)]}' { "log": [ { "commit": "d1e67ee464c9809bb3ec2d3093a8ba5392a6b012", "tree": "4d37cf0b1775c087d0cbca25dc682bacfb53549f", "parents": [ "12d46630deb9f47b40b847b209294370b0376373" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Nov 10 19:22:39 2026 +0100" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Nov 10 20:42:40 2026 +0100" }, "message": "Build against Maven 3.9.16 instead of Maven 3.10.0\n\nMaven 3.10.0 is the first 3.x release that ships Resolver 2, and the plugin declares a\nMaven 3.9 prerequisite. Back to Maven 3.9.16.\n\nRefs: apache/maven-parent#636\n" }, { "commit": "12d46630deb9f47b40b847b209294370b0376373", "tree": "5510152262d73b722bed1c62758cb600bff98dbd", "parents": [ "d0d20efac6898e8d125fb5bebb62189313fbeaab" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Nov 05 07:45:47 2026 +0100" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sat Nov 07 17:12:54 2026 +0100" }, "message": "Fix #1074: requireSameVersions no longer drops members sharing a version\n\nRequireSameVersions.execute merged the per-source (dependency, build\nplugin, report plugin) results with Map.putAll, so a version shared by\ntwo sources had the earlier source\u0027s members silently replaced by the\nlater one\u0027s in the failure message. Detection was unaffected, only the\nmessage was incomplete.\n\ncollectVersionMembers now writes directly into the shared map instead\nof returning a separate map to be merged with putAll.\n" }, { "commit": "d0d20efac6898e8d125fb5bebb62189313fbeaab", "tree": "9cc82d8b01a19de4780147c797d7bbab0992b40d", "parents": [ "6d313829d2ae3e4b2af4057b7f5a0bdc5b0c0386" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sat Nov 07 13:37:39 2026 +0100" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sat Nov 07 14:52:56 2026 +0100" }, "message": "Extend ATR configuration in .asf.yaml\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6d313829d2ae3e4b2af4057b7f5a0bdc5b0c0386", "tree": "082540bb72fcd1cdc5db829f430ece9307c886ac", "parents": [ "589014a35ab759712cdd134be5bb9e3a0cf468ce" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 29 14:10:05 2026 +0100" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sat Nov 07 13:14:28 2026 +0100" }, "message": "Fix #532: include classifier and extension in convergence key\n\nDependencyVersionMap.constructKey(Artifact) grouped dependencies for\nthe convergence check by groupId:artifactId alone. Two artifacts that\nshare groupId:artifactId but differ by classifier or extension -- for\nexample platform-specific native jars published under the same\ngroupId:artifactId with a different classifier per OS/arch -- are\ndifferent files that can legitimately carry different versions, but\ngot bucketed into the same convergence group and reported as a\nversion conflict.\n\nconstructKey now includes classifier and extension, matching how\nMaven identifies a specific artifact. Added DependencyConvergenceTest\ncovering both cases: different classifiers with different versions no\nlonger conflict, while a real same-classifier version mismatch still\ndoes.\n" }, { "commit": "589014a35ab759712cdd134be5bb9e3a0cf468ce", "tree": "323b166af5da1f6eba1b0b60e06a27db69d7bf67", "parents": [ "7e2aa28a37c49a6e06f3018cf872cc7dddb09251" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Nov 06 12:26:02 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Nov 06 16:27:26 2026 +0100" }, "message": "Bump org.xerial.snappy:snappy-java\n\nBumps [org.xerial.snappy:snappy-java](https://github.com/xerial/snappy-java) from 1.1.10.4 to 1.1.10.9.\n- [Release notes](https://github.com/xerial/snappy-java/releases)\n- [Commits](https://github.com/xerial/snappy-java/compare/v1.1.10.4...v1.1.10.9)\n\n---\nupdated-dependencies:\n- dependency-name: org.xerial.snappy:snappy-java\n dependency-version: 1.1.10.9\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "7e2aa28a37c49a6e06f3018cf872cc7dddb09251", "tree": "11f36c1922efc1721835a3cbaf8b36ec19253a0f", "parents": [ "24c2df4335944be50f119804803d13d9e7613855" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Nov 05 02:06:15 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Nov 06 13:20:19 2026 +0100" }, "message": "Cover the plugins form of requireSameVersions and keep MENFORCER-395\n\nA project with a snapshot dependency fails an includes-only requireReleaseDeps, so always-pass cannot host that case; the NPE guard needs a project without one.\n" }, { "commit": "24c2df4335944be50f119804803d13d9e7613855", "tree": "dfdfbad3edd4ac49bad6c0d3d21eba4c58bb5817", "parents": [ "4348f62c6c10e454ca111e45beeef33b1e632265" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Nov 04 21:46:36 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Nov 06 13:20:19 2026 +0100" }, "message": "Combine and tighten the enforcer ITs\n\nalways-pass hosts one passing configuration per rule so the POM XML binding stays covered; require-snapshot-version_success stays separate because the project version cannot be both a release and a snapshot.\n" }, { "commit": "4348f62c6c10e454ca111e45beeef33b1e632265", "tree": "1b1755f1521fd45cc702f235b6c51fa7d853ff71", "parents": [ "0d0d5c7e0ec80c47bfc37ad0e555ccc5586af616" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Nov 05 01:50:21 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Nov 06 13:20:11 2026 +0100" }, "message": "Keep the managed report plugin IT and assert the property value is not leaked\n\nThe IT guards #916: only a real Maven build shows what the rule receives for a report plugin whose version comes from pluginManagement alone.\n" }, { "commit": "0d0d5c7e0ec80c47bfc37ad0e555ccc5586af616", "tree": "28f16cd5d7966efe2f2a8520244af9000caeb5b7", "parents": [ "49867db695d3963a695cdf4f751a8a45165d2434" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Nov 04 21:15:55 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Nov 06 13:20:11 2026 +0100" }, "message": "Replace twelve ITs with unit tests\n\nRules keep their pass ITs. The unit tests now assert the failure messages and the warn level, rulesToSkip and display-info logging the removed ITs checked through build.log.\n" }, { "commit": "49867db695d3963a695cdf4f751a8a45165d2434", "tree": "2b5e915dac6774068e17c41ea047984145927dac", "parents": [ "5c97986e7a1288b3bc113aee51c3c75af701aea3" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 29 19:05:55 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 11:41:45 2026 +0100" }, "message": "Bump com.google.guava:guava\n\nBumps [com.google.guava:guava](https://github.com/google/guava) from 32.0.0-jre to 33.7.1-jre.\n- [Release notes](https://github.com/google/guava/releases)\n- [Commits](https://github.com/google/guava/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.google.guava:guava\n dependency-version: 33.7.1-jre\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "5c97986e7a1288b3bc113aee51c3c75af701aea3", "tree": "501113e910fa3d4899e605079028705b6e57bbdb", "parents": [ "318be66ecdd08af52aeefa16ba179ea06fd62386" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 00:29:31 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 11:41:33 2026 +0100" }, "message": "Use inputExcludes for apache-rat-plugin and remove redundant javaVersion\n" }, { "commit": "318be66ecdd08af52aeefa16ba179ea06fd62386", "tree": "6c42d1e83483bcf3d480cc492d25ef0c9cd622ab", "parents": [ "3cf92cad96d41713a905d5d45a21f0296e1451fb" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 19:08:47 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 11:41:17 2026 +0100" }, "message": "Declare the Maven artifacts the code uses\n\nenforcer-rules: org.eclipse.sisu.inject (provided).\nmaven-enforcer-extension: org.eclipse.sisu.plexus (provided).\nmaven-enforcer-plugin: maven-resolver-api (compile).\n" }, { "commit": "3cf92cad96d41713a905d5d45a21f0296e1451fb", "tree": "64fa9aebdd1b539b7613f82ba5a57fa904159d98", "parents": [ "94a48fc17eae9770ee40fb58bc14f9254aa52dc2" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 07:31:51 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 19:34:36 2026 +0100" }, "message": "Point ciManagement at GitHub Actions\n" }, { "commit": "94a48fc17eae9770ee40fb58bc14f9254aa52dc2", "tree": "ce262d2ef673ce30009b0cdd9b4f7864624dddfe", "parents": [ "f63b3d505c5ce9acc3a90559d051ffd398e34710" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 13:05:10 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 18:48:33 2026 +0100" }, "message": "Clean up declared dependencies\n\nRemoved:\n- javax.annotation-api (maven-enforcer-plugin)\n" }, { "commit": "f63b3d505c5ce9acc3a90559d051ffd398e34710", "tree": "ac1adeca7fdcd69d674d8ba6ade89e0c0d76e33b", "parents": [ "465ebf280e7f7efd9acf9f524b114df69a33c524" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Oct 26 23:26:09 2026 +0100" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Oct 26 23:26:09 2026 +0100" }, "message": "[maven-release-plugin] prepare for next development iteration\n" }, { "commit": "465ebf280e7f7efd9acf9f524b114df69a33c524", "tree": "78f6d4333418164332222621b73867020baf6135", "parents": [ "b24b05c33fd23e710d28e663b83311377be6f3e2" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Oct 26 23:25:49 2026 +0100" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Oct 26 23:25:49 2026 +0100" }, "message": "[maven-release-plugin] prepare release enforcer-3.7.0\n" }, { "commit": "b24b05c33fd23e710d28e663b83311377be6f3e2", "tree": "288e7fa6eac2f0727d0a19f3760ec2d04a85f3e5", "parents": [ "2b75dd32499dc971ca990ba5b62d564f3709122b" ], "author": { "name": "Efe Gökdemir", "email": "gokdemirefe1903@gmail.com", "time": "Mon Oct 26 17:28:32 2026 +0300" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Oct 26 22:56:04 2026 +0100" }, "message": "Fix test-scope mediation in RequireUpperBoundDeps\n" }, { "commit": "2b75dd32499dc971ca990ba5b62d564f3709122b", "tree": "84983255a081f837baed4bfc9b2452e4a90f6d93", "parents": [ "b519cd0372a170ef29b8318f251f7d5067972a21" ], "author": { "name": "Sambuddha-Jana", "email": "sambuddhajana1@gmail.com", "time": "Tue Oct 27 02:41:14 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 22:11:14 2026 +0100" }, "message": "Improve RequireUpperBoundDeps error message (#1059)\n\n* Improved RequireUpperBoundDeps error message\n\n* Extract dependencyManagement suggestion helper and handle classifier\n\n* Update integration test expectation for requireUpperBoundDeps message" }, { "commit": "b519cd0372a170ef29b8318f251f7d5067972a21", "tree": "f31c80d58427dc7426b4b3e8e0475fa9ceeedb10", "parents": [ "f6222345ba1fbce5839ad45dd8ba650d2e052d31" ], "author": { "name": "Efe Gökdemir", "email": "gokdemirefe1903@gmail.com", "time": "Sat Oct 17 12:52:43 2026 +0300" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 25 18:19:11 2026 +0100" }, "message": "Fix EnforcerRuleCache concurrency across plugin realms (#1055)\n" }, { "commit": "f6222345ba1fbce5839ad45dd8ba650d2e052d31", "tree": "3c6f692d3f02df88b333bcaf15c67053e04e1969", "parents": [ "5a9ebca1b513ea6c1276f40dee7c8b9288fc569c" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 24 16:36:07 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 24 22:51:47 2026 +0200" }, "message": "Ignore SLF4J 2.x in Dependabot\n\nMaven 3 exports slf4j-api 1.7.x to plugins, so this component stays on\nSLF4J 1.7.x. See apache/maven-parent#623." }, { "commit": "5a9ebca1b513ea6c1276f40dee7c8b9288fc569c", "tree": "3c9b9169d695b37e202069cb6041f19142e39d6c", "parents": [ "e8512d0095bd082db1e933315b6f9d020b113464" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Wed Oct 21 00:02:07 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Wed Oct 21 18:55:53 2026 +0200" }, "message": "Remove redundant rat configuration\n" }, { "commit": "e8512d0095bd082db1e933315b6f9d020b113464", "tree": "e6e0f2f66bc09e4530d0eaef85e2b5cd2914881b", "parents": [ "08605b22b95923741b9da272987eb96d2c10850e" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Oct 20 23:56:38 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Wed Oct 21 10:11:01 2026 +0200" }, "message": "Fix ATR project name\n" }, { "commit": "08605b22b95923741b9da272987eb96d2c10850e", "tree": "9004b66c6da51a76bd2f3555cd353459be6734c1", "parents": [ "fbe1ae506c1defdb2d80d3a8298342905d68f912" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 18 11:39:46 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 18 12:27:47 2026 +0200" }, "message": "Use push for PR Automation\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fbe1ae506c1defdb2d80d3a8298342905d68f912", "tree": "b7615afe08d324e82be73d3593a12ecf9405132c", "parents": [ "b1d59aa6cc14579577c723b0b2b8c875e463773b" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sat Oct 17 01:26:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 01:26:09 2026 +0200" }, "message": "Use workflow_run for PR check (#1056)\n\n* Use workflow_run for PR check\n\nPR check runs on workflow_run after the new PR Signal workflow\ninstead of pull_request_target.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Restore synchronize in PR Signal\n\nPR check reports a commit status on the PR head, so it has to run\nagain for every new head commit.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Rename the PR check workflow to PR Check\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "b1d59aa6cc14579577c723b0b2b8c875e463773b", "tree": "dc7167708ceaf009e8dc9c2a2e3f0558181f0334", "parents": [ "80ae97366a6f17fae279cf9b62a0edf16e1a7efb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 13 20:50:59 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Oct 14 01:43:49 2026 +0200" }, "message": "Bump commons-codec:commons-codec from 1.22.1 to 1.23.0\n\nBumps [commons-codec:commons-codec](https://github.com/apache/commons-codec) from 1.22.1 to 1.23.0.\n- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)\n- [Commits](https://github.com/apache/commons-codec/compare/rel/commons-codec-1.22.1...rel/commons-codec-1.23.0)\n\n---\nupdated-dependencies:\n- dependency-name: commons-codec:commons-codec\n dependency-version: 1.23.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "80ae97366a6f17fae279cf9b62a0edf16e1a7efb", "tree": "16eea3f91449a2bfd682cb72d5fe117e6ec4a804", "parents": [ "30c1ccee40bff38e92ddada3e567225e1f40ef79" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Thu Oct 08 20:39:35 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Thu Oct 08 20:39:35 2026 +0200" }, "message": "Trigger asf process\n\n[ci skip]\n" }, { "commit": "30c1ccee40bff38e92ddada3e567225e1f40ef79", "tree": "bdbcfb2870fdca12a1c4af1dd0a19849d6114422", "parents": [ "44b1c84198c12151d6dd2c1188405b21d99e2e9d" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 22:12:18 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Wed Oct 07 22:44:14 2026 +0200" }, "message": "Add project metadata for ATR\n\n[ci skip]\n" }, { "commit": "44b1c84198c12151d6dd2c1188405b21d99e2e9d", "tree": "f677f78b5d23d532c96debde71fdd6298005cff9", "parents": [ "cb2937757f0047943c147325dd81cb7da059e400" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Fri Oct 02 23:34:48 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 04 16:37:21 2026 +0200" }, "message": "Use ReaderInputStream builder in RequireTextFileChecksum\n\nReplace the deprecated ReaderInputStream(Reader, Charset) constructor\nfrom Commons IO with ReaderInputStream.builder().\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "cb2937757f0047943c147325dd81cb7da059e400", "tree": "0386cfb7cc240be9f9dcc8d0b63b1a5c697d1f28", "parents": [ "bd02cfbef47299c6c902eabbeb4b605259502b8c" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Fri Oct 02 23:24:03 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 04 15:55:39 2026 +0200" }, "message": "Use Resolver RemoteRepository in BannedRepositories\n\nReplace the deprecated ArtifactRepository API with\nMavenProject.getRemoteProjectRepositories() and\nMavenProject.getRemotePluginRepositories(), which return\norg.eclipse.aether.repository.RemoteRepository.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "bd02cfbef47299c6c902eabbeb4b605259502b8c", "tree": "f1573347a52a0e6f9957fd1e1af25354b8e1bc1c", "parents": [ "1a59e208f5534c4bf1206568611098ea4145b9f7" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sat Oct 03 16:12:24 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 04 14:44:30 2026 +0200" }, "message": "Add PR check workflow\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1a59e208f5534c4bf1206568611098ea4145b9f7", "tree": "10d4b88b3c45edbd9495a4bebb7a6ed5a2341689", "parents": [ "8dbec6d08b039045e18dbf4b9fd1b76e07414b9e" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Sep 30 23:33:02 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Oct 04 13:32:30 2026 +0200" }, "message": "Resolve plugins on copies of the model plugins\n" }, { "commit": "8dbec6d08b039045e18dbf4b9fd1b76e07414b9e", "tree": "53cd91b76596ae6a8866f3b627bb999b0609f8f6", "parents": [ "0fb43e7c447f0e4a468696c9d7aa48ca89350724" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 01 07:27:07 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Oct 04 13:30:24 2026 +0200" }, "message": "Name enforcer 4.0.0 as the release that removes the legacy rule API\n" }, { "commit": "0fb43e7c447f0e4a468696c9d7aa48ca89350724", "tree": "0d8e6fdcd72dd0685e65dc99f841d69a9c2e27a1", "parents": [ "019cc76f8e38182f730f7560d11928648570097a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Oct 04 12:53:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 04 12:53:03 2026 +0200" }, "message": "Bump mavenVersion from 3.9.16 to 3.10.0 (#1050)\n\nBumps `mavenVersion` from 3.9.16 to 3.10.0.