[jira] [Created] (OFBIZ-13716) Allow Dependabot major-version updates for Gradle dependencies on trunk

["Mridul Pathak (Jira)" <ji...@apache.org>]

Mridul Pathak created OFBIZ-13716:
-------------------------------------

             Summary: Allow Dependabot major-version updates for Gradle dependencies on trunk
                 Key: OFBIZ-13716
                 URL: https://issues.apache.org/jira/browse/OFBIZ-13716
             Project: OFBiz
          Issue Type: Improvement
          Components: framework
    Affects Versions: Upcoming Branch
            Reporter: Mridul Pathak
            Assignee: Mridul Pathak


The trunk gradle entry in {{.github/dependabot.yml}} ignores every major-version update ({{dependency-name: "*"}}, {{update-types: version-update:semver-major}}). The rule was added in April to let the minor and patch updates catch up, which they now have. It also freezes libraries that don't follow semver, such as owasp-java-html-sanitizer (date-based versions, about 2.5 years behind), icu4j and libphonenumber, and it hides real migrations such as Tomcat 11, Jersey 4, Spring 7, Groovy 6 and Gradle 9. This was proposed on dev@ with no objections: https://lists.apache.org/thread/wcmpxgy3sln77f9rgx0sw3jq29d6zonx

h3. Proposed change
* Remove the semver-major ignore from the trunk gradle entry.
* Add explicit ignores for deliberate pins so they don't keep coming back:
** {{org.asciidoctor.jvm.convert}} and {{org.asciidoctor.jvm.pdf}}: only the pdf plugin has a 5.x release, because 5.x renamed the convert plugin, so a lone pdf bump would split the pair.
** {{org.activiti:activiti-juel-jakarta}} {{>= 9}}: 9.0.0 is compiled for Java 25, and trunk targets Java 17.
* Leave the release24.09 gradle entry unchanged. Major upgrades don't belong on a release branch.

Each major-version PR is then triaged on its own. Routine ones go through the normal Dependabot review, real migrations are handled one at a time, and any we defer get an explicit ignore entry.

h3. Acceptance criteria
* The trunk gradle entry no longer ignores {{version-update:semver-major}}.
* The asciidoctor and activiti-juel-jakarta ignores are present, each with a comment giving the reason.
* The release24.09 gradle entry is unchanged.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)