Repository navigation
Give each Tomcat JSP engine its own Dependabot scan - #242
Merged
Merged
Conversation
jsp/ pins Tomcat 9.0 and jakarta/ pins Tomcat 10.1 under the same Jasper and annotations API coordinates. The reactor scan combines repeated coordinates from the lowest version, so it proposed 9.0.123 for both modules (#238, #239) and broke the Jakarta engine. The root entry now ignores both coordinates outright. New /jsp and /jakarta entries allow only those coordinates and ignore major updates. A module scan fetches the module and its parent POM but not siblings, so each sees one engine line and proposes that line's patch as one grouped pull request. A policy test ties the entries to the modules that pin Tomcat and to each module's expected line.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
jsp/pins Tomcat 9.0 andjakarta/pins Tomcat 10.1 under the same Jasper and annotations API coordinates. The reactor scan from/combines repeated coordinates from the lowest version, so it proposed 9.0.123 for both modules in #238 and #239 and broke the Jakarta engine. No ignore rule on that scan can keep the two lines apart.This change:
/jspand/jakartaentries that allow only those two coordinates, ignore major updates and group them into one PR. A module scan fetches the module and its parent POM but not sibling modules, so each entry sees a single engine line. The root ignores everything these entries allow, so they don't bring back the duplicate PRs the reactor-once rule prevents.jakarta/POM moved down to 9.0.123.DEPENDENCY_DECISIONS.md, which previously listed these as manual-review updates.I ran the Dependabot CLI (v1.94.0) locally against a copy of this branch with the pre-#241 versions, 9.0.122 and 10.1.60:
jsp/pom.xmlandjakarta/pom.xml(reproduces #238/#239)/jspentryjsp/pom.xmlonly: Jasper and annotations API 9.0.123/jakartaentryjakarta/pom.xmlonly: Jasper and annotations API 10.1.61python3 -m unittest discover -s scripts/testspasses (36 tests), and the config validates against the SchemaStore Dependabot schema.