)]}' { "log": [ { "commit": "9a834503cc3939ce9a70444fdc28fcde719f6088", "tree": "5810c3a39fb2dd7b2bf0ad813eda41d0f23a9135", "parents": [ "3a755b3fc919061e8290d768fbfa2380ae912783" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 31 20:13:22 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 31 22:06:49 2026 +0100" }, "message": "Move the common misconceptions page to maven.apache.org\n" }, { "commit": "3a755b3fc919061e8290d768fbfa2380ae912783", "tree": "2b15396a922acf9b46a12a7eea02b6ee64b0d34c", "parents": [ "8d67bd90f3eee031beec98b389c7afa89ea32b81" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 26 12:48:10 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 31 11:45:55 2026 +0100" }, "message": "GH-2174: Make jcl-over-slf4j an optional dependency of transport-apache\n\nA library should not choose the JCL implementation for its consumers:\nthe transitive bridge clashed with commons-logging on plugin classpaths.\nThe Maven distribution declares jcl-over-slf4j itself; the suppliers\nnow declare it too. Do not make it transitive again.\n" }, { "commit": "8d67bd90f3eee031beec98b389c7afa89ea32b81", "tree": "4d9983db9ca37d8f29dd6fc84cf6000cae5f0f82", "parents": [ "fbb739777a19841060ad7b5c95e848f34b4349bf" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 20:08:00 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 31 10:00:57 2026 +0100" }, "message": "Keep the test dependencies pilot finds used in transport-jetty\n\npilot:dependencies shows maven-resolver-impl and maven-resolver-named-locks used by the tests and jetty-quic-client unused.\n" }, { "commit": "fbb739777a19841060ad7b5c95e848f34b4349bf", "tree": "85615caccde061d7ed2aeee2e96402038c69c4f1", "parents": [ "ec6bd1bd696abe18e8b3630b0d53c12d139472ad" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 13:42:29 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 31 10:00:57 2026 +0100" }, "message": "Clean up declared dependencies\n\nRemoved from named-locks: mockito-core\nRemoved from impl: guice (classes)\nRemoved from connector-basic: guice (classes)\nRemoved from transport-file: slf4j-api\nRemoved from transport-jdk8: maven-resolver-util\nRemoved from transport-jdk11: jul-to-slf4j\nRemoved from transport-jetty: slf4j-api, maven-resolver-test-util, maven-resolver-impl\nRemoved from transport-minio: slf4j-api, maven-resolver-test-util, maven-resolver-impl\nRemoved from transport-url: maven-resolver-test-util\nRemoved from generator-gnupg: bcutil-jdk18on\nRemoved from generator-sigstore: bcpg-jdk18on, bcutil-jdk18on\nRemoved from supplier-mvn3 and supplier-mvn4: slf4j-api\nDeclared in transport-jetty: jetty-http, jetty-io, jetty-util, jetty-quic-client, jetty-http3-client\n" }, { "commit": "ec6bd1bd696abe18e8b3630b0d53c12d139472ad", "tree": "ada9dd762d26a37f8a91df75efe23b2d3668feac", "parents": [ "20e0f3e7e03da5b62ff0f51b1300b30b1f75fc44" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 21:04:44 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 23:56:57 2026 +0100" }, "message": "Remove the compiler source and target properties\n" }, { "commit": "20e0f3e7e03da5b62ff0f51b1300b30b1f75fc44", "tree": "5fb12c5fe04759988bc346ef579797ac0c1269c2", "parents": [ "97839c66e5a1b83966387cf829621dc7e666e66a" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 16:22:22 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 23:56:57 2026 +0100" }, "message": "Drop the blank line left in the minio properties\n" }, { "commit": "97839c66e5a1b83966387cf829621dc7e666e66a", "tree": "5ff9f65828f6951d728cc610110423bd0d2f7ca1", "parents": [ "6c3d6243ba8a083bf177d2b49d31a187a34c9e3f" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 00:39:04 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 23:56:57 2026 +0100" }, "message": "Remove redundant javaVersion and compiler release properties\n" }, { "commit": "6c3d6243ba8a083bf177d2b49d31a187a34c9e3f", "tree": "b138581ccf54ccfb3ac218e9dba14571e2bd6d9f", "parents": [ "7c473e5ba3d89fbe153259ff4bbc6ec9e28e6576" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 19:51:36 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 09:23:29 2026 +0100" }, "message": "Declare the Maven artifacts the code uses\n\nmaven-resolver-named-locks-hazelcast: maven-resolver-api (test).\nmaven-resolver-named-locks-ipc: maven-resolver-api (test).\nmaven-resolver-named-locks-redisson: maven-resolver-api (test).\nmaven-resolver-supplier-mvn4: maven-api-core (compile).\nmaven-resolver-test-http: maven-resolver-util (compile).\nmaven-resolver-transport-apache: junit-jupiter-params (test).\nmaven-resolver-transport-jdk11: junit-jupiter-params (test).\n" }, { "commit": "7c473e5ba3d89fbe153259ff4bbc6ec9e28e6576", "tree": "c7aa6b837ae86877eb20f30f1c36feef9d0764da", "parents": [ "6d9a95a5cbf82778bcc5d1ff9b30b0f842cca126" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 23:00:17 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Oct 30 09:04:15 2026 +0100" }, "message": "Upgrade Netty to 4.2.17.Final and Jackson to 2.21.7\n" }, { "commit": "6d9a95a5cbf82778bcc5d1ff9b30b0f842cca126", "tree": "42cd3826b7775725725963b8c75f49cb77c4dd40", "parents": [ "f668b0ac2aeedd78748ffdccae70fef5313c9f1b" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 07:23:07 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 19:44:03 2026 +0100" }, "message": "Point ciManagement at GitHub Actions\n" }, { "commit": "f668b0ac2aeedd78748ffdccae70fef5313c9f1b", "tree": "02e64752cf2d83823ec3dde3803b4336d11ce0f0", "parents": [ "a78c1b35b530dcb592d9f513cc6068ec2de656e8" ], "author": { "name": "Konrad Windszus", "email": "kwin@apache.org", "time": "Wed Oct 28 09:59:59 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 09:59:59 2026 +0100" }, "message": "Log retries in ApacheTransporter (#2236)\n\nWhen retry delay exceed the maximum delay just cap it (instead of failing right away).\nExtract logging helpers into HttpTransporter.\nAdd ITs for all HttpTransporters.\nSame tests executed for JDK and Apache transporter.\n\nThis closes #2233\n\n---------\n\nCo-authored-by: Guillaume Nodet - AI Bot \u003cgnodet+bot@gmail.com\u003e" }, { "commit": "a78c1b35b530dcb592d9f513cc6068ec2de656e8", "tree": "6b4ebd5d83b074a6d2f3f3cf68bee72c15325e17", "parents": [ "1ce80a9bf33b38b77455606959201b20bd1199bf" ], "author": { "name": "Konrad Windszus", "email": "kwin@apache.org", "time": "Wed Oct 28 09:58:35 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 09:58:35 2026 +0100" }, "message": "Document the missing support of configurable retries in URL and Jetty (#2237)\n\n\n---------\n\nCo-authored-by: Guillaume Nodet - AI Bot \u003cgnodet+bot@gmail.com\u003e" }, { "commit": "1ce80a9bf33b38b77455606959201b20bd1199bf", "tree": "e08a5b7e6f855b7d4cb428c511e6a24c53d88abe", "parents": [ "bd12d84be0f7597980d46fe598de45d41e140c69" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 26 05:49:52 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 27 13:49:17 2026 +0100" }, "message": "build(deps): bump dev.sigstore:sigstore-java from 2.3.0 to 2.4.0\n\nBumps [dev.sigstore:sigstore-java](https://github.com/sigstore/sigstore-java) from 2.3.0 to 2.4.0.