Keep org.glassfish.jaxb and org.apache.cxf:cxf-xjc-plugin off major/minor dependabot bumps

[hugohills-regnosys]

Proposed Enhancement to Rune Testing

Pull Request Summary

Adds org.glassfish.jaxb* and org.apache.cxf:cxf-xjc-plugin to the major/minor dependabot ignore list, following the existing pattern for xtext-dev-bom and guava.

Supporting Documentation

jaxb-runtime 3.x/4.x only registers a jakarta.xml.bind.JAXBContextFactory provider (META-INF/services/jakarta.xml.bind.JAXBContextFactory -> org.glassfish.jaxb.runtime.v2.JAXBContextFactory), not javax.xml.bind's. This pom still pins javax.xml.bind:jaxb-api:2.3.1 directly, and FpMLSchemeEnumReader/IsoCurrencySchemeEnumReader call javax.xml.bind.JAXBContext.newInstance() on that API.

Bumping just jaxb-runtime's dependencyManagement entry to 4.0.9 (leaving jaxb-api at 2.3.1) still compiles fine, and mvn test passes - but that's because FpMLSchemeEnumReaderTest only exercises string-formatting helper methods, not the actual JAXBContext.newInstance() call, and IsoCurrencySchemeEnumReader has no test at all. Calling javax.xml.bind.JAXBContext.newInstance() directly against that dependency set throws at runtime:

javax.xml.bind.JAXBException: Implementation of JAXB-API has not been found on module path or classpath.
 - with linked exception:
[java.lang.ClassNotFoundException: com.sun.xml.internal.bind.v2.ContextFactory]

So a bot-driven jaxb-runtime major/minor bump would pass CI here and break silently at runtime for any consumer that hits the FpML/ISO4217 scheme import path.

cxf-xjc-plugin is coupled to the same jaxb-api/jaxb-runtime pin, but the risk here is more direct: unlike digital-regulatory-reporting's equivalent plugin (gated behind a generate-mic profile that isn't run by default), this pom's cxf-xjc-plugin execution runs unconditionally at generate-sources, regenerating src/generated/java on every build. cxf-xjc-plugin 4.x emits jakarta.xml.bind-annotated classes, so a standalone bump breaks mvn compile outright with package jakarta.xml.bind.annotation does not exist.

Test plan

• Bumped org.glassfish.jaxb:jaxb-runtime alone to 4.0.9 in a scratch checkout: mvn compile and mvn test -Dtest=FpMLSchemeEnumReaderTest both pass (confirming existing coverage wouldn't catch this).
• Isolated repro: called javax.xml.bind.JAXBContext.newInstance() directly against the same javax.xml.bind:jaxb-api:2.3.1 + org.glassfish.jaxb:jaxb-runtime:4.0.9 classpath - throws JAXBException/ClassNotFoundException as shown above.
• Bumped cxf-xjc-plugin alone to 4.2.0 in a scratch checkout: mvn compile fails immediately regenerating src/generated/java/org/genericode/xml/_2004/ns/codelist/_0/*.java with package jakarta.xml.bind.annotation does not exist.

🤖 Generated with Claude Code