From 14b10c80212adff4f85c8a3a6a1092cf6cac81ce Mon Sep 17 00:00:00 2001 From: chandan Date: Fri, 24 Jul 2026 16:40:02 +0530 Subject: [PATCH 1/2] Scope Dependabot to Maven and ignore provided-scope deps (#1289) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Spark, Scala, and Spark's Jackson libs are declared `provided` in the poms — compiled against but not packaged into the Zingg jar. The Spark runtime (Databricks/EMR/etc.) supplies and patches them, so Dependabot PRs/alerts on these are noise. Ignore them; keep jackson-annotations (compile scope, shipped) since its alerts are real. --- .github/dependabot.yml | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3307e47c5..9a1df37c4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,11 +1,30 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file +# Dependabot configuration for Zingg. +# See: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file +# +# NOTE (issue #1289): Zingg runs *on top of* a Spark cluster (Databricks, EMR, +# spark-submit classpath). Spark, Scala, and the Jackson libs Spark ships are +# declared as `provided` scope in the poms — they are compiled against but NOT +# packaged into the Zingg jar. The runtime environment supplies (and patches) +# them. Zingg cannot choose their runtime version, so Dependabot PRs/alerts on +# these are noise. We therefore `ignore` them below. +# GitHub classifies Maven `provided` scope as "runtime" (not "development"), so +# there is no built-in scope filter for this yet (dependabot-core#7973) — the +# ignore list is the config-level lever, and pom remain the real +# fix for transitive artifacts we must strip from the shipped graph. version: 2 updates: - - package-ecosystem: "*" # See documentation for possible values - directory: "/" # Location of package manifests + - package-ecosystem: "maven" + directories: + - "/**" # cover the root + all Maven submodules (common/*, spark/*, ...) schedule: interval: "weekly" + open-pull-requests-limit: 10 + ignore: + # --- provided scope: supplied by the Spark runtime, not shipped by Zingg --- + - dependency-name: "org.apache.spark:*" + - dependency-name: "org.scala-lang:*" + - dependency-name: "com.fasterxml.jackson.core:jackson-core" + - dependency-name: "com.fasterxml.jackson.core:jackson-databind" + # NOTE: jackson-annotations is `compile` scope (shipped in the jar) — do + # NOT ignore it; its alerts are real and actionable. From eb67b0af09f0c89d1f24e2a22deb2340aa538a3b Mon Sep 17 00:00:00 2001 From: Chandan Date: Fri, 24 Jul 2026 17:28:47 +0530 Subject: [PATCH 2/2] Clean up Dependabot configuration comments Removed unnecessary comments and clarified configuration. --- .github/dependabot.yml | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9a1df37c4..880bba5fa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,7 @@ -# Dependabot configuration for Zingg. -# See: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file -# -# NOTE (issue #1289): Zingg runs *on top of* a Spark cluster (Databricks, EMR, -# spark-submit classpath). Spark, Scala, and the Jackson libs Spark ships are -# declared as `provided` scope in the poms — they are compiled against but NOT -# packaged into the Zingg jar. The runtime environment supplies (and patches) -# them. Zingg cannot choose their runtime version, so Dependabot PRs/alerts on -# these are noise. We therefore `ignore` them below. -# GitHub classifies Maven `provided` scope as "runtime" (not "development"), so -# there is no built-in scope filter for this yet (dependabot-core#7973) — the -# ignore list is the config-level lever, and pom remain the real -# fix for transitive artifacts we must strip from the shipped graph. +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file version: 2 updates: