Build: Use major.minor versions in runtime-deps baselines

[kevinjqliu]

Summary

This PR changes checkRuntimeDeps to store only major.minor in runtime-deps.txt files.

Previously, runtime-deps.txt stored full major.minor.patch versions but checkRuntimeDeps only flagged mismatches at the major.minor level. This allowed Dependabot patch bumps (e.g. 5.6.0 → 5.6.1) to pass CI without updating the baseline, but over time the baselines drifted from the actual resolved dependencies, causing PRs like #16204 to merge with stale baselines.

By storing only major.minor in the baseline, both generateRuntimeDeps and checkRuntimeDeps now operate on the same coordinates. Patch bumps produce identical entries so Dependabot PRs pass freely, while major/minor changes, added deps, and removed deps still fail the check.

Testing

./gradlew generateRuntimeDeps -DallModules=true --rerun-tasks

[kevinjqliu]

i was surprised by the drift in runtime-deps.txt, @RussellSpitzer wydt about this pattern to autoupdate for dependabot?

[RussellSpitzer]

@kevinjqliu Ryan and I discussed this in the previous work. Rather than letting dependapot automatically change the deps (or raise the change) we just decided to ignore patch updates. I still record them though so it may make sense to remove them

[RussellSpitzer]

I think I would vote that we just drop the patch's from the dependency text to avoid the churn there.

[kevinjqliu]

I think I would vote that we just drop the patch's from the dependency text to avoid the churn there.

i like that more, made the change

[RussellSpitzer]

Looks good to me but we'll have to do a fast rebase and merge to get this in, @kevinjqliu as soon as you rebase at tests pass I think you should merge

[kevinjqliu]

Ran

git merge origin/main -Xtheirs
./gradlew generateRuntimeDeps -DallModules=true --rerun-tasks

Thanks for the review