Dependabot isn't as dependable as people would like it to be? :-)

[trixpan]

Description

Hi,

was tracking a snyk vulnerability in a project we use quarkus and noticed mermaid-js was out of date.

Checking the .github/dependabot.yml I can wee the package should have been auto-updated, yet, seems to have been forgotten?

@gsmet tagging you as you seem to be the 3PP overlord atm. ;-)

Implementation ideas

No response

[trixpan]

added #26555 meanwhile

[geoand]

We have a comment saying:

<!-- we don't add mermaid as a dependency as it brings a ton of things we don't use -->

which is I guess why we have not added the dependency to the dependencyManagement section of the build-parent pom.xml.
I assume this is why dependabot is not updating the dependency.

[trixpan]

@geoand it may be. I saw that comment and was a bit puzzled tbh. The wonders of maven... :-)

[geoand]

So we should either remove the comment (if it is no longer applicable), or comment out dependabot configuration for mermaid (with the appropriate explanation)

[geoand]

cc @gsmet

[gastaldi]

I created #26611 which makes the dependency visible to Dependabot and excludes any unwanted dependencies from where it is used