\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.16 to 3.10.0\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.16...maven-3.10.0)\n\nUpdates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-model` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-model-builder` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-settings` from 3.9.16 to 3.10.0\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-artifact\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-plugin-api\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-core\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-model\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-model-builder\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-settings\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "019cc76f8e38182f730f7560d11928648570097a", "tree": "868215caca6fe188c4f4bf697af9ea7117f3d75f", "parents": [ "5d1ed124ba70c273ab4d7e0db1443efe3bf801fb" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Fri Oct 02 20:19:15 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Fri Oct 02 20:19:15 2026 +0200" }, "message": "Simplify GH PR template boilerplate\n\n[ci skip]\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "5d1ed124ba70c273ab4d7e0db1443efe3bf801fb", "tree": "c82708477c2bd0baa51529f574a0a5ca23c321f6", "parents": [ "260dfdfdbd59711d70962531f538d27b88db1063" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 02 06:14:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 02 06:14:07 2026 +0200" }, "message": "Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#1045)\n\nBumps org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-lang3\n dependency-version: 3.21.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "260dfdfdbd59711d70962531f538d27b88db1063", "tree": "2e0bf99612280309caef06d62b5e296b4fececc2", "parents": [ "d0c876646620ae769b7e57aa53d2078f01bc2757" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 01 08:07:02 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 01 10:58:49 2026 +0200" }, "message": "Replace plexus-utils StringUtils with commons-lang3 in enforcer-rules\n" }, { "commit": "d0c876646620ae769b7e57aa53d2078f01bc2757", "tree": "2b37f2a5a8bdf99b579a589198773b1dfa24457f", "parents": [ "cd13c7acba9cae31c9394519e5fc5c650a18d15f" ], "author": { "name": "Julio Gómez Díaz", "email": "28807086+juliojgd@users.noreply.github.com", "time": "Wed Sep 30 23:47:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 23:47:20 2026 +0200" }, "message": "[MENFORCER-433] Add banPropertyPrefix rule to ban Maven properties by configured prefixes (#1039)\n\n* Add banPropertyPrefix rule (MENFORCER-433)\n\nNew rule that fails the build when any Maven property starts with one\nof the configured banned prefixes. Prefixes are configured through a\nprefixes/prefix list; every entry may also hold several comma-separated\nprefixes. An optional custom message can be provided.\n\nhttps://issues.apache.org/jira/browse/MENFORCER-433\n\n* Add tests for banPropertyPrefix rule (MENFORCER-433)\n\nhttps://issues.apache.org/jira/browse/MENFORCER-433\n\n* Add documentation for banPropertyPrefix rule (MENFORCER-433)\n\nhttps://issues.apache.org/jira/browse/MENFORCER-433\n\n* Use neutral example prefixes in banPropertyPrefix tests and docs\n\n* Add integration tests for banPropertyPrefix rule (MENFORCER-433)\n\n* Use assertThrows and assertDoesNotThrow in TestBanPropertyPrefix\n\nApply review feedback: replace try/fail/catch blocks with\nassertThrows when an exception is expected and assertDoesNotThrow\nwhen the rule should pass.\n\n* Fix author name in banPropertyPrefix documentation\n\n* Use ASCII-only author name in banPropertyPrefix docs\n\n* fix: do not log property values in banPropertyPrefix error message\n\nListing matched property values in the build log can expose\ncredentials or tokens when configurable prefixes match sensitive\nproperties. Join only the offending property names instead.\n\n* Align ban-property-prefix-fail IT with value-free error message\n\nThe IT verification script still asserted the property value in the\nbuild log while the rule no longer logs it. Check that the offending\nproperty key is present and that its value is not leaked." }, { "commit": "cd13c7acba9cae31c9394519e5fc5c650a18d15f", "tree": "874a44c85446b781fbf06dc5bb3f5cf1218a18fc", "parents": [ "01ba46f87e0e0f8646e65d6e765c13f740acdf70" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 20:34:38 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Wed Sep 30 20:30:48 2026 +0200" }, "message": "Skip banDuplicatePomDependencyVersions ITs on Maven 3.10+\n\nMaven 3.10.0 promoted the duplicate dependency declaration check to a\nPOM reading error, like Maven 4 does. The build fails while the project\nis being read, before the enforcer plugin is executed, so the three ITs\nasserting the rule error message cannot pass there.\n\nExtend the existing Maven 4 exclusion to 3.10+ and note in the rule\ndocumentation that the rule is only useful with older Maven versions.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "01ba46f87e0e0f8646e65d6e765c13f740acdf70", "tree": "8d1d159b3a952fd2468999d514ed2534d62fba59", "parents": [ "6a192d9c25b529a2f5d6fa00d4983eb21b0b2af5" ], "author": { "name": "schwarfl", "email": "schwarfl@users.noreply.github.com", "time": "Tue Sep 29 23:05:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 29 23:05:30 2026 +0200" }, "message": "[MENFORCER-517] RequireReleaseDeps checks now also for optional dependencies (#1025)" }, { "commit": "6a192d9c25b529a2f5d6fa00d4983eb21b0b2af5", "tree": "ec9b8ebaf3020c01b23dc9742c23961eb9fd2adc", "parents": [ "f50585a9b5d069453caae36477d287ec69ef856b" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Sep 29 18:34:19 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Sep 29 19:20:33 2026 +0200" }, "message": "Keep Dependabot off Mockito 5\n\nMockito 5 requires Java 11, and CI still builds on JDK 8.\n" }, { "commit": "f50585a9b5d069453caae36477d287ec69ef856b", "tree": "828603342311d5afafe6a8c48413cf77b0732814", "parents": [ "3c3703c1eb645f5a59bf068c472a164abbdb29bb" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 18:10:04 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 19:09:13 2026 +0200" }, "message": "Bump project version to 3.7.0-SNAPSHOT\n" }, { "commit": "3c3703c1eb645f5a59bf068c472a164abbdb29bb", "tree": "d528ee14b3961c90c46bb96f656e7cb8b11f5e22", "parents": [ "1f55ad396c83b141d89b708f7c8e2bf2a2f77372" ], "author": { "name": "Efe Gökdemir", "email": "efe@rexcode.co.uk", "time": "Wed Sep 23 18:14:57 2026 +0300" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 18:13:00 2026 +0200" }, "message": "fix: avoid legacy warning for unknown enforcer rules\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e\n" }, { "commit": "1f55ad396c83b141d89b708f7c8e2bf2a2f77372", "tree": "63f61912a9151202d1ab279fcf85da3e8207af9f", "parents": [ "e30b94ba83bf5fb6d3c707224dae38f10af19da4" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 12:50:01 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 13:46:23 2026 +0200" }, "message": "Match both log levels in the BUILD FAILURE IT assertions\n\nMaven 4.0.0-rc-7 and 3.10.0 log the build result summary at ERROR level,\nso the line reads [ERROR] BUILD FAILURE. The three ITs that assert the\n[INFO] prefix therefore fail on those versions. Match either prefix, so\nthe ITs pass on Maven 3.9.x and on 4.x alike.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e30b94ba83bf5fb6d3c707224dae38f10af19da4", "tree": "a3f71bd95c76691628886e8c15c050b7ef3a3115", "parents": [ "f48b0915490df53197e07b864c3b15f4f6d10b6f" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Thu Sep 17 00:07:48 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 29 08:56:35 2026 +0200" }, "message": "requireFilesExist should accept a symbolic link\n\nThe case check added for #477 compares the configured file name with the\none from getCanonicalFile(), which resolves a symbolic link to its\ntarget. A link whose name differs from its target name - the normal case\n- was therefore reported as missing.\n\nKeep getCanonicalFile() for a regular file, where nothing is resolved\naway, and look the name up among the entries of the parent directory\nwhen the path is a symbolic link. A directory entry carries the name as\nit is stored on disk. toRealPath(NOFOLLOW_LINKS) would be cheaper but is\nnot an option: it corrects the case only since JDK 21, so on an older\nJDK the check would silently pass for any name.\n\nMove the check to AbstractRequireFiles behind a shared fileExists(File),\nso that all three rules share one notion of an existing file. This\nchanges behaviour on a case-insensitive filesystem: requireFilesDontExist\nno longer fails on a file whose name differs only in case, and\nrequireFilesSize reports such a file as missing instead of measuring a\ndifferent file. Document the case handling on the three rule pages.\n\nThe symbolic link tests and the relative path IT come from #297. The\ntry/catch blocks in the touched test classes are converted to\nassertThrows along the way.\n\nFixes #501\n\nCo-authored-by: Jason Irwin \u003cjason.irwin@idoxgroup.com\u003e\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f48b0915490df53197e07b864c3b15f4f6d10b6f", "tree": "a60191a8f88ef51e4041d657e50e3103b28e190a", "parents": [ "4779cad12cbb274de200287b3ca8e1fcf103bbd7" ], "author": { "name": "Dhruv_G_123", "email": "9bdhruv@gmail.com", "time": "Mon Sep 28 02:23:26 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 27 22:53:26 2026 +0200" }, "message": "Improve RequireUpperBoundDeps error message (#1022)\n\n* Improve RequireUpperBoundDeps error message\n\n* Update managed dependency integration test\n\n* Address review feedback for ENFORCER-937" }, { "commit": "4779cad12cbb274de200287b3ca8e1fcf103bbd7", "tree": "598f71dfae342b328cebb21e92b4e07064438114", "parents": [ "598b42607787da109cc9f9d3ddfb3c64c1c66054" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 25 16:28:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 25 16:28:05 2026 +0200" }, "message": "Bump org.apache.maven:maven-parent from 49 to 50 (#1036)\n\n* Bump org.apache.maven:maven-parent from 49 to 50\n\nBumps [org.apache.maven:maven-parent](https://github.com/apache/maven-parent) from 49 to 50.