Revert dependency version regression, fix dependabot config (#1104)

* Revert dependency bump that breaks Java 11 build

Dependabot changed `error-prone` library to 2.36.0 again in #1089,
re-breaking the fix that was included in #1083.

This reverts commit 6902df0.

* further dependabot config refinements

.github/dependabot.yml

@@ -3,11 +3,33 @@ updates:
   - package-ecosystem: maven
     directory: "/"
     schedule:
-      interval: daily
+      interval: weekly
     target-branch: main
+    ignore:
+      # Ignore minor version updates for dependencies with group ID "com.google.errorprone"
+      - dependency-name: "com.google.errorprone:*"
+        update-types: [ "version-update:semver-minor" ]
+    groups:
+      security:
+        # Group security updates into a single pull request
+        applies-to: security-updates
+        patterns:
+          - "*"
+      production-dependencies:
+        # Group version updates for "production" dependencies into a single pull request
+        applies-to: version-updates
+        dependency-type: production
+        patterns:
+          - "*"
+      development-dependencies:
+        # Group version updates for "development" dependencies into a single pull request
+        applies-to: version-updates
+        dependency-type: development
+        patterns:
+          - "*"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
     target-branch: main

pom.xml

@@ -81,7 +81,7 @@
         <threetenbp.version>1.7.0</threetenbp.version>
 
         <!-- Error Prone version > 2.31.0 can't run on JDK 11. see https://errorprone.info/docs/installation -->
-        <error-prone.version>2.36.0</error-prone.version>
+        <error-prone.version>2.31.0</error-prone.version>
 
         <jacoco.version>0.8.12</jacoco.version>
         <surefire.version>3.5.2</surefire.version>