Skip to content

Commit 2f608ee

Browse files
KehrlannKehrlann
committed
Update dependency policy
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
1 parent b5bbbb5 commit 2f608ee

2 files changed

Lines changed: 104 additions & 39 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 90 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,92 @@
11
version: 2
22
updates:
3-
- package-ecosystem: 'github-actions'
4-
directory: '/'
5-
schedule:
6-
interval: monthly
7-
labels:
8-
- 'github_actions'
9-
- 'waiting for triage'
10-
- package-ecosystem: 'maven'
11-
directory: '/'
12-
schedule:
13-
interval: monthly
14-
open-pull-requests-limit: 10
15-
labels:
16-
- 'dependencies'
17-
- 'waiting for triage'
18-
ignore:
19-
# Freeze production dependencies of mcp-core
20-
- dependency-name: 'org.slf4j:slf4j-api'
21-
- dependency-name: 'com.fasterxml.jackson.core:jackson-annotations'
22-
- dependency-name: 'tools.jackson.core:jackson-databind'
23-
- dependency-name: 'io.projectreactor:reactor-bom'
24-
- dependency-name: 'io.projectreactor:reactor-core'
25-
- dependency-name: 'jakarta.servlet:jakarta.servlet-api'
26-
# mcp-json-jackson2 and mcp-json-jackson3 dependencies
27-
- dependency-name: 'com.fasterxml.jackson.core:jackson-databind'
28-
- dependency-name: 'com.networknt:json-schema-validator'
3+
- package-ecosystem: 'github-actions'
4+
directory: '/'
5+
schedule:
6+
interval: weekly
7+
labels:
8+
- 'github_actions'
9+
- 'waiting for triage'
10+
# Active development line: all updates, except minor and major updates of production dependencies
11+
- package-ecosystem: 'maven'
12+
directory: '/'
13+
schedule:
14+
interval: weekly
15+
open-pull-requests-limit: 15
16+
labels:
17+
- 'dependencies'
18+
- 'waiting for triage'
19+
ignore:
20+
# mcp-core production dependencies
21+
- dependency-name: 'org.slf4j:slf4j-api'
22+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
23+
- dependency-name: 'com.fasterxml.jackson.core:jackson-annotations'
24+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
25+
- dependency-name: 'io.projectreactor:reactor-bom'
26+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
27+
- dependency-name: 'io.projectreactor:reactor-core'
28+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
29+
- dependency-name: 'jakarta.servlet:jakarta.servlet-api'
30+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
31+
# mcp-json-jackson2 and mcp-json-jackson3 production dependencies
32+
- dependency-name: 'com.fasterxml.jackson.core:jackson-databind'
33+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
34+
- dependency-name: 'tools.jackson.core:jackson-databind'
35+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
36+
- dependency-name: 'com.networknt:json-schema-validator'
37+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
38+
# mcp-test compile dependencies, which end up on consumers' test classpath
39+
- dependency-name: 'org.assertj:assertj-core'
40+
update-types: ['version-update:semver-major']
41+
- dependency-name: 'org.junit.jupiter:*'
42+
update-types: ['version-update:semver-major']
43+
- dependency-name: 'org.mockito:mockito-core'
44+
update-types: ['version-update:semver-major']
45+
- dependency-name: 'org.testcontainers:*'
46+
update-types: ['version-update:semver-major']
47+
- dependency-name: 'org.awaitility:awaitility'
48+
update-types: ['version-update:semver-major']
49+
- dependency-name: 'ch.qos.logback:logback-classic'
50+
update-types: ['version-update:semver-major']
51+
- dependency-name: 'net.javacrumbs.json-unit:json-unit-assertj'
52+
update-types: ['version-update:semver-major']
53+
# Maintenance lines: patch updates only
54+
- package-ecosystem: 'maven'
55+
directory: '/'
56+
target-branch: '2.1.x'
57+
schedule:
58+
interval: monthly
59+
open-pull-requests-limit: 10
60+
labels:
61+
- 'dependencies'
62+
- 'maintenance'
63+
- 'waiting for triage'
64+
ignore:
65+
- dependency-name: '*'
66+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
67+
- package-ecosystem: 'maven'
68+
directory: '/'
69+
target-branch: '1.1.x'
70+
schedule:
71+
interval: monthly
72+
open-pull-requests-limit: 10
73+
labels:
74+
- 'dependencies'
75+
- 'maintenance'
76+
- 'waiting for triage'
77+
ignore:
78+
- dependency-name: '*'
79+
update-types: ['version-update:semver-major', 'version-update:semver-minor']
80+
- package-ecosystem: 'maven'
81+
directory: '/'
82+
target-branch: '0.18.x'
83+
schedule:
84+
interval: monthly
85+
open-pull-requests-limit: 10
86+
labels:
87+
- 'dependencies'
88+
- 'maintenance'
89+
- 'waiting for triage'
90+
ignore:
91+
- dependency-name: '*'
92+
update-types: ['version-update:semver-major', 'version-update:semver-minor']

