72f9da91a2Add governance documentation required for SEP-1730 tier compliance: - DEPENDENCY_POLICY.md: Conservative update policy for Maven dependencies - VERSIONING.md: SemVer policy with breaking/non-breaking definitions - ROADMAP.md: 2025-11-25 spec implementation focus and v1.x development - .github/dependabot.yml: Monthly updates with frozen production dependencies This mirrors the TypeScript SDK PR structure while being adapted for the Java context. Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
26 lines
1.5 KiB
Markdown
26 lines
1.5 KiB
Markdown
# Dependency Policy
|
|
|
|
As a library consumed by downstream projects, the MCP Java SDK takes a conservative approach to dependency updates. Dependencies are kept stable unless there is a specific reason to update, such as a security vulnerability, a bug fix, or a need for new functionality.
|
|
|
|
## Update Triggers
|
|
|
|
Dependencies are updated when:
|
|
|
|
- A **security vulnerability** is disclosed (via GitHub security alerts).
|
|
- A bug in a dependency directly affects the SDK.
|
|
- A new dependency feature is needed for SDK development.
|
|
- A dependency drops support for a Java version the SDK still targets.
|
|
|
|
Routine version bumps without a clear motivation are avoided to minimize churn for downstream consumers.
|
|
|
|
## What We Don't Do
|
|
|
|
The SDK does not run scheduled version bumps for production Maven dependencies. Updating a dependency can force downstream consumers to adopt that update transitively, which can be disruptive for projects with strict dependency policies.
|
|
|
|
Dependencies are only updated when there is a concrete reason, not simply because a newer version is available.
|
|
|
|
## Automated Tooling
|
|
|
|
- **GitHub security updates** are enabled at the repository level and automatically open pull requests for Maven packages with known vulnerabilities. This is a GitHub repo setting, separate from the `dependabot.yml` configuration.
|
|
- **GitHub Actions versions** are kept up to date via Dependabot on a monthly schedule (see `.github/dependabot.yml`).
|
|
- **Maven dependencies** are monitored via Dependabot on a monthly schedule for non-production updates only (see `.github/dependabot.yml`).
|