The Spring bom and the Spring Gradle plugin are versioned independently in the dependencies.gradle file:

ext.plugins = [
        // ...
        "org.springframework.boot:spring-boot-gradle-plugin:3.1.6",
        // ...
]

// BOMs
libraries["spring-boot-dependencies"] = "org.springframework.boot:spring-boot-dependencies:3.1.6"

This leads to mismatching issues when both dependencies should use the same version. Moreover, dependabot will create separate pull requests to bump these dependencies.

As a solution, we could have a common property "quarkus.version" and use it in both dependencies, though I'm not sure how compatible this would be for dependabot.

Another solution would be to try the Dependabot groups feature: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups

Acceptance Criteria

• Both dependencies should use the same version
• Dependabot should bump the both dependencies at the same time