Configure Renovate

[renovate]

Welcome to Renovate! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

📚 See our Reading List for relevant documentation you may be interested in reading.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to renovate.json in this branch. Renovate will update the Pull Request description the next time it runs.

---

Detected Package Files

• pom.xml (maven)
• .mvn/wrapper/maven-wrapper.properties (maven-wrapper)
• renovate.json (renovate-config)

Configuration Summary

Based on the default config's presets, Renovate will:

• Start dependency updates only once this onboarding PR is merged
• Hopefully safe environment variables to allow users to configure.
• Show all Merge Confidence badges for pull requests.
• Enable Renovate Dependency Dashboard creation.
• Use semantic commit type fix for dependencies and chore for all others if semantic commits are in use.
• Group known monorepo packages together.
• Use curated list of recommended non-monorepo package groupings.
• Show only the Age and Confidence Merge Confidence badges for pull requests.
• Apply crowd-sourced package replacement rules.
• Apply crowd-sourced workarounds for known problems with packages.
• Ensure that every dependency pinned by digest and sourced from Forgejo contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from Gitea contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitHub.com and Github enterprise contains a link to the commit-to-commit diff
• Ensure that every dependency pinned by digest and sourced from GitLab.com contains a link to the commit-to-commit diff
• Correctly link to the source code for golang.org/x packages
• Link to pkg.go.dev/... for golang.org/x packages' title
• Provide a link to octochangelog's improved breakdown for Renovate's changelogs
• Enable Docker major updates.
• Append Signed-off-by: to signoff Git commits.
• Run lock file maintenance (updates) on the first day of each month.
• Disable semantic prefixes for commit messages and PR titles.
• Recommended configuration for abandoned packages, treating packages without a release for 1 year as abandoned, while taking into account community-sourced overrides.
• Wait until the npm package is three days old before raising the update. This a) introduces a short delay to allow for malware researchers and scanners to (possibly) detect any malicious behaviour in packages, and b) prevents the maintainer and/or NPM from unpublishing a package you already upgraded to, breaking builds.
• Show OpenSSF badge on pull requests.
• Raise PR when vulnerability alerts are detected.
• Enable go.mod indirect dependency updates only when vulnerabilities have been detected.
• Weekly schedule on early Monday mornings (before 4 AM).
• Run Renovate on following schedule: * 0-3 * * 1

---

What to Expect

With your current configuration, Renovate will create 10 Pull Requests, up to a maximum of 15 over time (see docs for prConcurrentLimit), plus 3 security update Pull Requests which are not subject to this limit:

Update dependency org.hibernate:hibernate-core to v5.4.24.Final [SECURITY]

• Branch name: renovate/maven-org.hibernate-hibernate-core-vulnerability
• Merge into: master
• Upgrade org.hibernate:hibernate-core to 5.4.24.Final

Update dependency org.assertj:assertj-core to v3.27.7 [SECURITY]

• Branch name: renovate/maven-org.assertj-assertj-core-vulnerability
• Merge into: master
• Upgrade org.assertj:assertj-core to 3.27.7

Update dependency com.h2database:h2 to v2 [SECURITY]

• Branch name: renovate/maven-com.h2database-h2-vulnerability
• Merge into: master
• Upgrade com.h2database:h2 to 2.2.220

Update dependency org.jacoco:jacoco-maven-plugin to v0.8.15

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/jacoco-maven-plugin.version
• Merge into: master
• Upgrade org.jacoco:jacoco-maven-plugin to 0.8.15

Update dependency maven to v3.9.16

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/maven-3.x
• Merge into: master
• Upgrade maven to 3.9.16

Update dependency org.apache.commons:commons-dbcp2 to v2.14.0

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/org.apache.commons-commons-dbcp2-2.x
• Merge into: master
• Upgrade org.apache.commons:commons-dbcp2 to 2.14.0

Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3.12.0

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/org.apache.maven.plugins-maven-javadoc-plugin-3.x
• Merge into: master
• Upgrade org.apache.maven.plugins:maven-javadoc-plugin to 3.12.0

Update dependency org.apache.maven.plugins:maven-source-plugin to v3.4.0

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/org.apache.maven.plugins-maven-source-plugin-3.x
• Merge into: master
• Upgrade org.apache.maven.plugins:maven-source-plugin to 3.4.0

Update dependency org.springframework:spring-jdbc to v5.3.39

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/spring-core
• Merge into: master
• Upgrade org.springframework:spring-jdbc to 5.3.39

Update junit-framework monorepo

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/junit-framework-monorepo
• Merge into: master
• Upgrade org.junit.vintage:junit-vintage-engine to 5.14.4
• Upgrade org.junit.platform:junit-platform-launcher to 1.14.4
• Upgrade org.junit.jupiter:junit-jupiter to 5.14.4

Update dependency com.mycila:license-maven-plugin to v5

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/com.mycila-license-maven-plugin-5.x
• Merge into: master
• Upgrade com.mycila:license-maven-plugin to 5.1.2

Update dependency org.apache.maven.plugins:maven-release-plugin to v3

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/org.apache.maven.plugins-maven-release-plugin-3.x
• Merge into: master
• Upgrade org.apache.maven.plugins:maven-release-plugin to 3.3.1

Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/org.apache.maven.plugins-maven-surefire-plugin-3.x
• Merge into: master
• Upgrade org.apache.maven.plugins:maven-surefire-plugin to 3.5.6

Update dependency org.springframework:spring-jdbc to v7

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/major-spring-core
• Merge into: master
• Upgrade org.springframework:spring-jdbc to 7.0.9

Update junit-framework monorepo to v6

• Schedule: ["* 0-3 * * 1"]
• Branch name: renovate/major-junit-framework-monorepo
• Merge into: master
• Upgrade org.junit.vintage:junit-vintage-engine to 6.1.3
• Upgrade org.junit.platform:junit-platform-launcher to 6.1.3
• Upgrade org.junit.jupiter:junit-jupiter to 6.1.3

🚸 PR creation will be limited to maximum 2 per hour, so it doesn't swamp any CI resources or overwhelm the project. See docs for prHourlyLimit for details. Security update Pull Requests are not subject to this limit and will be created straight away.

---

❓ Got questions? Check out Renovate's Docs, particularly the Getting Started section.
If you need any further assistance then you can also request help here.

---

This PR was generated by Mend Renovate. View the repository job log.