deal with dependabot updates and failures

[DaanHoogland]

As a developer/release manager I would like for dependabot's updates to be applicable. At the moment all GHA for dependabot's PRs fail the updates do not seem to be appropriate even when the simplest tiny upgrades are attempted. It would be nice to be able to just apply these.
This situation mostly applies to the JS updates, but also mvn updates fail when attempted.

[dheeraj12347]

I’d like to investigate why Dependabot PRs are failing (JS and Maven) and propose fixes to make these updates applicable. I’ll start by analyzing recent Dependabot PR CI logs.

[dheeraj12347]

Hi @DaanHoogland
I looked into a few recent Dependabot PRs to see why they’re failing CI.

JS / UI PRs

#13036 (dompurify 3.2.6 → 3.4.0 in /ui):

build.yml passes; only “TestHook interrupted while sleeping” shows up in the logs.

ui.yml fails in the codecov/codecov-action@v4 step. The Codecov CLI logs show {"message":"Token required because branch is protected"} for the branch dependabot/npm_and_yarn/ui/dompurify-3.4.0, and the action exits with code 1.

I don’t see npm ci / npm run build failing here, so this looks like a Codecov + protected-branch issue, not a dompurify issue.

#12987 (fast-xml-parser 4.3.0 → 4.5.6 in /ui):

build.yml also passes with the same “TestHook interrupted while sleeping” messages.

The red checks come from UI Build and simulator/coverage workflows, not from the main Maven build.

Maven PRs

#12916 (maven-dependency-plugin 3.9.0 → 3.10.0):

ui.yml again fails at codecov/codecov-action@v4 with the same pattern: Codecov runs create-commit, gets HTTP 400 with {"message":"Token required because branch is protected"}, and fails the job.

#12915 (org.springframework.version 5.3.26 → 7.0.6):

ui.yml shows the same Codecov failure and Node 20 deprecation warning for codecov/codecov-action@v4.

From these, it looks like many Dependabot PRs (JS and Maven) are being marked failed mainly because Codecov cannot operate on protected Dependabot branches without a token, and because of shared simulator/coverage workflow issues, rather than because the underlying dependency bumps immediately break the main build.