Java package metadata for Dependabot updates

Dependabot uses the url, scm, and issueManagement fields in pom.xml files to create pull requests for Java dependency updates. When you include this metadata, pull requests will contain links to release notes and issue trackers, helping users update packages with confidence.

Metadata that Dependabot needs in pom.xml files

Dependabot uses the URLs for the project, the source code management system, and the issue management system to build the summary for update pull requests.

• url: The home page for the project. See More Project Information in the POM reference
• scm: The URL of the source code management system used by the project. See SCM in the POM Reference
• issueManagement: The URL of the issue management system used by the project. See Issue Management in the POM Referencex

Example for a project hosted on GitHub

<project>
  <url>https://github.com/OWNER/REPOSITORY</url>
  <scm>
    <url>https://github.com/OWNER/REPOSITORY</url>
  </scm>
  <issueManagement>
    <url>https://github.com/OWNER/REPOSITORY/issues</url>
  </issueManagement>
</project>

Impact of omitting project metadata from pom.xml files

If you forget to include the URLs that Dependabot checks for, then pull requests to update Java packages are still created. However, the information available to users in the pull request summary will be limited.

• Project repository or Source code management URL undefined: no links to release notes in Dependabot pull requests
• Issue management URL undefined: no link to the issues page for reporting problems.

Adding this information helps Dependabot provide better, more accurate updates for your project, complete with helpful links to release notes and issue trackers.

Further reading

• Maven SCM Plugin