From b3f63db7f373db11948d3af5f7dd1ceacc6a03e0 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Wed, 19 Aug 2026 16:49:56 +0200
Subject: [PATCH] Stop dependabot proposing slf4j 2.x and guice 6+ on 4.x

The 4.x line tracks the Maven 3.9 runtime: slf4j 1.7.x comes from the core
realm, and Maven still embeds Guice 5.1.0 on javax.inject. Both bumps have
been opened and reverted or closed more than once (#460, #463), so ignore
them for that target branch only. master is deliberately left alone.
---
 .github/dependabot.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3cbe5986..eb46641a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,6 +11,16 @@ updates:
     target-branch: "4.x"
     schedule:
       interval: "daily"
+    ignore:
+      # Maven 3.9.x exports slf4j 1.7.x from its core realm, so the 4.x line
+      # cannot compile against the 2.0.x API. See #463 and #469.
+      - dependency-name: "org.slf4j:*"
+        versions: ["[2.0.0,)"]
+      # Maven still embeds Guice 5.1.0 on javax.inject, and Guice 7 dropped
+      # javax.inject entirely. Testing against 6.x or 7.x exercises a
+      # container no consumer runs. See #460.
+      - dependency-name: "com.google.inject:guice"
+        versions: ["[6.0.0,)"]
 
   - package-ecosystem: "github-actions"
     directory: "/"