Bump parent POM from 1.65 to 1.69 #291
Conversation
Bumps [jenkins](https://github.com/jenkinsci/pom) from 1.65 to 1.69. - [Release notes](https://github.com/jenkinsci/pom/releases) - [Changelog](https://github.com/jenkinsci/pom/blob/master/CHANGELOG-old.md) - [Commits](jenkinsci/pom@jenkins-1.65...jenkins-1.69) --- updated-dependencies: - dependency-name: org.jenkins-ci:jenkins dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…2.4 paths to dependency are:
+-org.kohsuke.stapler:stapler-jelly:999999-SNAPSHOT
+-org.jvnet.hudson:htmlunit:2.6-hudson-2 [test]
+-commons-lang:commons-lang:2.4
and
+-org.kohsuke.stapler:stapler-jelly:999999-SNAPSHOT
+-org.kohsuke.stapler:stapler:999999-SNAPSHOT
+-org.kohsuke.stapler:json-lib:2.4-jenkins-3
+-commons-lang:commons-lang:2.5
and
+-org.kohsuke.stapler:stapler-jelly:999999-SNAPSHOT
+-org.kohsuke.stapler:stapler:999999-SNAPSHOT
+-org.kohsuke.stapler:json-lib:2.4-jenkins-3
+-net.sf.ezmorph:ezmorph:1.0.6
+-commons-lang:commons-lang:2.3
| <dependency> | ||
| <groupId>commons-lang</groupId> | ||
| <artifactId>commons-lang</artifactId> | ||
| <version>2.5</version> |
There was a problem hiding this comment.
Maybe better to <exclude> it from wherever it was being improperly picked up?
There was a problem hiding this comment.
I pasted the error in the commit message. So where do you think it is being improperly picked up?
There was a problem hiding this comment.
Looks like both htmlunit and ezmorph, with json-lib asking for the newest version. Not worth bothering over. (When there is just one dep trail which picks up an old lib, and unfortunately that happens to be the one preferred by Maven’s silly “nearest” algorithm, then it is easier to exclude that trail than to maintain an explicit version number.)
There was a problem hiding this comment.
When there is just one dep trail which picks up an old lib, and unfortunately that happens to be the one preferred by Maven’s silly “nearest” algorithm, then it is easier to exclude that trail than to maintain an explicit version number
Yeah, I agree. It gets particularly perverse when Dependabot then starts trying to update that number in the <dependencyManagement> section.
Like #289 but with SpotBugs warnings suppressed and some Enforcer changes.