\n- [Release notes](https://github.com/sigstore/sigstore-java/releases)\n- [Changelog](https://github.com/sigstore/sigstore-java/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/sigstore/sigstore-java/compare/v2.3.0...v2.4.0)\n\n---\nupdated-dependencies:\n- dependency-name: dev.sigstore:sigstore-java\n dependency-version: 2.4.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "bd12d84be0f7597980d46fe598de45d41e140c69", "tree": "22414830f73743afa7effe25aa7d7d01fdabda03", "parents": [ "67ffc16671f65fe15922a0fa02cd00788b9a45ce" ], "author": { "name": "Konrad Windszus", "email": "kwin@apache.org", "time": "Mon Oct 26 17:09:12 2026 +0100" }, "committer": { "name": "Konrad Windszus", "email": "konrad@windszus.net", "time": "Tue Oct 27 13:44:29 2026 +0100" }, "message": "Upgrade brotli4j to 1.24.0\n\nThis is necessary as the most recent version of Jetty (12.1.14) still\ndepend on the outdated 1.23.0.\nThis is only fixed in\nhttps://github.com/jetty/jetty.project/commit/bf4676927d35fcc3691ee689bfef57116397a37b\n(not yet released)" }, { "commit": "67ffc16671f65fe15922a0fa02cd00788b9a45ce", "tree": "77d3a6b63be78581285e89fe43114b6c166182cf", "parents": [ "fb3dfa5f6e60e876528775bc7ee96463ea7753c2" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 27 05:22:46 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 27 13:40:32 2026 +0100" }, "message": "build(deps): bump com.google.code.gson:gson from 2.14.0 to 2.15.0\n\nBumps [com.google.code.gson:gson](https://github.com/google/gson) from 2.14.0 to 2.15.0.\n- [Release notes](https://github.com/google/gson/releases)\n- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/google/gson/compare/gson-parent-2.14.0...gson-parent-2.15.0)\n\n---\nupdated-dependencies:\n- dependency-name: com.google.code.gson:gson\n dependency-version: 2.15.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "fb3dfa5f6e60e876528775bc7ee96463ea7753c2", "tree": "8ea1505cfaea3c5ac52eca27317ea7078b551db9", "parents": [ "eee22960dc740aa285f6e2a3a445e258373c8c1a" ], "author": { "name": "Torsten Liermann", "email": "torsten@liermann-it.de", "time": "Sun Oct 25 18:30:22 2026 +0100" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 26 13:36:37 2026 +0100" }, "message": "GH-2225: Separate the new Javadoc paragraph\n" }, { "commit": "eee22960dc740aa285f6e2a3a445e258373c8c1a", "tree": "7f9c61fa5ac344439624768334dddee36447a4bd", "parents": [ "8564253992c739a9cddb9063e08aadf0ddd2bc5e" ], "author": { "name": "Torsten Liermann", "email": "torsten@liermann-it.de", "time": "Fri Oct 23 10:52:28 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 26 13:36:37 2026 +0100" }, "message": "GH-2225: Preserve existing mirror selections\n\nPreserve mirrors already selected for build-supplied repositories while retaining session authentication, proxy and merge processing. Keep mirror selection for remote descriptor repositories. Document both API and SPI contracts and cover repeated selection, merging, blocking and session changes with regression tests.\n" }, { "commit": "8564253992c739a9cddb9063e08aadf0ddd2bc5e", "tree": "9606933b01d35866e7d22515ce895411e7fb7b45", "parents": [ "b67aa7041f93a68a4e1dae6e592bbf047cab47d6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 26 05:48:48 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 26 11:19:27 2026 +0100" }, "message": "build(deps): bump com.squareup.okhttp3:okhttp-bom from 5.5.0 to 5.5.1\n\nBumps [com.squareup.okhttp3:okhttp-bom](https://github.com/lysine-dev/okhttp) from 5.5.0 to 5.5.1.\n- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/lysine-dev/okhttp/compare/parent-5.5.0...parent-5.5.1)\n\n---\nupdated-dependencies:\n- dependency-name: com.squareup.okhttp3:okhttp-bom\n dependency-version: 5.5.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "b67aa7041f93a68a4e1dae6e592bbf047cab47d6", "tree": "f5af3aa77fd5ac014c043b9613b8b2cc6d589d52", "parents": [ "82a1a48d154e79e4f391eacc1f541293981f39ab" ], "author": { "name": "Konrad Windszus", "email": "kwin@apache.org", "time": "Wed Oct 21 19:37:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 19:37:07 2026 +0200" }, "message": "Introduce transporter agnostic redirect handling (#2211)\n\nAdd transport agnostic redirect tests to HttpTransporterTest\nSecure URLTransport to not leak origin scoped headers" }, { "commit": "82a1a48d154e79e4f391eacc1f541293981f39ab", "tree": "f7b7008d61b0fe4ff71a88bde46b09ab1f85e629", "parents": [ "12f0e6c6e3c3885c5a2373bd2b13803f93f3ddfe" ], "author": { "name": "Konrad Windszus", "email": "kwin@apache.org", "time": "Wed Oct 21 19:35:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 19:35:36 2026 +0200" }, "message": "Render \"@see\" tags for configuration elements (#2218)\n\nRender by default below description (similar to javadoc).\nThe links to references are either pointing to javadoc or other\nconfiguration field." }, { "commit": "12f0e6c6e3c3885c5a2373bd2b13803f93f3ddfe", "tree": "20168d48aaced7dd4946007602b3d16972792e0c", "parents": [ "b4634ebc81c5d6bc951264d8bfbe82f3cd0353b0" ], "author": { "name": "Konrad Windszus", "email": "kwin@apache.org", "time": "Wed Oct 21 19:35:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 19:35:09 2026 +0200" }, "message": "Support String properties being converted to Enums in a case insensitive (#2220)" }, { "commit": "b4634ebc81c5d6bc951264d8bfbe82f3cd0353b0", "tree": "8d319b129e7fd69afb03c896667896718e039637", "parents": [ "7ab6dbb38fa3fa0fc72d3f08364a12859a5437ff" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Wed Oct 21 19:16:55 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 19:16:55 2026 +0200" }, "message": "Fix testPut_StartCancelled regression introduced by #2206 (#2219)\n\n## Summary\n\nFixes a regression introduced by #2206: `testPut_StartCancelled` fails on macOS CI with \"Expected error\" because `TransferCancelledException` from the retroactive `transportStarted()` call is silently swallowed.\n\n## Root Cause\n\n#2206 added a retroactive progress-event block that fires `transportStarted`/`transportProgressed` after a successful response, for macOS/Jetty configurations that skip `onRequestContent` callbacks. The block caught `TransferCancelledException` from `transportStarted()` and fell through silently:\n\n```java\n} catch (TransferCancelledException e) {\n // upload already sent — retroactive notification cannot be cancelled;\n // fall through to transportPropertiesAvailable and status check\n}\n```\n\nWhen a test listener has `cancelStart()` set, `transportStarted()` is supposed to throw and the caller (`transporter.put()`) must surface that exception. The catch-and-ignore broke this contract, causing the PUT to complete without error instead of throwing `TransferCancelledException`.\n\n## Fix\n\nRemove the try/catch around the retroactive `transportStarted()` call. The exception propagates naturally — the fact that bytes were already sent does not authorise silencing a `cancelStart` cancellation.\n\nThe `catch (TransferCancelledException e) { break; }` inside the retroactive `transportProgressed` loop is kept as-is: it exits the loop (correct) and the status check still runs after.