dependency-update

name	dependency-update
description	Check and update Maven dependencies. Use when upgrading libraries, verifying Spring Boot BOM compatibility, running Dependabot-like checks locally, or planning version upgrades. Validates builds and updates documentation.

Dependency Update Workflow

When to Use

• Periodic dependency freshness check
• After Dependabot PRs to verify compatibility
• Before a release to ensure all dependencies are current
• When upgrading Spring Boot versions

Procedure

Step 1: Analyze Current Dependencies

Read pom.xml and catalog all dependencies AND plugins with explicit versions vs BOM-managed versions. Always update to the latest stable version listed on Maven Central.

Key explicitly-versioned dependencies to check:

• sol-jcsmp
• testcontainers and testcontainers-junit-jupiter
• gson
• okhttp
• swagger-annotations / swagger-codegen-maven-plugin
• All Maven plugins with explicit versions (e.g. central-publishing-maven-plugin)

Step 2: Check for Updates

For each explicitly-versioned dependency and plugin:

• Check Maven Central for the latest stable release via web search (skip RC/alpha/beta)
• Only update if the version is actually available and downloadable from Maven Central
• Verify compatibility with the current Spring Boot BOM
• Assess risk level: patch (safe), minor (review changelog), major (breaking — review carefully)

Step 3: Apply Updates

For approved updates:

1. Update the version in pom.xml
2. Run build verification:

   mvn verify "-Dgpg.skip" -DskipTests
   

   Note: Use -Dgpg.skip because GPG signing is not available in dev environments.
3. If build succeeds, run tests:

   mvn test > maven_tests.log 2>&1
   

4. If tests pass, run integration tests:

   mvn verify "-Dgpg.skip" > maven_it_tests.log 2>&1
   

5. Parse results: tail -20 maven_tests.log and grep -E "Tests run:|BUILD" maven_tests.log

Step 4: Version Bump

After successful mvn verify, bump the project version to the next patch release:

1. Update <version> in pom.xml (e.g. 3.0.2 → 3.0.3)
2. Update the Maven dependency snippet in README.md to the new version

Step 5: Update Documentation

README.md — Version Compatibility Table

• Only ADD a new line at the top of the table for the new version
• NEVER modify or replace existing lines in the table — they are historical records
• Update the Maven dependency snippet <version> to the new version

CHANGELOG.md

• First check if CHANGELOG.md exists in the repository
• If it exists, add a new version entry (e.g. ## 3.0.3 - 2026-04-20) with a ### Changed section listing all dependency updates
• Do NOT use [Unreleased] — use the concrete version number and today's date directly

Step 6: Verify Dependabot Coverage

Check .github/dependabot.yml to ensure new dependencies are covered by automated updates.

Step 7: Verify CI

gh run list --limit 5