chore(deps): block renovate noise on jakarta-migration + retired-project deps#319
Merged
bjagg merged 1 commit intouPortal-Project:masterfrom May 10, 2026
Conversation
…ect deps Problem: 5 renovate PRs are open against deps the portlet can't take — pluto-taglib v3 (Apache Pluto attic'd, no jakarta.portlet path), jaxb-xjc v4 (jakarta.xml.bind namespace), jaxen v2 (drops the Atlassian fork the parent has tracked for years). Two more dep families are coming via renovate eventually that are equally out-of-scope: JUnit 5 (Jupiter, when the parent's JUnit 4 line stops getting patches) and portletmvc4spring 6+ (Spring 6 + Jakarta + Java 17, milestone exists in Liferay git but not on Maven Central). Without explicit allowedVersions/enabled rules, renovate keeps re-opening these and reviewers keep re-closing them. Goal: encode the existing review decisions as packageRules so renovate stops surfacing them, with descriptions that capture *why* each is blocked so the policy survives reviewer changes. Changes: 5 new packageRules added to renovate.json: - pluto-taglib (and any org.apache.portals.pluto:* artifact) < 3.0: Apache Pluto Attic, no jakarta.portlet uPortal path. - jaxen:jaxen < 2.0: stay on Atlassian's 1.2.0-atlassian-2 fork (matches the existing fork-tracking convention with commons-lang and ehcache-spring-annotations). - org.junit.jupiter:* / org.junit.platform:* / org.junit:junit-bom enabled=false: project is JUnit 4.13.2 via parent, no migration scoped. - com.liferay.portletmvc4spring:* < 6.0: 6.0.0-M1 not on Maven Central + 3-stack migration (Spring 6 + Jakarta + Java 17). - Existing jaxb rule extended to also cover com.sun.xml.bind:jaxb-xjc alongside jaxb-impl, jakarta.xml.bind-api, and jaxb-runtime — the 4.x line for xjc is the same jakarta-namespace shift. Notes: skipped Hibernate (not a direct or surfaced transitive in this portlet's pom.xml). Open renovate PRs that this would have prevented: uPortal-Project#309 (jaxb-xjc v4), uPortal-Project#311 (jaxen v2), uPortal-Project#312 (pluto-taglib v3) — those can be closed once renovate re-evaluates against the new config.
This was referenced May 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
5 renovate PRs are open right now against deps this portlet can't take, and a couple more dep families are coming via renovate eventually that are equally out-of-scope. This PR encodes the existing review decisions as
packageRulesso they stop showing up.New rules:
org.apache.portals.pluto:*< 3.0— Apache Pluto is in the Attic; v3.x isjakarta.portlet. uPortal's embedded Pluto has no jakarta path. Closes Update dependency org.apache.portals.pluto:pluto-taglib to v3 #312 once renovate re-evaluates.jaxen:jaxen< 2.0— Stay on Atlassian's1.2.0-atlassian-2fork (matches the convention with commons-lang, ehcache-spring-annotations). Closes Update dependency jaxen:jaxen to v2 #311.org.junit.jupiter:*/org.junit.platform:*/org.junit:junit-bomenabled: false— Project is JUnit 4.13.2 via parent; CLAUDE.md / project policy says no Jupiter migration scoped.com.liferay.portletmvc4spring:*< 6.0— 6.0.0-M1 isn't on Maven Central + the upgrade is a three-stack migration (Spring 6 + Jakarta + Java 17).com.sun.xml.bind:jaxb-xjc— samejakarta.xml.bindnamespace shift at v4. Closes Update dependency com.sun.xml.bind:jaxb-xjc to v4 #309.Skipped: Hibernate (not a direct or surfaced transitive in this pom).
Test plan
python3 -c 'import json; json.load(open("renovate.json"))'— JSON syntax valid (verified locally)