‎DEPENDENCY_POLICY.md‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,27 @@
11
# Dependency Policy
22

3-
As a library consumed by downstream projects, the MCP Java SDK takes a conservative approach to dependency updates. Dependencies are kept stable unless there is a specific reason to update, such as a security vulnerability, a bug fix, or a need for new functionality.
3+
As a library consumed by downstream projects, the MCP Java SDK takes a conservative approach to dependency updates. Production dependencies receive patch updates routinely: they carry little risk, and keep consumers that do not manage dependency versions themselves off stale releases with known bugs. Minor and major updates are avoided, as they can force downstream consumers to adopt a new version of a dependency transitively, which can be disruptive for projects with strict dependency policies.
44

5-
## Update Triggers
5+
## Update Rules
66

7-
Dependencies are updated when:
7+
On the active development line (`main`):
88

9-
- A **security vulnerability** is disclosed (via GitHub security alerts).
10-
- A bug in a dependency directly affects the SDK.
11-
- A new dependency feature is needed for SDK development.
12-
- A dependency drops support for a Java version the SDK still targets.
9+
- **Patch updates** of production dependencies are applied routinely.
10+
- **Minor updates** of production dependencies are applied only with an SDK minor release, and are noted in the release notes.
11+
- **Major updates** of production dependencies are applied only with an SDK major release, or through a separate opt-in module (for example `mcp-json-jackson3`).
12+
- **Test dependencies, Maven plugins, and GitHub Actions** are kept up to date, across all versions. The exception is the compile dependencies of the published `mcp-test` module (JUnit, AssertJ, Mockito, Testcontainers, and others), which end up on consumers' test classpath: these do not receive major updates outside of an SDK major release.
1313

14-
Routine version bumps without a clear motivation are avoided to minimize churn for downstream consumers.
14+
On maintenance lines (see [VERSIONING.md](VERSIONING.md)), only patch updates are applied.
1515

16-
## What We Don't Do
16+
Security vulnerabilities are fixed on every supported release line. When a fix is only available in a new minor or major version of a dependency, the dependency is updated anyway, and the update is noted in the release notes.
1717

18-
The SDK does not run scheduled version bumps for production Maven dependencies. Updating a dependency can force downstream consumers to adopt that update transitively, which can be disruptive for projects with strict dependency policies.
18+
## What We Don't Do
1919

20-
Dependencies are only updated when there is a concrete reason, not simply because a newer version is available.
20+
The SDK does not accept contributor pull requests that update dependency versions. Dependency updates are handled by Dependabot and the maintainers. If a dependency needs to be updated, for example to fix a bug affecting the SDK, please open an issue instead.
2121

2222
## Automated Tooling
2323

2424
- **GitHub security updates** are enabled at the repository level and automatically open pull requests for Maven packages with known vulnerabilities. This is a GitHub repo setting, separate from the `dependabot.yml` configuration.
25-
- **GitHub Actions versions** are kept up to date via Dependabot on a monthly schedule (see `.github/dependabot.yml`).
26-
- **Maven dependencies** are monitored via Dependabot on a monthly schedule for non-production updates only (see `.github/dependabot.yml`).
25+
- **GitHub Actions versions** are kept up to date via Dependabot on a weekly schedule (see `.github/dependabot.yml`).
26+
- **Maven dependencies** on `main` are kept up to date via Dependabot on a weekly schedule, following the rules above (see `.github/dependabot.yml`).
27+
- **Maven dependencies** on maintenance branches receive patch updates via Dependabot on a monthly schedule (see `.github/dependabot.yml`).

0 commit comments

Comments
 (0)