Maven: Ignore repositories from profiles that are not activated#14154
Open
yeikel wants to merge 1 commit intodependabot:mainfrom
Open
Maven: Ignore repositories from profiles that are not activated#14154yeikel wants to merge 1 commit intodependabot:mainfrom
yeikel wants to merge 1 commit intodependabot:mainfrom
Conversation
89a2b43 to
92f7af3
Compare
1 task
92f7af3 to
fda7149
Compare
jglick
reviewed
Feb 11, 2026
Comment on lines
+355
to
+362
| it "does not include repositories from profiles that are not activated by default" do | ||
| expect(repository_urls).to eq( | ||
| %w( | ||
| https://repo.jenkins-ci.org/public | ||
| https://repo.jenkins-ci.org/incrementals-activated | ||
| https://repo.jenkins-ci.org/incrementals-activated-2 | ||
| https://repo.jenkins-ci.org/another-activated | ||
| https://repo.maven.apache.org/maven2 |
a96b796 to
ab5620b
Compare
Contributor
Author
|
@kbukum1 Could you please review this as well? Thanks in advance |
a8cd434 to
ea54bb1
Compare
ea54bb1 to
c00c234
Compare
Contributor
Author
|
@JamieMagee, thanks as always for helping to move my changes forward 🙇 If you have time, I'd appreciate some eyes for this one as well Thanks in advance! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
In #13747, we updated Dependabot to consider all repositories defined in a project rather than only the first match.
Unfortunately, this revealed a gap in Dependabot’s repository parsing: repositories that were expected to be disabled via Maven profiles were still being extracted. As a result, Dependabot started to query repositories that users had explicitly disabled in their Maven configuration leading to unexpected updates
With this change, we now respect the user’s configuration and only include repositories that are:
Profiles that are explicitly deactivated, or that lack activation configuration, are treated as disabled to match native Maven behavior.
Fixes #14148
Anything you want to highlight for special attention from reviewers?
The diff looks larger than it is because I had to reduce the code complexity as per
rubocopHow will you know you've accomplished your goal?
Both new and existing spec pass
The new specs focused on parsing the profile and show how it should ignore profiles that are not activated
Validated using the provided reproducer
I ran this version against the reproducer documented in #14148 and produces the expected output (only
https://repo.jenkins-ci.org/public/org/jenkins-ci/plugins/mock-slave/is consulted)Logs
Checklist