\n- [Release notes](https://github.com/apache/maven-parent/releases)\n- [Commits](https://github.com/apache/maven-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-parent\n dependency-version: \u002750\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\n\n* Use inputExcludes for apache-rat 0.18\n\nKeep the rat configuration in pluginManagement; the check itself is\nactivated by the parent\u0027s java17+ profile on JDK 17+.\n\nSigned-off-by: Sylwester Lachiewicz \u003cslachiewicz@apache.org\u003e\n\n* Use version.maven-surefire-plugin in ITs\n\nmaven-parent 50 removed the version.maven-surefire property (apache-parent 40\nrenamed it), so the invoker @token@ interpolation no longer resolves and the\nIT builds fail on surefire plugin resolution.\n\nSigned-off-by: Sylwester Lachiewicz \u003cslachiewicz@apache.org\u003e\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nSigned-off-by: Sylwester Lachiewicz \u003cslachiewicz@apache.org\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Sylwester Lachiewicz \u003cslachiewicz@apache.org\u003e" }, { "commit": "598b42607787da109cc9f9d3ddfb3c64c1c66054", "tree": "9845b63504cd55daa0f51fe53e872735242521d5", "parents": [ "c991d455dad93b46a40a367ef55896ea79c79431" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Sep 20 12:20:16 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Sep 20 12:47:53 2026 +0200" }, "message": "Deprecate the evaluateBeanshell rule\n\nBeanShell is being retired across Maven (apache/maven#13207); the bsh\nartifact has had no release on Central since 2016. The rule keeps working\nand logs a warning so users have time to move to a built-in or custom rule.\n" }, { "commit": "c991d455dad93b46a40a367ef55896ea79c79431", "tree": "cd8a3650775659e1295a8fcf86b54a1d3d746250", "parents": [ "b19171b436d7dbaa5f18fde6177d9dd6c09316cb" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Sep 19 23:51:35 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Sep 20 00:18:59 2026 +0200" }, "message": "Drop Hamcrest from tests\n" }, { "commit": "b19171b436d7dbaa5f18fde6177d9dd6c09316cb", "tree": "5c9a83c934790cfb0934f0be65dbda4d91318794", "parents": [ "29bc41ac7295ec0e50004aca44255e261afa92cc" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Sep 17 22:49:41 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Sep 17 22:55:39 2026 +0200" }, "message": "Ignore mrm-maven-plugin 2.x in Dependabot\n\nmrm-maven-plugin 2.0.0 declares a Java 17 prerequisite and this project\nstill builds on an older Java level. Drop this rule once javaVersion is 17.\n" }, { "commit": "29bc41ac7295ec0e50004aca44255e261afa92cc", "tree": "7f760bd400c41a24127b1a13cfb022ed484c4c64", "parents": [ "d255d1f8e61196f6c6003ac00ad0c881b42f5881" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 15 21:39:04 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 15 23:08:31 2026 +0200" }, "message": "Use junit instead of hibernate-annotations as corrupted-jar IT fixture\n\nThe enforce-bytecode-version-with-corrupted-jar IT pulled\norg.hibernate:hibernate-annotations:3.4.0.GA only to have a jar to\ncorrupt. Reuse junit:junit:4.13.2, which the IT already declares, and\ndrop the extra dependency.\n\nThe IT runs before the others (invoker.ordinal) and now removes the\nwhole junit/junit/4.13.2 directory from the local repository in\nverify.groovy, so the following ITs resolve a clean artifact again.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d255d1f8e61196f6c6003ac00ad0c881b42f5881", "tree": "760b78dc36bad1bf0fd7b81dda264cfad8c16c23", "parents": [ "85e321f0b7ea23e890961b86cc6a6b11d0e70f49" ], "author": { "name": "Dhruv_G_123", "email": "9bdhruv@gmail.com", "time": "Wed Sep 16 02:16:06 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 22:46:06 2026 +0200" }, "message": "Fix/916 require same versions for managed report plugins (#1024)\n\n* Fix RequireSameVersions for managed report plugins\n\n* Handle build plugin versions for report plugins\n\n* Address review feedback for RequireSameVersions" }, { "commit": "85e321f0b7ea23e890961b86cc6a6b11d0e70f49", "tree": "a7c200cb17cc65df4545f29c4274a5c65307f05e", "parents": [ "b6afbe998e5039a803aa3ffd2a8e9fbaeb00c565" ], "author": { "name": "Dhruv_G_123", "email": "9bdhruv@gmail.com", "time": "Tue Sep 15 22:32:31 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 15 19:02:31 2026 +0200" }, "message": "[ENFORCER-939] Support enforcer.skip without a POM (#1021)" }, { "commit": "b6afbe998e5039a803aa3ffd2a8e9fbaeb00c565", "tree": "9b6568e1ac039c6eabc59bfa178d0b2d0caaa8c5", "parents": [ "c09fce54a78e72ae67556241e78c5a8efd2301a5" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Sep 14 21:03:23 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Sep 14 21:47:34 2026 +0200" }, "message": "Decouple the includes IT from the commons-lang3 fixture version\n\nThe verify script pinned the exact version reported as banned, so a\nPOM-only bump of the fixture fails the IT - the same coupling that\na4e30b9 removed from the log4j-api fixtures.\n\nMatch the reported version with a regular expression instead. The\nassertion keeps its strength: commons-lang3 has to be reported and\njsr305 must not be.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c09fce54a78e72ae67556241e78c5a8efd2301a5", "tree": "d60c66195aac943bacd15d780c0e7323214ed588", "parents": [ "b00415a8bfa3f89b32b985305acbd33fa7d05bcc" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 14 18:38:17 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Sep 14 21:47:34 2026 +0200" }, "message": "Bump org.apache.commons:commons-lang3\n\nBumps org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-lang3\n dependency-version: 3.18.0\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "b00415a8bfa3f89b32b985305acbd33fa7d05bcc", "tree": "e4348e0019ca7ecb67557fb1f87fdd100fa8f1fa", "parents": [ "4991d9c001c332e9011476950e4a3d31764d80e5" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 14 18:38:01 2026 +0000" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Sep 14 21:11:24 2026 +0200" }, "message": "Bump org.apache.commons:commons-lang3\n\nBumps org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-lang3\n dependency-version: 3.18.0\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "4991d9c001c332e9011476950e4a3d31764d80e5", "tree": "6a5f72736ec4ecbeb7e206106686109740ea2e76", "parents": [ "bf83746a09c38d1b051a61e2bc8df70f1fcaa8ad" ], "author": { "name": "Nikulin Nikita", "email": "42353747+w3lld1@users.noreply.github.com", "time": "Mon Sep 14 21:37:14 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 20:37:14 2026 +0200" }, "message": "fix: correct enforceBytecodeVersion excludes filtering (#990)\n\n* Fix enforceBytecodeVersion excludes filtering\n\nInvert the ArtifactMatcher result so excluded dependencies are skipped while include overrides remain eligible for bytecode checks. Add regression coverage for excludes with and without include overrides.\n\n* Cover enforceBytecodeVersion excludes and includes in integration tests\n\nThe enforce-bytecode-version-excluded-deps project excluded every\ndependency with *:* at maxJdkVersion 1.4, so it passed just as well when\nfilterDependencies() returned nothing at all.\n\nNarrow the exclude to commons-lang3, the only dependency targeting a JDK\nabove the threshold, and keep jsr305 as a dependency that is really\nanalysed and passes.\n\nAdd enforce-bytecode-version-included-deps for the case where an include\noverrides a wide exclude - there the build has to fail on commons-lang3\nalone.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n\n---------\n\nSigned-off-by: w3lld1 \u003c42353747+w3lld1@users.noreply.github.com\u003e\nCo-authored-by: Slawomir Jaranowski \u003cs.jaranowski@gmail.com\u003e\nCo-authored-by: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "bf83746a09c38d1b051a61e2bc8df70f1fcaa8ad", "tree": "dcae2216ab0af00270bd9bb69e617c59d2af24d3", "parents": [ "a53e3954ca27af222816086a7d092af03c03d798" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Aug 31 16:36:23 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Sep 01 00:31:42 2026 +0200" }, "message": "Use JSR-330 for components injection\n" }, { "commit": "a53e3954ca27af222816086a7d092af03c03d798", "tree": "3ee60a2f7c753a92e4d61e2b6afceb87cb19fa9f", "parents": [ "a4e30b9a505295771eaeb0a1a5c34c330de12250" ], "author": { "name": "Abdullah", "email": "89297042+AzazelSensei@users.noreply.github.com", "time": "Thu Aug 27 22:26:40 2026 +0000" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Aug 31 16:12:32 2026 +0200" }, "message": "Add tests for requireJavaVersion five-part JDK strings #980\n\nnormalizeJDKVersion(21.0.10.0.1) becomes 21.0.10-0, so a requireJavaVersion\npin of ${java.version} only passes when the raw runtime string is tried first.