Merge pull request #685 from Azquelt/add-dependabot

Add dependabot configuration

Author: Azquelt

.github/dependabot.yml

@@ -0,0 +1,23 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "maven" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "jakarta.*" # Don't offer updates for new Jakarta EE spec versions
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: "org.eclipse.microprofile:microprofile-parent" # The major version of microprofile-parent is tied to the Jakarta EE version
+        update-types:
+          - version-update:semver-major
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

api/pom.xml

@@ -41,7 +41,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-checkstyle-plugin</artifactId>
-                    <version>3.2.1</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!-- https://github.com/checkstyle/checkstyle/issues/8240 -->
                         <excludes>**/module-info.java</excludes>

pom.xml

@@ -37,12 +37,12 @@
         <rest-assured.version>5.5.1</rest-assured.version>
         <hamcrest.version>3.0</hamcrest.version>
         <httpclient.version>4.5.14</httpclient.version>
-        <jackson.version>2.18.2</jackson.version>
+        <jackson.version>2.18.3</jackson.version>
         <mp.rest-client-api.version>4.0</mp.rest-client-api.version>
         <jakarta.xml.bind-api.version>3.0.1</jakarta.xml.bind-api.version>
         <jakarta.validation-api.version>3.0.2</jakarta.validation-api.version>
         <!-- We can use the 3.x TCK BOM even though we use the 2.x parent because we're targetting Java 11 -->
-        <version.microprofile.tck.bom>3.2</version.microprofile.tck.bom>
+        <version.microprofile.tck.bom>3.4</version.microprofile.tck.bom>
     </properties>
 
     <developers>