renovate.json

{
  "extends": ["config:base", ":rebaseStalePrs", ":preserveSemverRanges"],
  "renovateFork": true,
  "packageRules": [
    {
      "matchPackageNames": ["javax.portlet:portlet-api"],
      "allowedVersions": "< 3.0",
      "description": "uPortal runs JSR-286 (Portlet API 2.0). Portlet API 3.x (JSR-362) is a different container contract and is not supported."
    },
    {
      "matchPackagePrefixes": ["org.springframework:", "org.springframework.data:"],
      "allowedVersions": "< 5.0",
      "description": "This portlet is pinned to Spring Framework 4.3.x. Spring 5+ requires a coordinated migration; Spring 6+ additionally needs Jakarta EE + Java 17+."
    },
    {
      "matchPackagePrefixes": ["org.hibernate:", "org.hibernate.orm:"],
      "allowedVersions": "< 6.0",
      "description": "Pinned to Hibernate 5.6.x. Hibernate 6+ (including the org.hibernate.orm groupId rename) requires Jakarta EE and Java 17+."
    },
    {
      "matchPackageNames": [
        "com.sun.xml.bind:jaxb-impl",
        "jakarta.xml.bind:jakarta.xml.bind-api",
        "org.glassfish.jaxb:jaxb-runtime"
      ],
      "allowedVersions": "< 3.0",
      "description": "The 2.x releases preserve the javax.xml.bind.* package namespace. 3+ moves to jakarta.xml.bind as part of Jakarta EE 9+, which this portlet is not migrating to yet."
    },
    {
      "matchPackageNames": ["org.codehaus.plexus:plexus-archiver"],
      "allowedVersions": "< 4.10.0",
      "description": "plexus-archiver 4.10+ requires a newer commons-io (BoundedInputStream.builder()) than the one bundled with maven-war-plugin 3.4.0 (pinned by uportal-portlet-parent). Revisit once the parent bumps maven-war-plugin to 3.5.x+."
    },
    {
      "matchPackageNames": [
        "org.mockito:mockito-core",
        "org.mockito:mockito-inline",
        "org.mockito:mockito-junit-jupiter"
      ],
      "allowedVersions": "< 5.0",
      "description": "Mockito 5 uses the inline MockMaker by default; its bundled byte-buddy references ClassFileVersion.JAVA_V21, missing on the byte-buddy pulled transitively via Hibernate/Javassist. Would fail tests with MockitoInitializationException. Stay on Mockito 4.x until byte-buddy can be reconciled at the parent level."
    },
    {
      "matchPackageNames": ["javax.servlet:javax.servlet-api"],
      "allowedVersions": "< 4.0",
      "description": "uPortal-start runs on Tomcat 8.5/9 which serves the Servlet 3.1 spec. Servlet API 5+ is in the Jakarta EE namespace and incompatible with this portlet's javax.servlet imports."
    }
  ]
}