\n" }, { "commit": "a4e30b9a505295771eaeb0a1a5c34c330de12250", "tree": "6a5a7944deebfeaf964801d5746cc727a67b14f1", "parents": [ "63637d86bcf944f2b4386cd79450c21c041bed14" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Aug 27 23:46:43 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Aug 28 01:12:26 2026 +0200" }, "message": "Decouple enforceBytecodeVersion ITs from the log4j-api fixture version\n\nThe IT POMs and their verify scripts both pinned the exact log4j-api\nversion, so every fixture upgrade required touching the two files in\nsync, and a POM-only bump failed the IT verification.\n\nMove the version into a \u003clog4j.version\u003e property and make the script\nassertions match the artifact regardless of its version. Bumping the\nfixture is now a one-line POM change, decreasing the maintenance cost,\nwhile the tests keep asserting the actual rule behaviour: analysis of\nmulti-release JARs, module-info ignoring below Java 9 and the strict\nmode ban of classes above the maximum JDK.\n\nBoth projects are refreshed to log4j-api 2.25.5.\n" }, { "commit": "63637d86bcf944f2b4386cd79450c21c041bed14", "tree": "bef685db0623e59375dac086972c43a01d0f1521", "parents": [ "73216961566feef921c1d12ec71b132aede1ce3c" ], "author": { "name": "Elliotte Rusty Harold", "email": "elharo@users.noreply.github.com", "time": "Sun Aug 23 07:27:50 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 23 07:27:50 2026 -0400" }, "message": "javadoc grammar (#1013)" }, { "commit": "73216961566feef921c1d12ec71b132aede1ce3c", "tree": "0281dad6e64119d4cb420fc50387665eaf14564f", "parents": [ "7854a79f8dad2f1e4e32add9e93b0e687867ee12" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Aug 23 10:59:36 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Aug 23 12:21:34 2026 +0200" }, "message": "Rename the local stub factory so it cannot be read as the harness one\n\nA Test prefix would have been picked up by surefire\u0027s default includes.\n" }, { "commit": "7854a79f8dad2f1e4e32add9e93b0e687867ee12", "tree": "86b450e1379de6f3bcaea7c5bc923c4ad3b7c1be", "parents": [ "576260b1c9785489a309dfbaa7df3da2ce6e6357" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Aug 23 10:52:07 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Aug 23 12:21:34 2026 +0200" }, "message": "Build artifact stubs locally instead of via the testing harness\n\nArtifactStubFactory was the only harness class these tests used, and its\nArchiverManager field forced plexus-archiver onto the test classpath just\nso the JVM could resolve types nothing calls. The local factory builds\nthe same artifacts; only the handler\u0027s classifier changes, \"\" to null,\nwhich nothing reads.\n" }, { "commit": "576260b1c9785489a309dfbaa7df3da2ce6e6357", "tree": "6de66d56db4447478abde4075ff4d04464504793", "parents": [ "0adfeb96271d6f7b905622162d91aca7e88084cc" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Aug 23 09:52:06 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Aug 23 10:04:09 2026 +0200" }, "message": "Stop dependabot from updating test fixtures\n\nThe pinned versions in these trees are the test input, not dependencies\nof the build; bumping them breaks the ITs that assert on them." }, { "commit": "0adfeb96271d6f7b905622162d91aca7e88084cc", "tree": "f3ccf9ddc31c010b42b13346c0a54fb1c1357854", "parents": [ "8f83b6ae2d9db219f73b24a81f70beeb3141ca50" ], "author": { "name": "btpka3", "email": "btpka3@163.com", "time": "Fri Aug 21 19:53:27 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 21 07:53:27 2026 -0400" }, "message": "Fix: support custom \u003cmessage\u003e output for 9 enforcer rules that ignored getMessage() (#1004)\n\n* Fix: support custom message output for enforcer rules that ignored getMessage()\n\nSeveral enforcer rules did not output the user-configured \u003cmessage\u003e when\nthe rule failed. This meant users could not provide custom context or\nexplanations for rule violations.\n\nFixed the following rules to prepend getMessage() to the error output\nwhen set:\n- BannedPlugins\n- BannedRepositories\n- BanDuplicatePomDependencyVersions\n- BanDistributionManagement\n- RequireMatchingCoordinates\n- RequireExplicitDependencyScope\n- RequireProfileIdsExist\n- RequireSameVersions\n- RequirePrerequisite\n\nAlso updated toString() methods to include getMessage() for better\ndebugging support, and added setter methods where missing.\n\nAdded/updated tests:\n- New TestBannedPlugins test class\n- Added custom message test to TestBannedRepositories\n- Added custom message test to TestRequireSameVersions\n\n* Use \\n instead of System.lineSeparator() in exception messages\n\nException messages must be platform-independent. Replace all\nSystem.lineSeparator() calls with literal \"\\n\" in enforcer rule\nerror messages to avoid \\r\\n on Windows." }, { "commit": "8f83b6ae2d9db219f73b24a81f70beeb3141ca50", "tree": "8d1915f8083ed0c68b2bc30edc04a6cf1cc34d95", "parents": [ "22e7bb3e94208541e660143e399280312c808317" ], "author": { "name": "Abdullah", "email": "89297042+AzazelSensei@users.noreply.github.com", "time": "Fri Aug 21 00:22:24 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 17:22:24 2026 -0400" }, "message": "RequireFilesExist should accept a file reached through .. (#1011)\n\nThe rule compared the configured path\u0027s URI to getCanonicalFile().\nA path that still contains .. never matches, so a file that exists\nis reported missing. I collapse those segments first and compare\nthe file names, which is what the Windows case check needs anyway.\n\nFixes #977" }, { "commit": "22e7bb3e94208541e660143e399280312c808317", "tree": "3163dcda4f28381b48d77ade1a67683f4549658f", "parents": [ "09213e3eb20837e4c521dc8171dd8c62d795a313" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 01:39:43 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 22:45:38 2026 +0200" }, "message": "Restore the common wording on the download page\n\nThe wording here had drifted from the text the rest of the Maven estate uses.\nThis restores the shared form so the page is identical to its counterparts\napart from the distribution area and the artifact name.\n\nRewording elsewhere in the estate had silently dropped links, leaving the text\nas plain prose, so this is not purely cosmetic.\n\nNo URL or in-page anchor changes. The ASF licence header is left exactly as\nit was.\n\nGenerated-by: Claude Opus 5 (1M context)\n" }, { "commit": "09213e3eb20837e4c521dc8171dd8c62d795a313", "tree": "7ea553554165d70f24c3f5c9ddd85c85460fbb61", "parents": [ "23e21f9679e582e7bc86f8bade09b004f07d9b32" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 02:29:48 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 03:11:01 2026 +0200" }, "message": "Use \u003ca id\u003e rather than \u003ca name\u003e for the FAQ anchors\n\nmaven-site-plugin 3.21.0 drops the name attribute from inline HTML\nanchors while 3.22.0 keeps it, so a page written with \u003ca name\u003e loses its\nanchors on the older plugin with a green build and no warning. Doxia\u0027s\nXhtml5BaseParser reads Attribute.ID first and only falls back to NAME, so\nid is the primary path; name on \u003ca\u003e is also obsolete in HTML5.\n\nThis project builds with 3.22.0 today, so the published anchors are not\ncurrently affected. The change makes the page correct on both, and keeps\nit correct if it is ever back-ported to a line with an older toolchain.\nIt also aligns this FAQ with the rest of the estate-wide FML to Markdown\nconversion, which now uses \u003ca id\u003e throughout.\n\nVerified by generating the site and comparing the anchors the generated\nfaq.html serves. Unchanged: question and top are both still served, the\n\u003chead\u003e is byte-identical, and the build emits no duplicate-anchor\nwarning.\n\nGenerated-by: Claude Opus 5 (1M context)\n" }, { "commit": "23e21f9679e582e7bc86f8bade09b004f07d9b32", "tree": "d66f0e9f55c4b8e060b4558d4a875ee6e5d16394", "parents": [ "69c2f5dc41ba9a7d9220db67e77c22e4d0c917f2" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 02:07:07 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 02:26:32 2026 +0200" }, "message": "Convert the FAQ from FML to Markdown\n\ndoxia-converter cannot target FML usefully - the questions come out as\nlink-reference syntax rather than headings, the [top] back-links become\nlinks to a nonexistent \u0027top\u0027 page, and the contents links lose their #\nanchors. The page is written out by hand instead.\n\nExplicit anchors keep the existing deep links working. FML routes every\n\u003cfaq id\u003e through DoxiaUtils.encodeId, which rewrites an id that is not a\nvalid XML name: a space becomes \u0027_\u0027 and any other character becomes its\ndot-prefixed UTF-8 bytes, so \u0027,\u0027 becomes .2C and \u0027?\u0027 becomes .3F. The\n\u003ca name\u003e elements emitted here reproduce that rendered form, not the raw\nattribute, so the live URLs still resolve.\n\nProse double quotes are written as \u0026quot; entities: flexmark\u0027s smart\npunctuation would otherwise turn a straight quote into a typographic\none and silently change the visible text. That matches the convention\nalready used by the Markdown pages in this estate.