renovate.json

{
  "extends": [
    "config:base",
    ":rebaseStalePrs",
    ":preserveSemverRanges"
  ],
  "renovateFork": true,
  "packageRules": [
    {
      "matchPackageNames": ["javax.portlet:portlet-api"],
      "allowedVersions": "< 3.0",
      "description": "uPortal runs JSR-286 (Portlet API 2.0). Portlet API 3.x (JSR-362) is a different container contract and is not supported."
    },
    {
      "matchPackagePrefixes": ["org.springframework:", "org.springframework.data:"],
      "allowedVersions": "< 5.0",
      "description": "This portlet is pinned to Spring Framework 4.3.x. Spring 5+ requires a coordinated migration; Spring 6+ additionally needs Jakarta EE + Java 17+."
    },
    {
      "matchPackageNames": [
        "com.sun.xml.bind:jaxb-impl",
        "jakarta.xml.bind:jakarta.xml.bind-api",
        "org.glassfish.jaxb:jaxb-runtime"
      ],
      "allowedVersions": "< 3.0",
      "description": "The 2.x releases preserve the javax.xml.bind.* package namespace. 3+ moves to jakarta.xml.bind as part of Jakarta EE 9+, which this portlet is not migrating to yet."
    },
    {
      "matchPackagePrefixes": ["org.jvnet.jaxb2_commons:"],
      "allowedVersions": "< 1.0",
      "description": "This portlet uses jaxb2-basics 0.6.0 (last 0.x). The 1.x release requires jaxb2-maven-plugin 1.x+ which has a substantially different plugin configuration; not doing that migration yet."
    },
    {
      "matchPackageNames": ["org.codehaus.plexus:plexus-archiver"],
      "allowedVersions": "< 4.10.0",
      "description": "plexus-archiver 4.10+ requires a newer commons-io (BoundedInputStream.builder()) than the one bundled with maven-war-plugin 3.4.0 (pinned by uportal-portlet-parent). Revisit once the parent bumps maven-war-plugin to 3.5.x+."
    },
    {
      "matchPackageNames": [
        "org.mockito:mockito-core",
        "org.mockito:mockito-inline",
        "org.mockito:mockito-junit-jupiter"
      ],
      "allowedVersions": "< 5.0",
      "description": "Mockito 5 uses the inline MockMaker by default; its bundled byte-buddy references ClassFileVersion.JAVA_V21, missing on the byte-buddy pulled transitively via Javassist. Stay on Mockito 4.x until byte-buddy can be reconciled at the parent level."
    },
    {
      "matchPackageNames": ["javax.servlet:javax.servlet-api"],
      "allowedVersions": "< 5.0",
      "description": "Servlet API 5+ is in the Jakarta EE namespace and incompatible with this portlet's javax.servlet imports. Runtime is Tomcat 8.5/9 (Servlet 3.1)."
    }
  ]
}