\n\n## Testing\n\n- `testPut_StartCancelled` now passes (was failing)\n- `testPut_ProgressCancelled`, `testPut_ProxyAuthenticated`, `testPut_SSL` continue to pass\n- Full `JettyTransporterTest` suite: 90 tests pass, 10 skipped (HTTP/3 infra), 0 failures\n\n_Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_" }, { "commit": "7ab6dbb38fa3fa0fc72d3f08364a12859a5437ff", "tree": "4d46a5571f9b7da2a620d2ff1e06e8b97247c1c2", "parents": [ "e8c0e57444a1e80cdcd929aac7a0706f369f5430" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Tue Oct 20 23:03:40 2026 +0200" }, "committer": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Tue Oct 20 23:03:40 2026 +0200" }, "message": "Revert \"Fix prefix filter verification for denied artifact paths (#2188)\"\n\nThis reverts commit 836f47abc784b62bc574cb9ee3ef14fa2a8a15dd.\n" }, { "commit": "e8c0e57444a1e80cdcd929aac7a0706f369f5430", "tree": "096cf6f9d786d8bf06779005723dcddb8a124603", "parents": [ "db0fe32b05cd8ca439d472b8bb6bfcc205c75d58" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Tue Oct 20 22:19:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 22:19:10 2026 +0200" }, "message": "fix: prefix files parsing bug (#2217)\n\nFixes #2191\n\nNo matter of order, \"shorter path wins\". Also, fixing a misnamed field siblings vs children." }, { "commit": "db0fe32b05cd8ca439d472b8bb6bfcc205c75d58", "tree": "c9071242c4b8658296cfb1f1cc41b53fbc9d91fe", "parents": [ "ffebc02c56f3156253ee53ed9db3be65e07164a5" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Tue Oct 20 21:16:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 21:16:03 2026 +0200" }, "message": "Fix javadoc warnings in maven-resolver-api (#2210)\n\nAdds missing descriptions, @param, @return and @throws tags across maven-resolver-api so that `mvn javadoc:javadoc` produces zero warnings under stricter JDK 25+ doclint. Fixes MRESOLVER-456.\n\n### What\nAdds the missing Javadoc content (descriptions, `@param`, `@return`, `@throws`) flagged by the javadoc tool\u0027s doclint when run under JDK 25/26, across all affected classes in `maven-resolver-api`.\n\n### How\n- Added a one-sentence description to enum constants, interface/class members and constructors that lacked a main description.\n- Added missing `@param`, `@return` and `@throws` tags, matching the existing style and wording used elsewhere in the same file/interface (e.g. reusing `RepositoryListener`\u0027s descriptions for the corresponding `RepositoryEvent.EventType` constants).\n- No behavioral changes; Javadoc-only.\n\n### Tests\n- `JAVA_HOME\u003d\u003cjdk-26\u003e mvn -pl maven-resolver-api clean javadoc:javadoc`: 0 warnings (previously ~100 under JDK 25/26, reproducing the issue).\n- `mvn -pl maven-resolver-api test`: 91 tests, 0 failures.\n- `mvn -pl maven-resolver-api checkstyle:check`: 0 violations.\n\n---\n\nTo make clear that you license your contribution under\nthe [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\ncheck one of the following:\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [x] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)." }, { "commit": "ffebc02c56f3156253ee53ed9db3be65e07164a5", "tree": "b3dc934bc0cfb96c3e63bb21da393bc00a5fdd15", "parents": [ "e9cd7f336fea2ad477d2700046e8b00315c39a17" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Tue Oct 20 19:13:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 19:13:41 2026 +0200" }, "message": "Dependency updates (#2216)\n\nChanges:\n* Sisu 1.1.1\n* BouncyCastle 1.86\n* Maven4 4.0.0-rc-7\n* p-u-4 4.1.0" }, { "commit": "e9cd7f336fea2ad477d2700046e8b00315c39a17", "tree": "76d6364e9fd2cc8d58701d8251ec0d618a94b182", "parents": [ "82f658779d0b24f2995738634a2345c8fc15d642" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Tue Oct 20 19:01:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 19:01:54 2026 +0200" }, "message": "Fix #1269: Report a clear message when resolving an artifact with no version (#2209)\n\n## What and why\n\n`DefaultArtifactResolver` accepts a `VersionResult` whose version is null or blank, which happens whenever the request\u0027s `Artifact` has no version at all (#1269 / MRESOLVER-597). It keeps going, and the failure only surfaces much later as an opaque `IllegalArgumentException` thrown by `DefaultLocalPathComposer` about an invalid relative path, for instance `com/example/no-such-artifact//no-such-artifact-.jar`, with no mention of the real cause.\n\nI reproduced this against the current `maven-resolver-impl` code, both as a unit test and as a standalone program using `maven-resolver-supplier-mvn3`: resolving `com.example:no-such-artifact:jar` with no version throws that unrelated path exception.\n\nThe issue suggested either documenting the exception or failing fast when the request is built. Failing fast at construction time is not possible in general, because the input version can be a symbolic one (`RELEASE`, `LATEST`, a range) that only the version resolver can turn into a concrete version, so the earliest point where an empty result is known is right after `versionResolver.resolveVersion` returns.\n\n## How\n\n`DefaultArtifactResolver#resolve` now rejects a null or blank resolved version immediately after it is applied to the artifact, with an `ArtifactNotFoundException` that names the artifact and says its version is missing or blank, instead of letting execution reach the local repository path composer.\n\n## Tests\n\n`DefaultArtifactResolverTest#testResolveArtifactWithBlankVersionFailsWithClearMessage` fails without the change (the stub local repository manager used in this test class does not reproduce the production `IllegalArgumentException`, but the assertion on the clear message fails, confirming no such message was produced before). With the change, this test and the rest of `maven-resolver-impl` pass (589 tests), and `checkstyle:check` is clean.\n\n---\n\nTo make clear that you license your contribution under\nthe Apache License Version 2.0, January 2004 (http://www.apache.org/licenses/LICENSE-2.0)\ncheck one of the following:\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [x] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)." }, { "commit": "82f658779d0b24f2995738634a2345c8fc15d642", "tree": "899922320d7b71ed2712c87c7d2ebfda1181341a", "parents": [ "bf02fa2a40974fba8bec5695d8de8f91c6c36deb" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Tue Oct 20 20:00:47 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 19:00:47 2026 +0200" }, "message": "Fix skipping of version-range candidates (#2208)\n\nThe breadth-first dependency collector can skip the descriptor of a range-constrained candidate as a version conflict loser based on a previously visited artifact with the same versionless key. If conflict resolution selects that candidate, its transitive dependencies are missing.\n\nResolve range-constrained candidates so their dependencies remain available to conflict resolution, but do not let them replace the cached versionless winner. Exact-artifact duplicate caching remains in place. Added collector and skipper regressions.\n\nThe reported build fails on Maven 3.10.0 and 4.0.0-rc-7, passes on Maven 3.9.12, and passes with Resolver 2.0.25-SNAPSHOT on Maven 3.10.0 and 4.0.0-rc-7. Resolver validation: `mvn -Prun-its verify` (31 modules) and the focused skipper tests (28 passed).