\n\nVerified by building the site before and after and comparing the set of\nanchors the generated faq.html actually serves. All 3 anchors present\nbefore are still present after (5 after, the extra ones being the ids\nDoxia derives from the new headings):\n\n bodyColumn\n question\n top\n\nThe \u003chead\u003e is byte-identical, so the title and metadata are unchanged.\nsite.xml needs no edit - maven-enforcer-plugin/src/site/fml/faq.fml and\nmaven-enforcer-plugin/src/site/markdown/faq.md both render to faq.html.\n\nFML generates a [top] back-link after each answer; those are dropped\nrather than hand-written. The question renders as an h3 heading rather\nthan a definition term. Those are the only rendering losses.\n\nGenerated-by: Claude Opus 5 (1M context)\n" }, { "commit": "69c2f5dc41ba9a7d9220db67e77c22e4d0c917f2", "tree": "49dfee61110977feda77ad700019aee5613b5b27", "parents": [ "317493634b416d37c9af569fd7a5ecfc383c504a" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 01:52:30 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 10 02:26:32 2026 +0200" }, "message": "Rename the FAQ ahead of converting it\n\nGit records a rename plus a rewrite in one commit as a delete and an\nadd, which stops \u0027git log --follow\u0027. Splitting the rename out keeps the\nhistory. Please merge or rebase rather than squash.\n\nGenerated-by: Claude Opus 5 (1M context)\n" }, { "commit": "317493634b416d37c9af569fd7a5ecfc383c504a", "tree": "c219f19538ae5d88c5b56fa9594499536aefacca", "parents": [ "c96334175ac73d1386f82bbafd4af4e628f5f8cc" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Aug 07 11:57:15 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Aug 07 16:19:54 2026 +0200" }, "message": "Drop backslash escapes that Markdown does not need\n\nPages converted from APT with an older doxia-converter carry an escape in front of\npunctuation that is not markup where it stands: a hyphen or underscore inside a word,\na parenthesis, a full stop after a letter. The backslash renders as nothing and only\nmakes the source harder to read and to edit.\n\nOnly positions where the bare character can never be markup are touched. A full stop\nafter a digit keeps its escape, so an ordered list marker cannot appear by accident,\nand angle brackets keep theirs, since \u003cescapeString\u003e would otherwise be read as a tag.\nCode spans, fenced blocks and link destinations are left alone.\n" }, { "commit": "c96334175ac73d1386f82bbafd4af4e628f5f8cc", "tree": "86ae4121a156aa86dd34fc6a43573f249a259368", "parents": [ "04e6edcd94686c33f9e344a9cfefff0f33b14c84" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Aug 07 11:41:10 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Aug 07 16:18:39 2026 +0200" }, "message": "Restore the document metadata dropped when the pages were ported\n\nAn APT document opens with a header block giving its title, authors and date, and\ndoxia-converter turns that into YAML front matter. The port removed the front\nmatter along with the converter\u0027s per-line licence comments, so the generated\npages lost their author and date meta tags, and took their title from the first\nheading rather than from the document title.\n\nThe front matter has to come first in the file: the Markdown parser only looks for\nit when the source begins with \"---\". A licence header ahead of it would hide it,\nand RAT is happy either way.\n" }, { "commit": "04e6edcd94686c33f9e344a9cfefff0f33b14c84", "tree": "1b6b8ff8d94c4728063c3c09d24fc80050245912", "parents": [ "4df96a21c1a054850abd0e3dba5cf04975d8549d" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Aug 06 13:53:07 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Aug 06 19:18:02 2026 +0200" }, "message": "Port the site documentation from APT to Markdown\n\n47 page(s) converted with doxia-converter and then cleaned up by hand:\n\n- \u003c\u003c\u003ccode\u003e\u003e\u003e becomes backticks, \u003c\u003cbold\u003e\u003e becomes **bold**, {{{url}text}}\n becomes [text](url)\n- the ASF license header becomes a single block HTML comment\n- a page whose only Velocity reference was ${project.name} is now a plain\n .md with the title spelled out\n- a page that keeps a reference stays a .vm. Velocity reads ## as a line\n comment and would silently swallow every ATX heading below level one, so\n subsections use setext underlines and anything deeper is wrapped in\n #[[ ... ]]#\n- a reference APT rendered literally is escaped with ${esc.d}\n\nVerified by building the site before and after and comparing every generated\npage: the visible text and the link targets are unchanged apart from\n\u003cb\u003e/\u003ci\u003e becoming \u003cstrong\u003e/\u003cem\u003e and quotes and ellipses in prose picking up\nthe Markdown module\u0027s typographic substitution.\n" }, { "commit": "4df96a21c1a054850abd0e3dba5cf04975d8549d", "tree": "e45f357207129477e91f74e1e66599a0ef3d8011", "parents": [ "67571be666670219aa5fb08025388a1528ab190e" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Aug 06 13:53:07 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Aug 06 19:18:02 2026 +0200" }, "message": "Rename the site documents ahead of converting them\n\nA pure rename, so that git records it and `git log --follow` and `git blame` still\nreach the history of each page after the conversion that follows. The content is\nstill APT at this point and the site does not build between the two commits.\n" }, { "commit": "67571be666670219aa5fb08025388a1528ab190e", "tree": "6d429a14f69119c1173d2389d854f31125b22d32", "parents": [ "71aa6ddac1f9bafbd5f04b2c6d803fdc3a85477f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 30 20:02:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 30 20:02:53 2026 +0200" }, "message": "Bump commons-codec:commons-codec from 1.22.0 to 1.22.1 (#1003)\n\nBumps [commons-codec:commons-codec](https://github.com/apache/commons-codec) from 1.22.0 to 1.22.1.\n- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)\n- [Commits](https://github.com/apache/commons-codec/compare/rel/commons-codec-1.22.0...rel/commons-codec-1.22.1)\n\n---\nupdated-dependencies:\n- dependency-name: commons-codec:commons-codec\n dependency-version: 1.22.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "71aa6ddac1f9bafbd5f04b2c6d803fdc3a85477f", "tree": "cfda1159dc3fab1d63ad2d8229291a7282fa1cd9", "parents": [ "0610603283d8cd3e864398c42d15db12e4a5e64d" ], "author": { "name": "Stefano Cordio", "email": "stefano.cordio@gmail.com", "time": "Tue Jul 21 14:28:52 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Jul 21 22:21:26 2026 +0200" }, "message": "Remove obsolete note, clean up typos\n" }, { "commit": "0610603283d8cd3e864398c42d15db12e4a5e64d", "tree": "d6d68a00bc64d2e76076f4db490b6485a8f9e9d2", "parents": [ "9f2cf045d9bc5d7fffc3436589888e041a067feb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Jul 14 15:22:19 2026 +0000" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Tue Jul 21 20:15:16 2026 +0200" }, "message": "Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\n\nBumps [apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml](https://github.com/apache/maven-gh-actions-shared) from 4 to 5.\n- [Commits](https://github.com/apache/maven-gh-actions-shared/compare/v4...v5)\n\n---\nupdated-dependencies:\n- dependency-name: apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml\n dependency-version: \u00275\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "9f2cf045d9bc5d7fffc3436589888e041a067feb", "tree": "a03bb4aea50df6012a4dbcb686ddb7796ec455b6", "parents": [ "3ba89bc9b928d9fb07729926ac85d9aa0442390b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:32:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:32:23 2026 +0200" }, "message": "Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml (#991)\n\nBumps [apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml](https://github.com/apache/maven-gh-actions-shared) from 4 to 5.\n- [Commits](https://github.com/apache/maven-gh-actions-shared/compare/v4...v5)\n\n---\nupdated-dependencies:\n- dependency-name: apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml\n dependency-version: \u00275\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3ba89bc9b928d9fb07729926ac85d9aa0442390b", "tree": "c148475da26cf30257607d09147655077114a540", "parents": [ "f0a066c2ec5dbc0e0c49799ddcd92553fb908cb3" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Jul 16 18:32:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 16 18:32:10 2026 +0200" }, "message": "Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml (#993)\n\nBumps [apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml](https://github.com/apache/maven-gh-actions-shared) from 4 to 5.