owasp-java-encoder/.github/dependabot.yml at main · OWASP/owasp-java-encoder · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
version: 2
updates:
  - package-ecosystem: maven
    # The root scan covers every module in the Maven reactor. Keep only
    # standalone Maven projects as additional directories so Dependabot does
    # not open duplicate pull requests for reactor dependencies.
    directories:
      - /
      - /compatibility/dependencies
    schedule:
      interval: weekly
      day: monday
      time: '09:00'
      timezone: Etc/UTC
    open-pull-requests-limit: 5
    groups:
      maven-dependencies:
        applies-to: version-updates
        patterns: ['*']
        # These need individual compatibility review, not a mixed version PR.
        # Group exclusions do not ignore updates or suppress security proposals.
        # Rationale and revisit conditions: DEPENDENCY_DECISIONS.md.
        exclude-patterns:
          - org.apache.felix:maven-bundle-plugin
          - com.puppycrawl.tools:checkstyle
          - org.codehaus.plexus:plexus-utils
          - javax.servlet.jsp:javax.servlet.jsp-api
          - javax.servlet:javax.servlet-api
          - javax.el:javax.el-api
          - jakarta.servlet.jsp:jakarta.servlet.jsp-api
          - jakarta.servlet:jakarta.servlet-api
          - jakarta.el:jakarta.el-api
          # The wrapper's Maven version is a separately reviewed toolchain change.
          - org.apache.maven:apache-maven
      maven-security:
        applies-to: security-updates
        patterns: ['*']
    # Suppress only the routine SemVer update classes already rejected by the
    # documented compatibility review. GitHub applies update-types only to
    # version updates, so security updates remain eligible. Dependabot combines
    # repeated Maven coordinates from their lowest version; for mixed historical
    # and current inputs, routine current-line updates therefore require manual
    # review while these rules are active.
    #
    # The unqualified Felix rule predates these scoped rules: 5.6.12 is the
    # intentional OSGi R6/Java 8 execution fixture. Review any alert against its
    # actual test scope; never dismiss or upgrade it blindly.
    ignore:
      - dependency-name: org.apache.felix:org.apache.felix.framework
      - dependency-name: com.puppycrawl.tools:checkstyle
        update-types:
          - version-update:semver-major
      - dependency-name: org.codehaus.plexus:plexus-utils
        update-types:
          - version-update:semver-major
      - dependency-name: javax.servlet.jsp:javax.servlet.jsp-api
        update-types:
          - version-update:semver-minor
          - version-update:semver-major
      - dependency-name: javax.servlet:javax.servlet-api
        update-types:
          - version-update:semver-minor
          - version-update:semver-major
      - dependency-name: javax.el:javax.el-api
        update-types:
          - version-update:semver-minor
          - version-update:semver-major
      - dependency-name: jakarta.servlet.jsp:jakarta.servlet.jsp-api
        update-types:
          - version-update:semver-minor
          - version-update:semver-major
      - dependency-name: jakarta.servlet:jakarta.servlet-api
        update-types:
          - version-update:semver-minor
          - version-update:semver-major
      - dependency-name: jakarta.el:jakarta.el-api
        update-types:
          - version-update:semver-minor
          - version-update:semver-major
      # The JSP engine fixtures pin Tomcat 9.0 in jsp/ and 10.1 in jakarta/
      # under the same coordinates. This scan would combine them from 9.0 and
      # write that line's release into both modules, so the /jsp and /jakarta
      # entries below own these coordinates instead.
      - dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
      - dependency-name: org.apache.tomcat:tomcat-annotations-api
  # Each JSP engine fixture gets its own scan, limited to Tomcat. A module scan
  # reads the module and its parent POM but not sibling modules, so it sees one
  # engine line and proposes that line's patch release. Major updates would
  # replace the engine; see DEPENDENCY_DECISIONS.md.
  - package-ecosystem: maven
    directory: /jsp
    schedule:
      interval: weekly
      day: monday
      time: '09:00'
      timezone: Etc/UTC
    open-pull-requests-limit: 1
    allow:
      - dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
      - dependency-name: org.apache.tomcat:tomcat-annotations-api
    groups:
      tomcat-9-jsp-engine:
        patterns: ['*']
    ignore:
      - dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
        update-types:
          - version-update:semver-major
      - dependency-name: org.apache.tomcat:tomcat-annotations-api
        update-types:
          - version-update:semver-major
  - package-ecosystem: maven
    directory: /jakarta
    schedule:
      interval: weekly
      day: monday
      time: '09:00'
      timezone: Etc/UTC
    open-pull-requests-limit: 1
    allow:
      - dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
      - dependency-name: org.apache.tomcat:tomcat-annotations-api
    groups:
      tomcat-10-jakarta-engine:
        patterns: ['*']
    ignore:
      - dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
        update-types:
          - version-update:semver-major
      - dependency-name: org.apache.tomcat:tomcat-annotations-api
        update-types:
          - version-update:semver-major
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: monday
      time: '09:00'
      timezone: Etc/UTC
    open-pull-requests-limit: 3
    groups:
      actions:
        patterns: ['*']