\n\nRelated: apache/maven#13430.\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [x] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)." }, { "commit": "bf02fa2a40974fba8bec5695d8de8f91c6c36deb", "tree": "a24ec850d4a7298428ea06647985bbc2332a4ba1", "parents": [ "ac163bcb27395eadbeba68792281fbf0424f0f7a" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Tue Oct 20 19:59:43 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 18:59:43 2026 +0200" }, "message": "fix: catch only expected IO failures (#2207)\n\nFixes #1988.\n\n`PutTaskRequestContent.read()` and `rewind()` now convert only `IOException` into terminal content failures. Unexpected runtime exceptions propagate to the caller instead of being hidden as ordinary content failures. Regression tests cover both channel paths.\n\nTests: focused Maven reactor verification passed with JDK 21; 105 Jetty tests passed and 10 were skipped. Spotless check passed with JDK 21.\n\n- [x] I hereby declare this contribution to be licensed under the Apache License Version 2.0, January 2004\n- [x] I hereby declare that I have filed an Apache Individual Contributor License Agreement." }, { "commit": "ac163bcb27395eadbeba68792281fbf0424f0f7a", "tree": "e376e2388ce5fba081af0ea4e3be964cd5532bba", "parents": [ "80657d33fb906358ada33864bdf2724e52aacd63" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 20 18:59:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 18:59:08 2026 +0200" }, "message": "Fix flaky JettyTransporterTest progress events on macOS (#2206)\n\n## Summary\n\nFixes the flaky `JettyTransporterTest.testPut_ProxyAuthenticated` and `JettyTransporterTest.testPut_SSL` tests that intermittently fail on macOS with `progressedCount \u003d 0`.\n\n## Root Cause\n\n`JettyTransporter.implPut()` relies on Jetty\u0027s `onRequestContent` callback to fire `transportProgressed` events. On macOS runners with proxy authentication or TLS/HTTP2, Jetty\u0027s async pipeline can coalesce small request bodies (6 bytes in the test) with the headers send, bypassing the per-chunk `onRequestContent` callback entirely. The upload succeeds (the file is written on the server), but the progress listener is never notified.\n\nThis is a platform-specific timing issue in Jetty\u0027s HTTP/2 send pipeline — on Linux and Windows, the callback fires reliably; on macOS (kqueue-based IO), the write completes without the intermediate notification.\n\n## Fix\n\nAfter a successful PUT request completes, check whether any `onRequestContent` callback actually fired (tracked via a new `progressed` AtomicBoolean). If not, fire the missing `transportStarted`/`transportProgressed` events retroactively using the task\u0027s data. This is safe because:\n\n1. The request completed successfully (no exception, status \u003c 300)\n2. The data was definitely transmitted (verified by the server response)\n3. The events fire synchronously on the caller\u0027s thread, not in Jetty\u0027s async pipeline\n\nThe fix is minimal (16 lines added) and does not change behavior when `onRequestContent` fires normally — the retroactive path is only taken as a fallback.\n\n## Testing\n\n- All 103 JettyTransporterTest tests pass (90 active + 10 disabled + 3 others)\n- All 144 ApacheTransporterTest tests pass (unaffected)\n- No changes to test infrastructure\n\n---\n_Hermes Agent (Claude Opus 4) on behalf of Guillaume Nodet_" }, { "commit": "80657d33fb906358ada33864bdf2724e52aacd63", "tree": "0fdd1db29e0328c2d2c04d402f8f977895da0080", "parents": [ "a2efc997fc5c92d077d72c7ec006ae3f5b3a6ac6" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 20 18:58:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 18:58:34 2026 +0200" }, "message": "Fix #2204: Windows AccessDeniedException on install when IDE holds jar open (#2205)\n\n## Summary\n\nFixes a Windows regression introduced by PR #2083 (resolver 2.0.24 / Maven 3.10.0): `mvn install` throws `java.nio.file.AccessDeniedException` when an IDE (e.g. IntelliJ IDEA) keeps the installed `.jar` open.\n\nCloses #2204 · Closes apache/maven#13329\n\n## Root Cause\n\nPR #2083 replaced the old stream-based file copy with `Files.move()` + `ATOMIC_MOVE` in `PathProcessorSupport.retryingMove()` to fix the f007 security finding. That was the right thing to do — but it introduced a behavioral regression on Windows.\n\n**Old behavior (resolver ≤ 1.9.x):** `classicCopy()` opens the target with a truncating `FileOutputStream`. On Windows, this succeeds even when another process has the file open for reading, because the stream open uses `FILE_SHARE_READ` semantics.\n\n**New behavior (resolver 2.0.24):** `Files.move()` maps to `MoveFileEx`/`ReplaceFile` on Windows. These system calls **require exclusive access** to the destination — any open handle (including a shared read-only handle from an IDE\u0027s class loader) causes `AccessDeniedException`. With only 5 retries at 50 ms (250 ms total), a persistent IDE lock is never released and all retries fail.\n\n| Operation | Target open by reader? | Succeeds on Windows? |\n|---|---|---|\n| `FileOutputStream(target)` (stream write) | Yes (shared read) | ✅ Yes |\n| `Files.move(src, target, ATOMIC_MOVE)` | Yes (shared read) | ❌ No — needs exclusive |\n\n## Fix\n\nAfter exhausting all `WINDOWS_MOVE_ATTEMPTS` with `AccessDeniedException`, fall back to `classicCopy()` directly to the target as a last resort, logging a `WARN` to identify the situation. The atomicity guarantee is lost for this edge case (a concurrent reader may observe a partially written file), but the build completes — matching the pre-2.0.24 behavior that users relied on.\n\nA new system property controls the fallback:\n```\n-Dorg.eclipse.aether.spi.io.PathProcessor.WINDOWS_CLASSIC_COPY_FALLBACK\u003dfalse\n```\nSetting it to `false` disables the fallback and propagates the original `AccessDeniedException` (strict never-truncate mode).\n\nThe fallback is also exposed as an overridable `protected boolean isClassicCopyFallbackEnabled()` method for subclasses and tests.\n\n## Note on PR #2198\n\nThe open PR #2198 (hard-link install) sidesteps this problem for `mvn install` by not copying at all. This PR fixes the underlying `retryingMove` logic, which is also exercised in other code paths (download to local repo, `writeFile`). The two PRs are complementary.\n\n## Changes\n\n- `maven-resolver-spi/pom.xml` — add `slf4j-api` compile dependency and `slf4j-simple` test dependency\n- `PathProcessorSupport.java` — add `WINDOWS_CLASSIC_COPY_FALLBACK` constant, `isClassicCopyFallbackEnabled()` hook, fallback logic in `retryingMove()`\n- `PathProcessorSupportTest.java` — rename `retryingMoveNeverTruncatesTargetOnFailure` → `...WhenFallbackDisabled` (adds subclass override), add `retryingMoveFallsBackToClassicCopyOnPersistentLock`\n\n_Hermès Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_" }, { "commit": "a2efc997fc5c92d077d72c7ec006ae3f5b3a6ac6", "tree": "b293fa7ba784549e27dd8e3bbd7ee902abecebff", "parents": [ "94b42a3998784ee1d218566391fcffb0a1f25886" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 20 18:57:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 18:57:18 2026 +0200" }, "message": "feat: use hard links for artifact installation by default (#2198)\n\n## Summary\n\nAdd `aether.installer.hardLink` configuration property (default `true`) to make `DefaultInstaller` create a hard link from the build output file to its destination in the local repository, instead of copying it.