From 23780c82082068048a340cd1b78c03c53c1a90b2 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Tue, 29 Sep 2026 17:40:21 +0200
Subject: [PATCH] Keep Dependabot off plexus-xml 4.x and SLF4J 2.x

plexus-xml 4.x depends on maven-xml-impl 4.0.0-alpha and belongs to the Maven 4 line. Maven 3.9.x core exports slf4j-api 1.7.36, so a plugin built against 2.x can fail at runtime; CI on Maven 3.10, which ships 2.0.20, does not catch it.
---
 .github/dependabot.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b76b89570..83ae5f632 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,13 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    ignore:
+      # plexus-xml 4.x is the Maven 4 line (depends on maven-xml-impl 4.0.0-alpha)
+      - dependency-name: "org.codehaus.plexus:plexus-xml"
+        versions: [">= 4.0.0"]
+      # Maven 3.9.x core exports slf4j-api 1.7.36
+      - dependency-name: "org.slf4j:*"
+        versions: [">= 2.0.0"]
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule: