72f9da91a2Add governance documentation required for SEP-1730 tier compliance: - DEPENDENCY_POLICY.md: Conservative update policy for Maven dependencies - VERSIONING.md: SemVer policy with breaking/non-breaking definitions - ROADMAP.md: 2025-11-25 spec implementation focus and v1.x development - .github/dependabot.yml: Monthly updates with frozen production dependencies This mirrors the TypeScript SDK PR structure while being adapted for the Java context. Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
22 lines
No EOL
921 B
YAML
22 lines
No EOL
921 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: 'github-actions'
|
|
directory: '/'
|
|
schedule:
|
|
interval: monthly
|
|
- package-ecosystem: 'maven'
|
|
directory: '/'
|
|
schedule:
|
|
interval: monthly
|
|
open-pull-requests-limit: 10
|
|
ignore:
|
|
# Freeze production dependencies of mcp-core
|
|
- dependency-name: 'org.slf4j:slf4j-api'
|
|
- dependency-name: 'com.fasterxml.jackson.core:jackson-annotations'
|
|
- dependency-name: 'tools.jackson.core:jackson-databind'
|
|
- dependency-name: 'io.projectreactor:reactor-bom'
|
|
- dependency-name: 'io.projectreactor:reactor-core'
|
|
- dependency-name: 'jakarta.servlet:jakarta.servlet-api'
|
|
# mcp-json-jackson2 and mcp-json-jackson3 dependencies
|
|
- dependency-name: 'com.fasterxml.jackson.core:jackson-databind'
|
|
- dependency-name: 'com.networknt:json-schema-validator' |