\n\nThis saves significant disk I/O for large JARs when building locally: instead of reading and writing the full file, the OS simply adds a new directory entry pointing to the same inode.\n\n## Motivation\n\nThis was raised as a follow-up to [apache/maven-install-plugin#468](https://github.com/apache/maven-install-plugin/pull/468#pullrequestreview-5478638729). The install plugin only assembles the `ArtifactInstallerRequest` — the right place to implement hard-link installation is here in `DefaultInstaller`, which owns the file-copy step.\n\nThe feature is analogous to `FileTransporter.WriteOp.HARDLINK` which already exists for `file://` remote repositories.\n\n## Behaviour\n\n- **Default: `aether.installer.hardLink\u003dtrue`** — hard link attempted first.\n- **Fallback to copy** — when `Files.createLink` throws `UnsupportedOperationException` (unsupported filesystem) or `IOException` (cross-device link, `EXDEV`), the installer silently falls back to a regular file copy. The build is never broken.\n- **Opt out: `aether.installer.hardLink\u003dfalse`** — always copy, same as the previous behaviour.\n\n## Design notes\n\n- Property defined on `ConfigurationProperties` with full `@configurationSource` / `@configurationType` / `@configurationDefaultValue` / `@configurationRepoIdSuffix` annotations following the established pattern.\n- `PREFIX_INSTALLER \u003d \"aether.installer.\"` added alongside the existing prefix constants.\n- Hard links share an inode. Any tool that overwrites build output **in-place** (not via atomic rename) would silently corrupt the cached artifact. Standard Maven tooling always uses atomic rename for `target/`, so this is safe in practice.\n- When destination exists as a directory, the code explicitly checks and falls through to `copyWithTimestamp` (which will fail as before), preserving existing error semantics.\n\n## Testing\n\n- `testHardLinkInstallCreatesHardLink` — verifies that install succeeds and (on same-device filesystems) produces a hard link (same inode). Gracefully skips the inode assertion on cross-device environments (common in CI containers).\n- `testHardLinkDisabledFallsThroughToCopy` — sets `aether.installer.hardLink\u003dfalse` and verifies install still succeeds with correct content.\n- All 585 existing tests in `maven-resolver-impl` pass unchanged.\n\n## Configuration\n\nTo opt out globally, add to `~/.m2/settings.xml`:\n\n```xml\n\u003c!-- in Maven 4: via project properties or system property --\u003e\n```\n\nOr pass on the command line:\n\n```\nmvn install -Daether.installer.hardLink\u003dfalse\n```\n\n---\n_Hermès Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_" }, { "commit": "94b42a3998784ee1d218566391fcffb0a1f25886", "tree": "90fdfcf597dfb1076163a562763e2bb66b7daa98", "parents": [ "836f47abc784b62bc574cb9ee3ef14fa2a8a15dd" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Tue Oct 20 19:55:46 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 18:55:46 2026 +0200" }, "message": "GH-2196: Avoid warning for same-session repository fall-through (#2197)\n\n`DefaultUpdateCheckManager` now tracks artifact not-found markers written during the current `RepositorySystemSession`. When a sibling repository later provides the artifact, a marker written in the same session is still expired but logged at DEBUG. A marker from an earlier session continues to produce a warning.\n\nFixes #2196\n\n### Testing\n\n- `mvn -pl maven-resolver-impl -am -Dtest\u003dDefaultUpdateCheckManagerTest -Dsurefire.failIfNoSpecifiedTests\u003dfalse test` — 38 tests passed\n- `mvn -pl maven-resolver-impl -am test` — 585 tests passed, 5 skipped\n- `mvn -pl maven-resolver-impl -am spotless:check` — passed\n- `git diff --check` — passed\n\n---\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [x] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)" }, { "commit": "836f47abc784b62bc574cb9ee3ef14fa2a8a15dd", "tree": "d9e133ca9beffdc21038bd329208c03c20fdca9e", "parents": [ "40281920eea9bfb950c93a09ab7af7802b67536e" ], "author": { "name": "HARSHA B", "email": "harshab1062006@gmail.com", "time": "Tue Oct 20 22:25:11 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 18:55:11 2026 +0200" }, "message": "Fix prefix filter verification for denied artifact paths (#2188)\n\nDescription\n\nFixes the Maven Resolver prefix filter behavior when a repository serves an artifact path that is missing from its \"prefixes.txt\".\n\nA repository such as an Artifactory/Nexus virtual repository may expose a prefixes file generated from a public repository index while also serving private/internal artifacts. When the requested artifact path is absent from that prefixes file, the prefix filter can reject an artifact that the repository actually serves.\n\nThis change verifies a denied path against the repository before permanently rejecting it.\n\nImplementation\n\n- Successfully served denied paths are cached and allowed on subsequent requests.\n- Definitively absent paths remain blocked and are negative-cached to avoid repeated remote probes.\n- Transient/unknown transport failures are not negative-cached, allowing later requests to retry.\n- Verification is performed per exact artifact path.\n- Multiple independently denied paths can be verified without disabling the repository\u0027s prefix filter globally.\n- Existing \"verifyDeniedDropsTree\u003dtrue\" legacy behavior remains unchanged.\n\nSecurity\n\nThe implementation preserves the security invariant introduced by Resolver PR #2082.\n\nA successful verification of one denied path does NOT disable the prefix filter for the entire repository or authorize unrelated artifact paths.\n\nOnly the exact remotely verified path is allowed.\n\nTests\n\n- \"PrefixesRemoteRepositoryFilterSourceVerifyDeniedTest\": 14/14 passed\n- \"PrefixesRemoteRepositoryFilterSourceTest\": 6/6 passed\n- Checkstyle: passed with 0 violations\n- Spotless: passed\n- \"git diff --check\": clean\n\nRelated Maven Issue\n\nThis addresses the underlying Maven Resolver behavior reported in Apache Maven issue #13385:\n\nhttps://github.com/apache/maven/issues/13385\n\nThe original issue is reported against Maven because Maven users experience the resolution failure, while the prefix filtering implementation itself lives in Maven Resolver." }, { "commit": "40281920eea9bfb950c93a09ab7af7802b67536e", "tree": "0fcdc272bffd435f44e8713ae8829284edae347a", "parents": [ "4eb4c903bdd02f0b3c7fb14069f45286a7c25df6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 20 18:10:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 18:10:45 2026 +0200" }, "message": "build(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin (#2215)\n\nBumps [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) from 0.26.3 to 0.26.5.\n- [Release notes](https://github.com/siom79/japicmp/releases)\n- [Changelog](https://github.com/siom79/japicmp/blob/master/release.py)\n- [Commits](https://github.com/siom79/japicmp/compare/japicmp-base-0.26.3...japicmp-base-0.26.5)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.siom79.japicmp:japicmp-maven-plugin\n dependency-version: 0.26.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "4eb4c903bdd02f0b3c7fb14069f45286a7c25df6", "tree": "8cd863749da78e014da730079fb0b711656d87d7", "parents": [ "5991d0ebe0f59305a6ee8da03884a3c9c30228ab" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Oct 19 22:13:52 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Mon Oct 19 23:02:19 2026 +0200" }, "message": "Use push for PR Automation and add PR Check\n\n[ci skip]\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5991d0ebe0f59305a6ee8da03884a3c9c30228ab", "tree": "ad5edbd26d0ace179e287ebc1b50e9e06d5a9bcb", "parents": [ "029b3903e1ff4c3579bcb6a2f05f67abfccf885f" ], "author": { "name": "Dhruv_G_123", "email": "9bdhruv@gmail.com", "time": "Tue Oct 13 00:48:03 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 21:18:03 2026 +0200" }, "message": "[MRESOLVER-1736] Re-enable expect-continue on JDK 17.0.17+ (#2180)\n\n## Description\n\nFixes #1736.\n\nIn #1112, a workaround was introduced to disable `Expect: 100-continue` on Java versions prior to 20 due to JDK-8286171.\n\nThe underlying JDK issue has since been fixed and backported to JDK 17.0.17 (JDK-8364017). However, Maven Resolver currently checks only the Java feature version, so `Expect-Continue` remains disabled for JDK 17.0.17 and later JDK 17 releases.\n\nThis change makes the Java version check version-aware by using `Runtime.Version`:\n\n* JDK 17.0.0–17.0.16: `Expect-Continue` remains disabled\n* JDK 17.0.17+: `Expect-Continue` is enabled\n* JDK 18.x–19.x: `Expect-Continue` remains disabled\n* JDK 20+: `Expect-Continue` is enabled\n\nA regression test was added to verify the version-specific behavior, including the 17.0.16 → 17.0.17 boundary, and to verify that an explicitly enabled `Expect: 100-continue` header is sent on JDK 17.0.17+.\n\nThe regression test fails with the previous implementation on JDK 17.0.17 and passes with this change.\nThe version matrix test covers JDK 11, 17.0.16, 17.0.17, 17.0.18, 18, 19, 20, and 21.\n\nThe regression test fails with the previous implementation on JDK 17.0.17 and passes with this change.\n- [x] I hereby declare this contribution to be licensed under the Apache License Version 2.0, January 2004\n- [ ] I hereby declare that I have filed an Apache Individual Contributor License Agreement." }, { "commit": "029b3903e1ff4c3579bcb6a2f05f67abfccf885f", "tree": "b5ca73c49646bc6a322e3a635df5fc3f727643fa", "parents": [ "6ef98328d9ce39edb6c8d569039e0db7d138e291" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 20:59:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 20:59:57 2026 +0200" }, "message": "build(deps-dev): bump com.redis:testcontainers-redis from 2.2.4 to 3.0.0 (#2200)\n\nBumps [com.redis:testcontainers-redis](https://github.com/redis-field-engineering/testcontainers-redis) from 2.2.4 to 3.0.0.\n- [Release notes](https://github.com/redis-field-engineering/testcontainers-redis/releases)\n- [Commits](https://github.com/redis-field-engineering/testcontainers-redis/compare/v2.2.4...v3.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: com.redis:testcontainers-redis\n dependency-version: 3.0.0\n dependency-type: direct:development\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6ef98328d9ce39edb6c8d569039e0db7d138e291", "tree": "e3cb25bf39c59dd14961990dc3f45cc601451ceb", "parents": [ "dbfe933ae47ead5e9e6b5fcd67d80c451c51ff50" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 20:59:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 20:59:47 2026 +0200" }, "message": "build(deps): bump commons-codec:commons-codec from 1.22.1 to 1.23.0 (#2202)\n\nBumps [commons-codec:commons-codec](https://github.com/apache/commons-codec) from 1.22.1 to 1.23.0.\n- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)\n- [Commits](https://github.com/apache/commons-codec/compare/rel/commons-codec-1.22.1...rel/commons-codec-1.23.0)\n\n---\nupdated-dependencies:\n- dependency-name: commons-codec:commons-codec\n dependency-version: 1.23.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "dbfe933ae47ead5e9e6b5fcd67d80c451c51ff50", "tree": "cc5c883dd5d65ee8ee6a8a0452aca0289ae9b347", "parents": [ "d2dda33407f37b9f8ca8ddac7d8f7486ce52640e" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Mon Oct 12 20:03:06 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 19:03:06 2026 +0200" }, "message": "GH-1857: Include all repository failures in artifact messages (#2186)\n\n## What\n\nInclude the per-repository failures for unresolved artifacts in `ArtifactResolutionException` messages. The primary cause and existing message format remain unchanged when there is only one failure.\n\n## Why\n\nWhen artifact resolution fails for different reasons across repositories, the exception message currently reports only one cause. For example, a missing artifact in Central can be hidden by a transfer error from another repository, leaving users without the information needed to distinguish a bad coordinate from an unavailable repository.\n\n## How\n\nKeep the current primary cause selection, then append other recorded failures with the artifact and repository ID. Sort those additional details so the message is stable despite the concurrent map used to store repository failures.\n\nFixes #1857\n\n## Testing\n\n- Fail-before: the regression test failed on the unmodified implementation because the exception message contained the transfer failure but omitted Central\u0027s not-found reason.\n- Pass-after: `mvn -pl maven-resolver-api,maven-resolver-impl -am -Dspotless.apply.skip\u003dtrue -Dspotless.check.skip\u003dtrue test` — 583 tests passed, 5 skipped.\n- `mvn -pl maven-resolver-api spotless:check` — passed.\n- `git diff --check` — passed.\n\nThe reactor tests ran with Java 25; Spotless was verified separately with Java 17 because the configured formatter is incompatible with Java 25.\n\n## Compatibility\n\nSingle-failure messages are unchanged and covered by a regression assertion. Successful resolution behavior is unchanged.\n\nAI assistance was used for analysis and implementation; the patch and tests were reviewed before submission.\n\n---\n\nTo make clear that you license this contribution under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0), check one of the following:\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [ ] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).\n\nSigned-off-by: Efe Gökdemir \u003cgokdemirefe1903@gmail.com\u003e" }, { "commit": "d2dda33407f37b9f8ca8ddac7d8f7486ce52640e", "tree": "977fe286982f75796cf8ec974cdaaa67f2b13aeb", "parents": [ "05b2e683d558c2f2e7456c03320da76f668f942e" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Mon Oct 12 19:58:33 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 18:58:33 2026 +0200" }, "message": "GH-2156: Skip filters for disabled repository policies (#2192)\n\nCloses #2156.\n\nThe artifact and metadata resolvers currently evaluate remote repository filters before checking whether a repository policy enables access for the requested artifact or metadata. With prefix filtering enabled, this can trigger repository probes for requests that cannot use that repository.\n\nSkip artifact filtering when the relevant release or snapshot policy is disabled. For metadata, determine the enabled source repositories first and skip filtering when there are none. Descriptor-repository prefix auto-discovery remains out of scope.\n\nRegression tests cover disabled policies in artifact and metadata resolution. Both failed against the unmodified implementation and pass with this change.\n\nValidation:\n- `mvn -pl maven-resolver-impl -am -Dtest\u003dDefaultArtifactResolverTest,DefaultMetadataResolverTest -Dsurefire.failIfNoSpecifiedTests\u003dfalse test` — 40 tests passed.\n- `mvn -pl maven-resolver-impl -am test` — 585 tests passed, 5 skipped.\n- `mvn -pl maven-resolver-impl -am spotless:check` — passed.\n- `git diff --check` — passed.\n\n---\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [ ] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)." }, { "commit": "05b2e683d558c2f2e7456c03320da76f668f942e", "tree": "c6b564ffb9f4f9420b42773371399107aa88644e", "parents": [ "60275d9c1860bc56a496f73d65b78ae581fc719e" ], "author": { "name": "Piotr Findeisen", "email": "piotr.findeisen@gmail.com", "time": "Mon Oct 12 18:57:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 18:57:29 2026 +0200" }, "message": "Allow symlinked local path prefix directories (#2184)\n\nThe real-path check compared the whole path below the local repository base directory with its symlink-resolved form, so any symbolic link below the base directory made every artifact beneath it \"not present\". This rejects layouts where a split prefix directory (e.g. the remote cache) is a symbolic link to a cache shared by several local repositories, forcing a re-download of every artifact on each build.\n\nOnly the coordinate-derived part of the path can be aliased by case-colliding coordinates; the base directory and the prefix directories come from configuration. Resolve the prefix directory and compare real(prefix directory) + coordinate path with real(full path). Case and normalization aliases in the coordinates are still rejected.\n\n\n\n\u003c!-- Add your description here... what, why and how you resolve the issue --\u003e\n\n- Fixes #2183\n\n---\n\nTo make clear that you license your contribution under\nthe [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\ncheck one of the following:\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [x] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)." }, { "commit": "60275d9c1860bc56a496f73d65b78ae581fc719e", "tree": "ea22478debd845b03bb48efb723cbed7df191ca1", "parents": [ "7128537b1cf75f57295aa5d258932144701876ec" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Mon Oct 12 19:53:44 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 18:53:44 2026 +0200" }, "message": "GH-13383: Normalize default ports in Apache auth cache (#2185)\n\n## Summary\n\n- Normalize implicit HTTP and HTTPS ports in the Apache transport authentication cache so entries created from a repository URL match requests using the effective default port.\n- Preserve explicit ports and schemes, keeping authentication scoped to the same origin.\n\nFixes apache/maven#13383\n\n## Testing\n\n- `mvn -pl maven-resolver-transport-apache -am -Dtest\u003dApacheTransporterTest#testConcurrentAuthCacheMatchesImplicitDefaultPort -Dsurefire.failIfNoSpecifiedTests\u003dfalse test` — passed.\n- `mvn -pl maven-resolver-transport-apache -am test` — passed (all selected reactor tests; Apache transport: 144 tests, 6 skipped).\n- `mvn -pl maven-resolver-transport-apache -am spotless:check` — passed.\n- `git diff --check` — passed.\n- The regression test failed on the original implementation for both HTTP/80 and HTTPS/443 (cache lookup returned `null`) and passed after the fix.\n\nAI assistance: Codex assisted with analysis, implementation, and validation. The change was reviewed locally, and the commit includes DCO sign-off.\n\n---\n\nTo make clear that you license your contribution under the\n[Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\ncheck one of the following:\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [ ] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).\n\nSigned-off-by: Efe Gökdemir \u003cgokdemirefe1903@gmail.com\u003e" }, { "commit": "7128537b1cf75f57295aa5d258932144701876ec", "tree": "783cee5c607faad3fbc601f9ddfca6e5aab3d607", "parents": [ "9add368cc96b0e2599ce4c0290cdb6b8bf8abceb" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Mon Oct 12 19:51:02 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 18:51:02 2026 +0200" }, "message": "Fix #2173: Remove false deprecation from Path constructor (#2193)\n\nFixes #2173.\n\nThe Path-based constructor replaces the deprecated File overload, but its Javadoc was also tagged as deprecated and linked to itself. Remove that misleading tag while keeping the File overload deprecated.\n\nValidation:\n- `mvn -pl maven-resolver-spi -am test javadoc:javadoc` — 124 tests passed; Javadoc generated.\n- `mvn -pl maven-resolver-spi -am spotless:check` — passed.\n- Checked the generated API docs: the Path overload is no longer deprecated, while the File overload remains deprecated. The incorrect Path deprecation label was present before the change.\n- `git diff --check` — passed.\n\n---\n\n- [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [ ] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)." }, { "commit": "9add368cc96b0e2599ce4c0290cdb6b8bf8abceb", "tree": "34bfce271c9645e208f651804e109681b0069b5e", "parents": [ "4de6a95079ca1383d99e6ada5606668e665bef70" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 12 18:50:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 18:50:29 2026 +0200" }, "message": "Fix PathConflictResolver: use BFS to guarantee correct depth ordering in expandedNodes guard (#2175)\n\n## Problem\n\n`PathConflictResolver` introduced an OOM fix in #2153 (v2.0.24) using an `expandedNodes` guard to prevent exponential `Path` allocation on dense graphs. The guard tracks the minimum depth at which each `DependencyNode` instance was expanded. However, it used **DFS (LIFO stack)** traversal, which does not guarantee that a shared `DependencyNode` instance is first seen at its minimum depth.\n\nIn real Maven builds, the resolver\u0027s `DataPool` caches and reuses `List\u003cDependencyNode\u003e` children across multiple parent paths at different depths (via `getChildren`/`putChildren`). When the same `DependencyNode` instance appears at depth D and D\u0027 \u003c D, DFS may process the deeper occurrence first — recording depth D in `expandedNodes`. When the shallower occurrence (depth D\u0027) is later encountered, the guard detects D\u0027 \u003c D and **re-enqueues** the node, creating duplicate partition entries for its children at both D+1 and D\u0027+1 depths. These extra loser paths produce spurious `push()` calls that execute `parent.dn.getChildren().remove(child.dn)` on shared `DependencyNode` objects, corrupting the resolved dependency graph.