dependabot.yml

---
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
    ignore:
      # Exclusions in this section have been triaged and determined to be
      # permanent. We do not anticipate removing exclusions from this section.

      # Provided by Jetty and should be aligned with the version provided by the
      # version of Jetty we deliver. See:
      # https://github.com/jenkinsci/jenkins/pull/5211
      - dependency-name: "jakarta.servlet:jakarta.servlet-api"

      # Jetty Maven Plugin and Winstone should be upgraded in lockstep in order
      # to keep their corresponding Jetty versions aligned.
      - dependency-name: "org.eclipse.jetty:jetty-maven-plugin"
      - dependency-name: "org.jenkins-ci:winstone"

      # Here lies technical debt. Exclusions in this section have been triaged
      # and determined to be temporary. Exclusions should be removed from this
      # section once the remaining action items have been completed.

      # Contains incompatible API changes and needs compatibility work.
      - dependency-name: "jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api"

      # Needs significant testing. See:
      # https://github.com/jenkinsci/jenkins/pull/5112#issuecomment-744429487
      # https://github.com/jenkinsci/jenkins/pull/5116#issuecomment-744526638
      - dependency-name: "org.codehaus.groovy:groovy-all"
        versions: [">=2.5.0"]

      # Consumed by Groovy and should be updated in lockstep with Groovy. See:
      # https://github.com/jenkinsci/jenkins/pull/5184
      - dependency-name: "org.fusesource.jansi:jansi"

      # Contains incompatible API changes and needs compatibility work. See:
      # https://github.com/jenkinsci/jenkins/pull/4224
      - dependency-name: "org.jfree:jfreechart"

      # Starting with 6.x, Spring requires Java 17 at a minimum.
      - dependency-name: "org.springframework:spring-framework-bom"
        versions: [">=6.0.0"]

      # Starting with 6.x, Spring Security requires Java 17 at a minimum.
      - dependency-name: "org.springframework.security:spring-security-bom"
        versions: [">=6.0.0"]
  - package-ecosystem: "maven"
    directory: "/"
    target-branch: "stable-2.375"
    labels:
      - "into-lts"
      - "needs-justification"
    schedule:
      interval: "daily"
    # Include only security updates and exclude version updates.
    open-pull-requests-limit: 0