\n- [Commits](https://github.com/apache/maven-gh-actions-shared/compare/v4...v5)\n\n---\nupdated-dependencies:\n- dependency-name: apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml\n dependency-version: \u00275\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f0a066c2ec5dbc0e0c49799ddcd92553fb908cb3", "tree": "34dc9870c15e55529c346ee987ba06a2a0cf7fa2", "parents": [ "67471cec89f0a3e9a67270da33ef104107ad8c38" ], "author": { "name": "Omri SirComp", "email": "omribz156@gmail.com", "time": "Sat May 16 19:38:43 2026 +0300" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Thu Jul 16 00:44:52 2026 +0200" }, "message": "Add enforceBytecodeVersion to rules index\n" }, { "commit": "67471cec89f0a3e9a67270da33ef104107ad8c38", "tree": "14418343a70c19798d0ed64184bbc43c5dd0719b", "parents": [ "b5f7f988125d728f1369784d9eb685b9242630cd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Jul 15 07:28:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 15 07:28:45 2026 +0200" }, "message": "Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml (#994)\n\nBumps [apache/maven-gh-actions-shared/.github/workflows/stale.yml](https://github.com/apache/maven-gh-actions-shared) from 4 to 5.\n- [Commits](https://github.com/apache/maven-gh-actions-shared/compare/v4...v5)\n\n---\nupdated-dependencies:\n- dependency-name: apache/maven-gh-actions-shared/.github/workflows/stale.yml\n dependency-version: \u00275\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b5f7f988125d728f1369784d9eb685b9242630cd", "tree": "b90e225e62ee5a185753beb711da955786fc6a55", "parents": [ "9719db831709e53d723b32aed5b4f82646588649" ], "author": { "name": "Jarek Potiuk", "email": "jarek@potiuk.com", "time": "Wed Jul 08 12:39:46 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Jul 08 14:19:32 2026 +0200" }, "message": "Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability\n\nGenerated-by: Claude Code\n" }, { "commit": "9719db831709e53d723b32aed5b4f82646588649", "tree": "e5b5d103db57a7a0ce95164368295ee0aaf63aa1", "parents": [ "6fb03c44579500c45e4fa94f38c0c33247442583" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Jun 29 15:29:06 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Jun 29 19:25:24 2026 +0200" }, "message": "Bump org.apache.maven:maven-parent from 48 to 49\n\nBumps [org.apache.maven:maven-parent](https://github.com/apache/maven-parent) from 48 to 49.\n- [Release notes](https://github.com/apache/maven-parent/releases)\n- [Commits](https://github.com/apache/maven-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-parent\n dependency-version: \u002749\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "6fb03c44579500c45e4fa94f38c0c33247442583", "tree": "5ba7e8f5ea47da9ccaefa935d1f4c43c0d83664d", "parents": [ "fc75d3404b4371ca1bd0ae577be64fd1dc30dbf0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Jun 09 15:22:39 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Jun 09 13:59:20 2026 -0400" }, "message": "Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0\n\nBumps [org.codehaus.plexus:plexus-archiver](https://github.com/codehaus-plexus/plexus-archiver) from 4.11.0 to 4.12.0.\n- [Release notes](https://github.com/codehaus-plexus/plexus-archiver/releases)\n- [Changelog](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md)\n- [Commits](https://github.com/codehaus-plexus/plexus-archiver/compare/plexus-archiver-4.11.0...plexus-archiver-4.12.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.plexus:plexus-archiver\n dependency-version: 4.12.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "fc75d3404b4371ca1bd0ae577be64fd1dc30dbf0", "tree": "e4b31ef342205cbd0a8b13bd3135493ae28d1319", "parents": [ "d56a93a508fa7cf01d16616a4d782433c76bb78f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue May 19 07:04:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue May 19 07:04:14 2026 +0200" }, "message": "Bump mavenVersion from 3.9.15 to 3.9.16 (#984)\n\nBumps `mavenVersion` from 3.9.15 to 3.9.16.\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.15 to 3.9.16\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.15 to 3.9.16\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.15...maven-3.9.16)\n\nUpdates `org.apache.maven:maven-core` from 3.9.15 to 3.9.16\n\nUpdates `org.apache.maven:maven-model` from 3.9.15 to 3.9.16\n\nUpdates `org.apache.maven:maven-model-builder` from 3.9.15 to 3.9.16\n\nUpdates `org.apache.maven:maven-settings` from 3.9.15 to 3.9.16\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-artifact\n dependency-version: 3.9.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-plugin-api\n dependency-version: 3.9.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-core\n dependency-version: 3.9.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model\n dependency-version: 3.9.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model-builder\n dependency-version: 3.9.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-settings\n dependency-version: 3.9.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d56a93a508fa7cf01d16616a4d782433c76bb78f", "tree": "250fe3c03f50e80afdf44ab3374d90964c611489", "parents": [ "dff5e3dcc68d2605c819b48540a2053b84447667" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sat May 16 17:55:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat May 16 17:55:31 2026 +0200" }, "message": "Bump org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4 in /maven-enforcer-plugin/src/it/projects/MENFORCER-434 (#970)\n\n---------\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Elliotte Rusty Harold \u003celharo@ibiblio.org\u003e" }, { "commit": "dff5e3dcc68d2605c819b48540a2053b84447667", "tree": "449c0bd62b74cdbce9703a0e4bb26c6730f1ffd0", "parents": [ "c7daff33d46c9c3ee0666540c6857c66cf159e70" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Fri May 15 12:38:37 2026 +0200" }, "committer": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Fri May 15 12:38:37 2026 +0200" }, "message": "[maven-release-plugin] prepare for next development iteration\n" }, { "commit": "c7daff33d46c9c3ee0666540c6857c66cf159e70", "tree": "71dbdefb4b49d8d5eab33ed3579c6755ecf0afdf", "parents": [ "ee46e78b046be9882a739c07556940329a7345d6" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Fri May 15 12:38:12 2026 +0200" }, "committer": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Fri May 15 12:38:12 2026 +0200" }, "message": "[maven-release-plugin] prepare release enforcer-3.6.3\n" }, { "commit": "ee46e78b046be9882a739c07556940329a7345d6", "tree": "87369e9e9299b09658bc3153ce0ee7fb1967fdd5", "parents": [ "0806924d8f6c5ad6105ac387bf323846e769b18c" ], "author": { "name": "hvoynov", "email": "hvoynov@gmail.com", "time": "Fri May 15 01:07:26 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri May 15 00:07:26 2026 +0200" }, "message": "Make bannedDependencies report root and transitive dependency in case both are banned. (#940)" }, { "commit": "0806924d8f6c5ad6105ac387bf323846e769b18c", "tree": "94158a1aeb5633bd7e9861807fdb307cfb330fda", "parents": [ "8e4f5b94453de97592cf3935b79319894f013329" ], "author": { "name": "Robert Krajewski", "email": "rpk@alum.mit.edu", "time": "Thu May 14 13:51:41 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 14 19:51:41 2026 +0200" }, "message": "Document the banMavenDefaults option for the requirePluginVersions rule. (#936)\n\n* Document the banMavenDefaults option for the requirePluginVersions rule.\n\nI did not link to the Super POM or default lifecycle bindings because\nthe pages are dependent on the version of Maven.\n\n* https://maven.apache.org/ref/3.9.11/maven-model-builder/super-pom.html\n* https://maven.apache.org/ref/3.9.11/maven-core/default-bindings.html\n\nThere\u0027s a mavenVersion property that could be used to replace a fixed\nMaven version in these particular links if APT allows it, I suppose." }, { "commit": "8e4f5b94453de97592cf3935b79319894f013329", "tree": "490178afa7a26a0e3bcd818e9717d66dd36cb869", "parents": [ "fd4b1486dcc93394d5f6a11687efd51d0d30b22d" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Thu May 14 19:44:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 14 19:44:14 2026 +0200" }, "message": "Add better enforceBytecodeVersion rule based on mojohaus (#968)\n\nThis rule is very often used, and does not require anything special like a new dependency, hence it should be among \"built in\" rules.\n\nOTOH, it had issues, for example **on larger multi projects did recheck same (potentially huge) JAR over and over again**. It is now altered to not repeat same check (same options against same file) within same session.\n\nThis rule is 100% drop-in replacement for old uses (ITs are unmodified and just copied over), moreover rule itself has set priority that if enforce plugin gets updated with this rule, but the extra rules are present, the new rule will kick in. All the options are same as before, and rule name is unchanged as well.\n\nWhere it differs, and is reflected in ITs: is not so chatty as mojohaus one, it does not tell \"skipped due scope\", \"skipped due regexp\" etc, hence ITs are modified to simply assert for presence or absence of \"[DEBUG] Analyzing GAV...\" string instead." }, { "commit": "fd4b1486dcc93394d5f6a11687efd51d0d30b22d", "tree": "eba912574af097c83ac4235a4174a3444a061096", "parents": [ "f32d5979ef387668162c2beb905b368e25accd70" ], "author": { "name": "Johannes Bechberger", "email": "me@mostlynerdless.de", "time": "Thu May 14 19:30:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 14 19:30:32 2026 +0200" }, "message": "Add fix for 21.0.10.0.1 issue (#967)\n\nThe pull request allows the Java version requirement to be satisfied even when the normalized Java version differs, as long as the exact version strings are equal between the expected and the actual versions.