Skip to content

Bump org.apache.tomcat.embed:tomcat-embed-jasper from 9.0.122 to 9.0.123 - #239

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/org.apache.tomcat.embed-tomcat-embed-jasper-9.0.123
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/org.apache.tomcat.embed-tomcat-embed-jasper-9.0.123

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Bumps org.apache.tomcat.embed:tomcat-embed-jasper from 9.0.122 to 9.0.123.

@dependabot
dependabot Bot requested a review from jmanico as a code owner October 13, 2026 03:21
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 13, 2026
@dependabot
dependabot Bot requested a review from jeremylong as a code owner October 13, 2026 03:21
@dependabot dependabot Bot added the java Pull requests that update java code label Oct 13, 2026
jmanico added a commit that referenced this pull request Oct 14, 2026
Apply the patch release on each intended engine line: Tomcat 9.0 for the
javax encoder-jsp fixture and Tomcat 10.1 for the jakarta fixture.

This replaces #238 and #239, which moved the Jakarta fixture down to
9.0.123 because Dependabot classifies repeated coordinates from their
lowest version. Tomcat 9 cannot load jakarta JSP tags, so the packaged
Jakarta engine check failed.
jmanico added a commit that referenced this pull request Oct 14, 2026
Apply the patch release on each intended engine line: Tomcat 9.0 for the
javax encoder-jsp fixture and Tomcat 10.1 for the jakarta fixture.

This replaces #238 and #239, which moved the Jakarta fixture down to
9.0.123 because Dependabot classifies repeated coordinates from their
lowest version. Tomcat 9 cannot load jakarta JSP tags, so the packaged
Jakarta engine check failed.
Bumps org.apache.tomcat.embed:tomcat-embed-jasper from 9.0.122 to 9.0.123.

---
updated-dependencies:
- dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
  dependency-version: 9.0.123
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/org.apache.tomcat.embed-tomcat-embed-jasper-9.0.123 branch from 96b9f87 to 63ed213 Compare October 14, 2026 06:38
jmanico added a commit that referenced this pull request Oct 14, 2026
Apply the patch release on each intended engine line: Tomcat 9.0 for the
javax encoder-jsp fixture and Tomcat 10.1 for the jakarta fixture.

This replaces #238 and #239, which moved the Jakarta fixture down to
9.0.123 because Dependabot classifies repeated coordinates from their
lowest version. Tomcat 9 cannot load jakarta JSP tags, so the packaged
Jakarta engine check failed.
@jmanico

jmanico commented Oct 14, 2026

Copy link
Copy Markdown
Member

Superseded by #241.

@jmanico jmanico closed this Oct 14, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/maven/org.apache.tomcat.embed-tomcat-embed-jasper-9.0.123 branch October 14, 2026 06:42
jmanico added a commit that referenced this pull request Oct 14, 2026
jsp/ pins Tomcat 9.0 and jakarta/ pins Tomcat 10.1 under the same Jasper
and annotations API coordinates. The reactor scan combines repeated
coordinates from the lowest version, so it proposed 9.0.123 for both
modules (#238, #239) and broke the Jakarta engine.

The root entry now ignores both coordinates outright. New /jsp and
/jakarta entries allow only those coordinates and ignore major updates.
A module scan fetches the module and its parent POM but not siblings, so
each sees one engine line and proposes that line's patch as one grouped
pull request. A policy test ties the entries to the modules that pin
Tomcat and to each module's expected line.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant