From d5b3498278f2be993b5b5c7e036386e4167ac011 Mon Sep 17 00:00:00 2001 From: Hugo Hills Date: Thu, 17 Sep 2026 12:08:36 +0100 Subject: [PATCH 1/2] Keep org.glassfish.jaxb off major/minor dependabot bumps jaxb-runtime 3.x/4.x only registers a jakarta.xml.bind.JAXBContextFactory provider, not javax.xml.bind's. FpMLSchemeEnumReader and IsoCurrencySchemeEnumReader call javax.xml.bind.JAXBContext.newInstance() directly, so a bot bump still compiles against the untouched javax.xml.bind:jaxb-api pin but throws JAXBException at runtime - and neither reader has a test exercising that path, so it would pass CI and break silently. --- .github/dependabot.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a8eb5a7..a86ee86 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,7 +17,7 @@ updates: - java # com.regnosys and Rune artifacts are bumped deliberately as part of # release coordination, not by a bot. - # xtext-dev-bom and guava are kept off minor/major bumps entirely - + # xtext-dev-bom, guava and jaxb are kept off minor/major bumps entirely - # only patch updates are allowed through, and standalone rather than # grouped. ignore: @@ -43,6 +43,19 @@ updates: - dependency-name: com.google.inject* update-types: - version-update:semver-major + # jaxb-runtime 3.x/4.x only registers a jakarta.xml.bind.JAXBContextFactory + # provider, not javax.xml.bind's - so FpMLSchemeEnumReader and + # IsoCurrencySchemeEnumReader, which call javax.xml.bind.JAXBContext. + # newInstance() directly, still compile against the untouched + # javax.xml.bind:jaxb-api pin but throw JAXBException ("Implementation + # of JAXB-API has not been found") at runtime - confirmed by bumping + # jaxb-runtime alone and invoking JAXBContext.newInstance() directly. + # Neither reader has a test that exercises that path, so a bot bump + # here would pass CI and break silently at runtime. + - dependency-name: org.glassfish.jaxb* + update-types: + - version-update:semver-major + - version-update:semver-minor # One PR for routine minor/patch drift; majors still come through # individually so they get read properly. groups: @@ -50,6 +63,7 @@ updates: exclude-patterns: - org.eclipse.xtext:xtext-dev-bom - com.google.guava:guava + - org.glassfish.jaxb* update-types: - minor - patch From 980b79d603116948c0660f991ca9b80baf0a9fa4 Mon Sep 17 00:00:00 2001 From: Hugo Hills Date: Thu, 17 Sep 2026 13:38:05 +0100 Subject: [PATCH 2/2] Keep org.apache.cxf:cxf-xjc-plugin off major/minor dependabot bumps cxf-xjc-plugin runs unconditionally at generate-sources here (not behind a profile like DRR's), regenerating src/generated/java on every build. 4.x emits jakarta.xml.bind-annotated classes, which fail to compile against the still-javax jaxb-api/jaxb-runtime pinned above - confirmed by bumping cxf-xjc-plugin alone and running mvn compile. --- .github/dependabot.yml | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a86ee86..16513e6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,9 +17,9 @@ updates: - java # com.regnosys and Rune artifacts are bumped deliberately as part of # release coordination, not by a bot. - # xtext-dev-bom, guava and jaxb are kept off minor/major bumps entirely - - # only patch updates are allowed through, and standalone rather than - # grouped. + # xtext-dev-bom, guava, jaxb-runtime and cxf-xjc-plugin are kept off + # minor/major bumps entirely - only patch updates are allowed through, + # and standalone rather than grouped. ignore: - dependency-name: com.regnosys* - dependency-name: org.finos.rune* @@ -56,6 +56,17 @@ updates: update-types: - version-update:semver-major - version-update:semver-minor + # cxf-xjc-plugin runs unconditionally at generate-sources (not behind + # a profile), regenerating src/generated/java on every build. 4.x + # emits jakarta.xml.bind-annotated classes, which fail to compile + # against the still-javax jaxb-api/jaxb-runtime pinned above - + # confirmed by bumping cxf-xjc-plugin alone: `mvn compile` fails with + # "package jakarta.xml.bind.annotation does not exist". Bump together + # with jaxb-runtime, deliberately, not by a bot. + - dependency-name: org.apache.cxf:cxf-xjc-plugin + update-types: + - version-update:semver-major + - version-update:semver-minor # One PR for routine minor/patch drift; majors still come through # individually so they get read properly. groups: @@ -64,6 +75,7 @@ updates: - org.eclipse.xtext:xtext-dev-bom - com.google.guava:guava - org.glassfish.jaxb* + - org.apache.cxf:cxf-xjc-plugin update-types: - minor - patch