chore(deps): bump assertj across all eight smoke setups, and route them to develop - #517
Merged
Merged
Conversation
…em to develop Dependabot opened #514 against main. That is the divergence the maven block's target-branch exists to prevent: main is the release pointer, moved by fast-forwarding develop onto it, and a commit landing on main directly ends that. The cause is scope — scripts/release-smoke sits outside every directory the block lists, so updates for those poms arrived through the default branch instead. The directory list now covers them. #514 also bumped one project of eight. The smoke setups are deliberately identical consumers, differing only in which artifacts they depend on, so a version moving in one of them is drift rather than an upgrade. All eight go to 3.27.7 together, which is the version the engine itself already uses. Verified by running the smoke against the published 2.1.1 train: 8/8 pass.
DemchaAV
added a commit
that referenced
this pull request
Aug 5, 2026
The release-smoke note explained #514 landing on `main` as a consequence of those paths sitting outside every listed directory, which reads as though listing them stops it happening again. It does not: Dependabot raises security updates against the default branch whatever `target-branch` says, so the next advisory touching these manifests will open against `main` again. Records the rule and the handling it implies — close the PR and carry the bump to `develop`, as #517 did — plus the fact that a non-default `target-branch` also exempts security updates from the `labels` and `commit-message` settings. Also drops an inherited claim that the eight release-smoke projects are identical setups. They are deliberately different, one per published coordinate combination; only their test scaffolding matches, which is why a bump has to be applied eight times.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot opened #514 against
main. That is precisely the divergence the mavenblock's
target-branch: developexists to prevent — its own comment records it beingfixed in v1.6.8 "after the #111 / #115 episodes".
mainis the release pointer, moved byfast-forwarding
developonto it; a commit landing onmaindirectly ends that, and thenext
git push origin develop:mainstops being a fast-forward.The cause is scope, not the rule:
scripts/release-smoke/sits outside every directorythe block lists, so updates for those poms arrive through the default branch instead. The
commit-message prefix gives it away —
build(deps-dev)rather than the configureddeps.#514 also bumped one project of eight. The smoke setups are deliberately identical
consumers, differing only in which artifacts they depend on. A version moving in one of
them is drift, not an upgrade.
What
already uses.
/scripts/release-smoke/*, so the next updatefor them targets
developlike everything else.Tests
./mvnw -B -ntp clean verify→BUILD SUCCESS, anddependabot.ymlparses with bothentries still routed to
develop.The change is in the smoke projects themselves, so the meaningful check is the smoke:
run against the published 2.1.1 train with the bumped version — 8/8 pass.
On #514
It should be closed rather than merged or retargeted: retargeting would still leave one
project of eight moved, and this supersedes it with the uniform bump plus the config fix
that stops the next one arriving the same way.