Using Dependabot to keep Maven dependencies up-to-date

[jonkoops]

We can use Dependabot to keep packages we use updated to the latest versions. This will ensure that we can do timely updates for our dependencies without having to make massive PRs that update all of them together at the same time.

[stianst]

That's not possible I'm afraid for two reasons:

• We inherit a lot of dependencies directly from WildFly or Quarkus, and in most cases do not want to override those versions, but rather upgrade WildFly/Quarkus
• Dependabot doesn't actually catch all CVEs (@abstractj can confirm this), and we're looking into better options with regard to dependency scanning

[jonkoops]

We inherit a lot of dependencies directly from WildFly or Quarkus, and in most cases do not want to override those versions, but rather upgrade WildFly/Quarkus

We could blacklist those specific dependencies so that they are not upgraded automatically (note that a Dependabot PR will still have to go through the regular approval process). If these dependencies are shared between our project and WildFly/Quarkus do we really need to list them? Will they not get included simply because we have a direct dependency on a specific version of WildFly/Quarkus?

Dependabot doesn't actually catch all CVEs (@abstractj can confirm this), and we're looking into better options with regard to dependency scanning

Although a valid point I would consider CVE scanning to be a separate concern from providing PRs to update to the latest version of a given dependency. Although admittedly it would be nice to have a tool that does both.

[walterTyro]

I was looking at making some PRs based on updating dependencies that are having CVE issues reported by Sonatype CLM. We use sonatype for eve scanning and dependabot for version updating at my work. Besides not upgrading quarkus/wildfly dependencies directly are there any other restrictions I should be aware of?

Dependabot might still be a viable option btw as each upgrade is a separate PR and you can choose to ignore. Not sure if you can configure dependant to ignore certain libraries as I didn't set up our CICD or configure.

Also if Im doing these version changes as a PR do I need to limit to one dependency per PR (if Possible)? or can I submit multiple as a single PR?

[jonkoops]

Not sure if you can configure dependant to ignore certain libraries as I didn't set up our CICD or configure.

You can actually, there is an ignore option that can be set to ignore specific packages.

Also if Im doing these version changes as a PR do I need to limit to one dependency per PR (if Possible)? or can I submit multiple as a single PR?

I would say if they are security issues that need to be resolved that you should follow our security policy.