>
>
>

Re: Should we keep dependabot enabled on activemq-5.19.x branch?

Posted by Christopher Shannon <ch...@gmail.com>.
Hi JB,

I believe the outcome of the discuss thread (and also what Matt sent
out by email) was that the plan was to support it for another 6 months
and to backport important fixes (like security issues) so we should
probably keep it enabled.

There needs to be at least more release done or sure to fix a couple
regressions found with MQTT and the advisory support that was found,
and given all the AI generated security reports that have hit the open
source world over the last several months I'd expect more releases.

I think we could turn down the frequency of the updates, maybe run it
once a week or something like that. It makes sense to stay up to date
though, the best we can, if we are going to run releases.

Chris


On Thu, Sep 10, 2026 at 1:37 PM Jean-Baptiste Onofré <jb...@nanthrax.net> wrote:
>
> Hi everyone,
>
> A while ago, I configured Dependabot to run on the 5.19.x, 6.3.x, and
> main branches.
>
> Given the recent discussion regarding 5.19.x and the fact that we do
> not plan to make new releases on the activemq-5.19.x branch (unless
> requested by the community), I am wondering if we should keep
> Dependabot enabled for it.
>
> What are your thoughts?
>
> Regards,
> JB
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
> For additional commands, e-mail: dev-help@activemq.apache.org
> For further information, visit: https://activemq.apache.org/contact
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
For additional commands, e-mail: dev-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact

Re: Should we keep dependabot enabled on activemq-5.19.x branch?

Posted by Matt Pavlovich <ma...@apache.org>.
Hey JB-

Good question and I think this can become basis for how we manage the tools for ‘active’ release series going forward.

I think we should keep dependabot running on 5.19.x until the announced end-of-active timeframe (End of Feb 27).

We recently had a hiccup where dependent was not running for a while and the work to play catchup was really rough. I’d rather merge a few dependabot PRs that may-or-not make it into a release vs trying to scramble to address 60 dependency updates if we decide we need to do a release. 

I suggest we follow the same pattern with 6.3.x. Once we release 6.4.0, we can decide on an EOA (end-of-active) timeframe for 6.3.x series and then on that date, we disable dependabot, GH workflows for that branch, and update website (move the release series to archives, etc).

My $0.02

Thanks,
Matt

> On Sep 10, 2026, at 12:37 PM, Jean-Baptiste Onofré <jb...@nanthrax.net> wrote:
> 
> Hi everyone,
> 
> A while ago, I configured Dependabot to run on the 5.19.x, 6.3.x, and
> main branches.
> 
> Given the recent discussion regarding 5.19.x and the fact that we do
> not plan to make new releases on the activemq-5.19.x branch (unless
> requested by the community), I am wondering if we should keep
> Dependabot enabled for it.
> 
> What are your thoughts?
> 
> Regards,
> JB
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
> For additional commands, e-mail: dev-help@activemq.apache.org
> For further information, visit: https://activemq.apache.org/contact
> 
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@activemq.apache.org
For additional commands, e-mail: dev-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact