This is an automated email from the ASF dual-hosted git repository.
zyxxoo pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hugegraph.git
The following commit(s) were added to refs/heads/master by this push:
new 401e627c3 chore(ci): group Dependabot security updates (#3170)
401e627c3 is described below
commit 401e627c30a7a0e0db5548a9431b6acfe82e43a1
Author: imbajin <[email protected]>
AuthorDate: Tue Aug 25 15:48:57 2026 +0800
chore(ci): group Dependabot security updates (#3170)
- group Maven security updates by compatibility family
- cover all reactor and distribution manifests
- keep routine version update pull requests disabled
- leave repository settings and scan workflows unchanged
---
.github/dependabot.yml | 42 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..0a244a16b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,42 @@
+version: 2
+
+updates:
+ - package-ecosystem: "maven"
+ directories:
+ - "/"
+ - "/hugegraph-*"
+ - "/hugegraph-*/*"
+ - "/install-dist"
+ schedule:
+ interval: "weekly"
+ # Keep version updates disabled while retaining security updates.
+ open-pull-requests-limit: 0
+ groups:
+ jackson-security:
+ applies-to: "security-updates"
+ patterns:
+ - "com.fasterxml.jackson*"
+ grpc-protobuf-security:
+ applies-to: "security-updates"
+ patterns:
+ - "io.grpc:*"
+ - "com.google.protobuf:*"
+ logging-security:
+ applies-to: "security-updates"
+ patterns:
+ - "org.apache.logging.log4j:*"
+ - "org.slf4j:*"
+ - "ch.qos.logback:*"
+ spring-security:
+ applies-to: "security-updates"
+ patterns:
+ - "org.springframework*"
+ apache-commons-security:
+ applies-to: "security-updates"
+ patterns:
+ - "org.apache.commons:*"
+ - "commons-*:*"
+ other-security:
+ applies-to: "security-updates"
+ patterns:
+ - "*"
