Upgrade dependencies to latest stable versions - #1655
Conversation
7ad1b1b to
a9835cb
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
Dependency upgrades across core libraries (e.g., Jackson/gRPC/Protobuf) merit full CI + test execution to validate runtime compatibility beyond a compile-only build.
Pull request overview
This pull request updates Maven dependency version properties to newer stable releases and adjusts Dependabot configuration to group updates (patch vs minor) across multiple release branches.
Changes:
- Bump parent POM-managed versions (Spotless, Jackson, Protobuf Java Util, ClassGraph, gRPC).
- Bump impl module-managed versions (jackson-jq, a2a-java-sdk-client).
- Configure Dependabot grouping for patch/minor updates and limit open PRs per branch.
File summaries
| File | Description |
|---|---|
| pom.xml | Updates centrally-managed dependency/plugin version properties (Jackson, gRPC, Protobuf util, etc.). |
| impl/pom.xml | Updates impl module version properties for jackson-jq and a2a client SDK. |
| .github/dependabot.yml | Adds Dependabot grouping for patch/minor updates on main/4.x/5.x and caps open PRs. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
a9835cb to
0bb9538
Compare
|
Waiting for jackson-jq release so we can upgrade it too: |
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
Parent POM updates: - com.diffplug.spotless: 3.10.0 -> 3.10.1 - com.fasterxml.jackson: 2.22.1 -> 2.22.2 - com.google.protobuf.protobuf-java-util: 4.36.0 -> 4.36.1 - io.github.classgraph: 4.8.193 -> 4.8.194 - io.grpc.java: 1.83.1 -> 1.84.0 - com.networknt:json-schema-validator: 2.0.0 -> 2.0.7 Impl POM updates: - net.thisptr:jackson-jq: 1.6.2 -> 1.6.4 (includes Jandex 3.x support) - org.a2aproject.sdk:a2a-java-sdk-client: 1.2.0.Final -> 1.3.0.Final Dependabot configuration improvements: - Add grouping for patch and minor updates to reduce PR noise - Set open-pull-requests-limit to 10 per branch - Ignore major version updates (require manual review) - Groups related updates into single PRs for easier review Note on com.networknt upgrade: Version 3.x was skipped because it requires Jackson 3.x (tools.jackson.*) which would be a breaking change. Upgraded to 2.0.7 which uses Jackson 2.22.1 and is compatible with our current Jackson 2.22.2. Note on jackson-jq 1.6.4: This version includes Jandex 3.x support (via eiiches/jackson-jq#549), which eliminates Jandex reindexing warnings in Quarkus 3.x+ builds. Signed-off-by: Ricardo Zanini <ricardozanini@gmail.com>
0bb9538 to
3701f68
Compare
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
9690ad9
into
open-workflow-specification:main
Summary
This PR upgrades all dependencies to their latest stable versions (excluding alpha/beta/milestone releases).
Changes
Parent POM (
pom.xml)Impl POM (
impl/pom.xml)Dependabot Configuration (
.github/dependabot.yml)Improvements:
This addresses the issue where Dependabot was creating individual PRs for each dependency (e.g., PR #1631 for Jackson, PR #1641 for networknt), making it difficult to review and merge updates.
Testing
✅ Full build completed successfully:
All modules compiled without errors.
🎉 Notable Updates
⭐ jackson-jq 1.6.4
Before (1.6.2):
After (1.6.4): ✅ No warnings!
Jackson 2.22.2
gRPC 1.84.0
Why 2.0.7 and not 3.0.7?
Version 3.x introduces a breaking change - it requires Jackson 3.x (
tools.jackson.*package namespace instead ofcom.fasterxml.jackson.*).Upgrading to 3.0.7 would require:
What we did:
Future work:
Excluded from this PR
The following updates were excluded:
com.networknt3.x versions (requires Jackson 3.x migration - breaking change)Supersedes
This PR consolidates and updates: