modelcontextprotocol/java-sdk
Watch
1
0
Fork
You've already forked java-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-sdk/DEPENDENCY_POLICY.md
Dariusz Jędrzejczyk 72f9da91a2
 Add governance documentation for SEP-1730 (#808) 
Add governance documentation required for SEP-1730 tier compliance:

- DEPENDENCY_POLICY.md: Conservative update policy for Maven dependencies
- VERSIONING.md: SemVer policy with breaking/non-breaking definitions
- ROADMAP.md: 2025-11-25 spec implementation focus and v1.x development
- .github/dependabot.yml: Monthly updates with frozen production dependencies

This mirrors the TypeScript SDK PR structure while being adapted for the Java context.

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>
2026-02-20 18:11:26 +01:00

1.5 KiB
Raw Blame History

Dependency Policy

As a library consumed by downstream projects, the MCP Java SDK takes a conservative approach to dependency updates. Dependencies are kept stable unless there is a specific reason to update, such as a security vulnerability, a bug fix, or a need for new functionality.

Update Triggers

Dependencies are updated when:

  • A security vulnerability is disclosed (via GitHub security alerts).
  • A bug in a dependency directly affects the SDK.
  • A new dependency feature is needed for SDK development.
  • A dependency drops support for a Java version the SDK still targets.

Routine version bumps without a clear motivation are avoided to minimize churn for downstream consumers.

What We Don't Do

The SDK does not run scheduled version bumps for production Maven dependencies. Updating a dependency can force downstream consumers to adopt that update transitively, which can be disruptive for projects with strict dependency policies.

Dependencies are only updated when there is a concrete reason, not simply because a newer version is available.

Automated Tooling

  • GitHub security updates are enabled at the repository level and automatically open pull requests for Maven packages with known vulnerabilities. This is a GitHub repo setting, separate from the dependabot.yml configuration.
  • GitHub Actions versions are kept up to date via Dependabot on a monthly schedule (see .github/dependabot.yml).
  • Maven dependencies are monitored via Dependabot on a monthly schedule for non-production updates only (see .github/dependabot.yml).