Version policy : third-party upgrades in a minor release ?

[Tom Zeller]

Not urgent, but I do have a question about the Java Product Version Policy in regards to upgrading 3rd party dependencies in a minor release of the IdP. The policy states that 3rd party library upgrades “must follow the Java API compatibility rules”. My question is : how do we assess that ? Especially since our definition is broad.

There are some compliance checkers out there that we could use, but I doubt that they define API the way we do. Maybe they could be made to. Checking manually seems onerous.

Lacking a tool to check API compliance, it seems we would then in general not upgrade dependencies in a non-major release unless there are security issues.

I had been thinking we would bump non-major dependency (and Maven plugin) versions for the minor release of the IdP, but the policy seems to constrain that. Which is fine, it just means that we need a major version bump to freely upgrade dependencies which don’t have security updates.

Thoughts ?