From 6f6e0a171c793d7e935087b35dd95ccc5f09a3c9 Mon Sep 17 00:00:00 2001 From: Ned Wolpert Date: Wed, 29 Jul 2026 07:12:44 -0700 Subject: [PATCH] build(deps): Hold logback on the 1.5 line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit logback 1.6.0 removed ch.qos.logback.classic.PatternLayout.DEFAULT_CONVERTER_MAP. Dropwizard 5's dropwizard-request-logging reads that field in a static initializer, so with logback 1.6.1 on the classpath every Dropwizard app dies at boot: java.lang.NoSuchFieldError: Class ch.qos.logback.classic.PatternLayout does not have member field 'java.util.Map DEFAULT_CONVERTER_MAP' at io.dropwizard.request.logging.layout.LogbackAccessRequestLayout. That is what fails dependabot PR #138 — 16 integration tests in :pk-auth-dropwizard plus the dropwizard-demo e2e run. Dropwizard 5.0.2 is the newest release and still resolves logback 1.5.x, so ignore minor and major logback updates until Dropwizard supports 1.6. Patch updates on 1.5.x still flow. The minor entry matters: 1.5 -> 1.6 is a semver-minor bump, so a major-only ignore (as used for Micronaut) would not have held the line. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5480e40..d5cd626 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,6 +24,14 @@ updates: update-types: ["version-update:semver-major"] - dependency-name: "io.micronaut.test:*" update-types: ["version-update:semver-major"] + # logback 1.6.0 removed ch.qos.logback.classic.PatternLayout.DEFAULT_CONVERTER_MAP, which + # Dropwizard 5's dropwizard-request-logging reads in a static initializer — every Dropwizard + # app then dies at boot with NoSuchFieldError (see PR #138). Dropwizard 5.0.2 is the newest + # release and still resolves logback 1.5.x, so stay on the 1.5 line — patch updates still + # flow. Drop this once Dropwizard ships logback 1.6 support. Note the minor entry: 1.5 -> 1.6 + # is a semver-minor bump, so ignoring majors alone would not hold the line. + - dependency-name: "ch.qos.logback:*" + update-types: ["version-update:semver-minor", "version-update:semver-major"] - package-ecosystem: "npm" directories: