From 00640bded6e002c2832fc45c87622d406267cf4e Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 10:45:05 -0400 Subject: [PATCH 1/4] Add Dependabot config for weekly Gradle updates Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Jon Bartels --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..e07581508 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "gradle" + directory: "/" + schedule: + interval: "weekly" From 2431eba50a6bc5e68756d197f707d88833e762a2 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 10:48:16 -0400 Subject: [PATCH 2/4] Run Dependabot Gradle updates monthly instead of weekly Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Jon Bartels --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e07581508..dfa800a18 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,4 +3,4 @@ updates: - package-ecosystem: "gradle" directory: "/" schedule: - interval: "weekly" + interval: "monthly" From c6c59a275a80c4f1282ff8ddf7855afa4298ade2 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 10:59:23 -0400 Subject: [PATCH 3/4] Add Docker updates, cooldown, and grouping to Dependabot config Scan Dockerfile in addition to Gradle, require a 2-day minimum age (cooldown) before opening PRs, and group updates by coherent project family to reduce PR noise. Groups are keyed deep enough to keep unrelated org.apache.* projects (commons, log4j, ...) separate. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Jon Bartels --- .github/dependabot.yml | 71 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dfa800a18..74f6080ab 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,74 @@ updates: directory: "/" schedule: interval: "monthly" + # Wait 2 days after a release before opening a PR, to skip yanked/broken versions. + cooldown: + default-days: 2 + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "java" + commit-message: + prefix: "chore(deps)" + include: "scope" + # Groups are keyed at the coherent-project level. Note e.g. org.apache.* is NOT a + # single project — org.apache.commons, org.apache.logging.log4j, org.apache.pdfbox, + # etc. are unrelated and must not be bundled together, so patterns go three levels deep. + groups: + aws-sdk: + patterns: + - "software.amazon.awssdk:*" + - "software.amazon.eventstream:*" + jetty: + patterns: + - "org.eclipse.jetty*" + jersey: + patterns: + - "org.glassfish.jersey*" + - "org.glassfish.hk2*" + jackson: + patterns: + - "com.fasterxml.jackson*" + netty: + patterns: + - "io.netty*" + - "com.typesafe.netty*" + log4j: + patterns: + - "org.apache.logging.log4j*" + apache-commons: + patterns: + - "org.apache.commons:*" + - "commons-*:*" + test-tooling: + patterns: + - "org.mockito*" + - "net.bytebuddy*" + - "org.objenesis:*" + - "org.hamcrest:*" + - "junit:*" + # Everything else: bundle only minor/patch so major bumps still arrive as + # individual PRs that get reviewed on their own. + all-minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 2 + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "docker" + commit-message: + prefix: "chore(docker)" + groups: + docker-base-images: + patterns: + - "*" From 116e5d517b089d3d050246847a88c05ee478eb57 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 12:02:38 -0400 Subject: [PATCH 4/4] Removed cooldown, default is 3 days Signed-off-by: Jon Bartels --- .github/dependabot.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 74f6080ab..616dce695 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,9 +4,6 @@ updates: directory: "/" schedule: interval: "monthly" - # Wait 2 days after a release before opening a PR, to skip yanked/broken versions. - cooldown: - default-days: 2 open-pull-requests-limit: 10 labels: - "dependencies" @@ -63,8 +60,6 @@ updates: directory: "/" schedule: interval: "monthly" - cooldown: - default-days: 2 open-pull-requests-limit: 5 labels: - "dependencies"