\n\nThis allows the common CI pattern\n\n```xml\n \u003cplugin\u003e\n \u003cgroupId\u003eorg.apache.maven.plugins\u003c/groupId\u003e\n \u003cartifactId\u003emaven-enforcer-plugin\u003c/artifactId\u003e\n \u003cversion\u003e3.6.2\u003c/version\u003e\n \u003cexecutions\u003e\n \u003cexecution\u003e\n \u003cid\u003eenforce-java\u003c/id\u003e\n \u003cphase\u003evalidate\u003c/phase\u003e\n \u003cgoals\u003e\n \u003cgoal\u003eenforce\u003c/goal\u003e\n \u003c/goals\u003e\n \u003cconfiguration\u003e\n \u003crules\u003e\n \u003crequireJavaVersion\u003e\n \u003cversion\u003e${java.version}\u003c/version\u003e\n \u003c/requireJavaVersion\u003e\n \u003c/rules\u003e\n \u003c/configuration\u003e\n \u003c/execution\u003e\n \u003c/executions\u003e\n \u003c/plugin\u003e\n```\n\nTo succeed even when the Java version normalization can\u0027t handle the specific version format. This is rather hard to test, but all existing test cases succeed, and the diff is minimal.\n\n- [x] I hereby declare this contribution to be licenced under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)" }, { "commit": "f32d5979ef387668162c2beb905b368e25accd70", "tree": "b22c1b41dc85aefc9755dad4d47f109849dbbbc0", "parents": [ "df0f2a6d7fbbaf79914cdb56fa5899d99c8eaf19" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Thu May 14 19:17:12 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu May 14 19:17:12 2026 +0200" }, "message": "Deps: Parent POM 48 and align deps (#979)\n\nThere were (most probably) dependabot that made\ndeps fall apart: Maven, Resolver and Sisu should\nbe upped in lockstep." }, { "commit": "df0f2a6d7fbbaf79914cdb56fa5899d99c8eaf19", "tree": "a4af9f49cfa091e35f5772261d1f33efec6adf20", "parents": [ "2da7a68b4d8d9d2da866ffaf1e07a206c9b7115d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Apr 28 10:00:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Apr 28 10:00:46 2026 +0200" }, "message": "Bump commons-codec:commons-codec from 1.21.0 to 1.22.0 (#976)\n\nBumps [commons-codec:commons-codec](https://github.com/apache/commons-codec) from 1.21.0 to 1.22.0.\n- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)\n- [Commits](https://github.com/apache/commons-codec/compare/rel/commons-codec-1.21.0...rel/commons-codec-1.22.0)\n\n---\nupdated-dependencies:\n- dependency-name: commons-codec:commons-codec\n dependency-version: 1.22.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2da7a68b4d8d9d2da866ffaf1e07a206c9b7115d", "tree": "9962d6d2c6fdcf8cc26ef7b73ad00be71c56e2e1", "parents": [ "91eb4d9fe1f6f65137991c1131131ceaca542245" ], "author": { "name": "Carsten Pfeiffer", "email": "cpfeiffer@users.noreply.github.com", "time": "Fri Apr 17 17:18:25 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Apr 27 19:22:35 2026 +0200" }, "message": "Add null checks for modelId in PluginWrapper\n\nIn certain special scenarios (virtual maven-tiles), modelId can be null." }, { "commit": "91eb4d9fe1f6f65137991c1131131ceaca542245", "tree": "342daa23649d2270e8b97c95892a5d0af4c0619f", "parents": [ "b6222459bf3256bfd747731a7f4ea81577777ffe" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Apr 24 09:27:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Apr 24 09:27:23 2026 +0200" }, "message": "Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#975)\n\nBumps commons-io:commons-io from 2.21.0 to 2.22.0.\n\n---\nupdated-dependencies:\n- dependency-name: commons-io:commons-io\n dependency-version: 2.22.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b6222459bf3256bfd747731a7f4ea81577777ffe", "tree": "b9e1ec9673b0263d490c2ded04b5da892508b787", "parents": [ "20a4031c631f81ce2fcc1ebc4afe9e475f961a25" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Apr 20 14:03:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Apr 20 14:03:22 2026 +0200" }, "message": "Bump mavenVersion from 3.9.14 to 3.9.15 (#973)\n\nBumps `mavenVersion` from 3.9.14 to 3.9.15.\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.14 to 3.9.15\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.14 to 3.9.15\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.14...maven-3.9.15)\n\nUpdates `org.apache.maven:maven-core` from 3.9.14 to 3.9.15\n\nUpdates `org.apache.maven:maven-model` from 3.9.14 to 3.9.15\n\nUpdates `org.apache.maven:maven-model-builder` from 3.9.14 to 3.9.15\n\nUpdates `org.apache.maven:maven-settings` from 3.9.14 to 3.9.15\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-artifact\n dependency-version: 3.9.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-plugin-api\n dependency-version: 3.9.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-core\n dependency-version: 3.9.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model\n dependency-version: 3.9.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model-builder\n dependency-version: 3.9.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-settings\n dependency-version: 3.9.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "20a4031c631f81ce2fcc1ebc4afe9e475f961a25", "tree": "e0db06f441a38c16c55ddf645a7757a9a55f18c0", "parents": [ "2c3b5e1c2d66635e9c18158727066a055a80305d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Mar 16 17:46:31 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Mar 16 17:46:31 2026 +0100" }, "message": "Bump mavenVersion from 3.9.13 to 3.9.14 (#965)\n\nBumps `mavenVersion` from 3.9.13 to 3.9.14.\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.13 to 3.9.14\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.13 to 3.9.14\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.13...maven-3.9.14)\n\nUpdates `org.apache.maven:maven-core` from 3.9.13 to 3.9.14\n\nUpdates `org.apache.maven:maven-model` from 3.9.13 to 3.9.14\n\nUpdates `org.apache.maven:maven-model-builder` from 3.9.13 to 3.9.14\n\nUpdates `org.apache.maven:maven-settings` from 3.9.13 to 3.9.14\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-artifact\n dependency-version: 3.9.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-plugin-api\n dependency-version: 3.9.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-core\n dependency-version: 3.9.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model\n dependency-version: 3.9.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model-builder\n dependency-version: 3.9.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-settings\n dependency-version: 3.9.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2c3b5e1c2d66635e9c18158727066a055a80305d", "tree": "af4fd80b6091d1f02ad7e6d82792f6e1701df057", "parents": [ "c300e41d2e6d28049d0b3ce3eb279487ff8f6f6f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Mar 06 17:15:15 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Mar 06 17:15:15 2026 +0100" }, "message": "Bump mavenVersion from 3.9.12 to 3.9.13 (#964)\n\nBumps `mavenVersion` from 3.9.12 to 3.9.13.\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.12 to 3.9.13\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.12 to 3.9.13\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.12...maven-3.9.13)\n\nUpdates `org.apache.maven:maven-core` from 3.9.12 to 3.9.13\n\nUpdates `org.apache.maven:maven-model` from 3.9.12 to 3.9.13\n\nUpdates `org.apache.maven:maven-model-builder` from 3.9.12 to 3.9.13\n\nUpdates `org.apache.maven:maven-settings` from 3.9.12 to 3.9.13\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-artifact\n dependency-version: 3.9.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-plugin-api\n dependency-version: 3.9.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-core\n dependency-version: 3.9.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model\n dependency-version: 3.9.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-model-builder\n dependency-version: 3.9.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.maven:maven-settings\n dependency-version: 3.9.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c300e41d2e6d28049d0b3ce3eb279487ff8f6f6f", "tree": "069b647f7cfcf3cfec951638318db3f834f43055", "parents": [ "e5495a743abbb65d15ad7166e776bc75f3848f1f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Feb 10 17:33:21 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Feb 10 17:33:21 2026 +0100" }, "message": "Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness (#963)\n\nBumps org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugin-testing:maven-plugin-testing-harness\n dependency-version: 3.5.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e5495a743abbb65d15ad7166e776bc75f3848f1f", "tree": "c58824f3fe30e1cc3a2ad876e0b4ba0535e435d1", "parents": [ "352b4aa094026fd75e98b8d570417f8afae0b34d" ], "author": { "name": "Matthias Bünger", "email": "Bukama@users.noreply.github.com", "time": "Sat Jan 31 20:45:37 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jan 31 20:45:37 2026 +0100" }, "message": "Update log4j in test (#961)\n\n" } ], "next": "352b4aa094026fd75e98b8d570417f8afae0b34d" }