Context

The Sling Starter GitHub module is mainly a bill of materials, listing all dependencies that should be included in the final build. Updating these dependencies manually is tedious and time-consuming. With the CI checks we have in place, we are already able to validate most dependency updates without the need to manually verify the behaviour of the Sling Starter.

...

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base"
  ],
  "enabledManagers": ["osgifeature", "regex", "maven"],
  "regexManagers": [
    {
      "fileMatch": ["pom.xml"],
      "matchStrings": ["<jackson.version>(?<currentValue>.*?)</jackson.version>\\n"],
      "depNameTemplate": "com.fasterxml.jackson.core:jackson-core",
      "datasourceTemplate": "maven"
    }
  ],
  "packageRules": [
    {
      "matchManagers": ["maven"],
      "matchDepTypes": ["provided"],
      "enabled": false
    }
  ]
}

1. At line 6, we explicitly configure the managers we want to use
2. At lines 7-14 we configure updates for dependecies which have their versions declared in the pom file
3. At lines 16-20 we prevent dependencies of scope  provided from being updated by Maven. This affects only dependencies declared in the pom.xml

Pending items

• group certain items together ( e.g. jackrabbit and oak artifacts )
• exclude 'unstable' releases from Oak
• disable certain updates ( e.g. only patch/minor for codahale metrics, guava, etc)