\n\nThis caused the `MavenITmng0095ReactorFailureBehaviorTest` ITs to fail with Maven 4 after the 2.0.24 bump.\n\n## Fix\n\nSwitch `gatherCRNodes` from **DFS (LIFO `ArrayList`)** to **BFS (FIFO `ArrayDeque`)**. BFS processes nodes level-by-level, guaranteeing the first dequeue of any `DependencyNode` is at its **minimum reachable depth**. The `expandedNodes` guard then correctly suppresses all deeper/equal occurrences without re-enqueueing — producing exactly one partition entry per child at the correct (shallowest) depth, matching `NearestVersionSelector` semantics.\n\nThe OOM prevention property is preserved: each `DependencyNode` instance is still expanded **exactly once**, keeping the total `Path` count at O(unique nodes × max-degree).\n\n## Verification\n\n- All 467 `maven-resolver-util` tests pass\n- Built Maven 4.1.0-SNAPSHOT with `2.0.25-SNAPSHOT` resolver and ran `MavenITmng0095ReactorFailureBehaviorTest` locally: **3/3 pass** (`testitFailAtEnd`, `testitFailFast`, `testitFailNever`)\n- Two new regression tests for shared `DependencyNode` correctness added to `ConflictResolverTest`\n\nFixes regression introduced in #2153 / v2.0.24." }, { "commit": "4de6a95079ca1383d99e6ada5606668e665bef70", "tree": "99be159d184375c1984274304a7fedeed7ff22a3", "parents": [ "c0755b5ec2eddfc98ead888fba59ce02960fad32" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 12 16:30:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 16:30:26 2026 +0200" }, "message": "Fix minor documentation issues in release-highlights page (#2187)\n\n- Add missing trailing period to \u0027Native S3 transport\u0027 bullet\n- Fix grammar: \u0027use as a (read-only)\u0027 instead of \u0027use as (read only)\u0027\n- Align site.xml menu label with page H1: \u0027Notable Features\u0027\n\nFollows up on #2170." }, { "commit": "c0755b5ec2eddfc98ead888fba59ce02960fad32", "tree": "3735b65ff414269b3d9d64b1c8666818378de8be", "parents": [ "a949eb05b3caff598562a5aa0e6ab9295d288f5c" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 11 23:36:33 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 11 23:36:33 2026 +0200" }, "message": "Update ATR metadata\n\n[ci skip]\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a949eb05b3caff598562a5aa0e6ab9295d288f5c", "tree": "b18cde86c8e05ab4efe6fac5141e2da710c15f08", "parents": [ "1801bd588915c8f5f23db27ecd568a4a83e83472" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Sun Oct 11 12:09:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 11 12:09:46 2026 +0200" }, "message": "build(deps): bump org.eclipse.jetty:jetty-bom from 12.1.13 to 12.1.14 (#2195)\n\nBumps [org.eclipse.jetty:jetty-bom](https://github.com/jetty/jetty.project) from 12.1.13 to 12.1.14.\n- [Release notes](https://github.com/jetty/jetty.project/releases)\n- [Commits](https://github.com/jetty/jetty.project/compare/jetty-12.1.13...jetty-12.1.14)\n\n---\nupdated-dependencies:\n- dependency-name: org.eclipse.jetty:jetty-bom\n dependency-version: 12.1.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1801bd588915c8f5f23db27ecd568a4a83e83472", "tree": "3a2e97384361fb3ce2a75114ee633c4d6f916975", "parents": [ "39da34bcc58cc18e546ab948941795fa6e31431f" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Thu Oct 08 18:15:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 18:15:05 2026 +0200" }, "message": "Add page that summarize 2.0.x features (#2170)\n\nAdd page that summarize 2.0.x features" }, { "commit": "39da34bcc58cc18e546ab948941795fa6e31431f", "tree": "ee46fb3556def038a365576a1a4a9c96e6af9f80", "parents": [ "4c3d2b05f6f906287a95a63578ba9d240358ab71" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 05:23:54 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Oct 07 13:47:48 2026 +0200" }, "message": "build(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin\n\nBumps [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) from 0.26.2 to 0.26.3.\n- [Release notes](https://github.com/siom79/japicmp/releases)\n- [Changelog](https://github.com/siom79/japicmp/blob/master/release.py)\n- [Commits](https://github.com/siom79/japicmp/compare/japicmp-base-0.26.2...japicmp-base-0.26.3)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.siom79.japicmp:japicmp-maven-plugin\n dependency-version: 0.26.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "4c3d2b05f6f906287a95a63578ba9d240358ab71", "tree": "db22e544564bac92913917701e50aa10e50ce3ac", "parents": [ "33b114e880e3e7f68a167e8ab594a5ad03d54a27" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 05 21:48:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 05 21:48:29 2026 +0200" }, "message": "build(deps): bump com.google.guava:guava from 33.7.1-jre to 33.7.2-jre (#2176)\n\nBumps [com.google.guava:guava](https://github.com/google/guava) from 33.7.1-jre to 33.7.2-jre.\n- [Release notes](https://github.com/google/guava/releases)\n- [Commits](https://github.com/google/guava/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.google.guava:guava\n dependency-version: 33.7.2-jre\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "33b114e880e3e7f68a167e8ab594a5ad03d54a27", "tree": "e8f27fbdf15a18865bb90f2b6327bfe0eea57749", "parents": [ "00738315e6b46dfa22d122bcb216e6776b488ec1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 02 05:23:56 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 03 20:21:45 2026 +0200" }, "message": "build(deps): bump maven3Version from 3.9.16 to 3.10.0\n\nBumps `maven3Version` from 3.9.16 to 3.10.0.\n\nUpdates `org.apache.maven:maven-resolver-provider` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-model-builder` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.16 to 3.10.0\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.16...maven-3.10.0)\n\nUpdates `org.apache.maven:maven-settings` from 3.9.16 to 3.10.0\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-resolver-provider\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-model-builder\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-plugin-api\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-settings\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "00738315e6b46dfa22d122bcb216e6776b488ec1", "tree": "5db90c83efd8059bdfcacb71af68176bc21d0ef6", "parents": [ "27b1014a1f5bbb81bf0746e2577e31d7ce8cb3f6" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Fri Oct 02 20:20:12 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Fri Oct 02 20:20:12 2026 +0200" }, "message": "Simplify GH PR template boilerplate\n\n[ci skip]\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "27b1014a1f5bbb81bf0746e2577e31d7ce8cb3f6", "tree": "1f3028faa08f2dbfbbe3e6b58cfb90fbf2b8c8d7", "parents": [ "d247c15370cd19043ea68ecbb6967abb264bd989" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 30 13:25:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 30 13:25:40 2026 +0200" }, "message": "build(deps): bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#2169)\n\nBumps org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-lang3\n dependency-version: 3.21.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d247c15370cd19043ea68ecbb6967abb264bd989", "tree": "648391c4458a7257b328a67e7f59de0858863583", "parents": [ "366bd1ffae39a1150220d4f4d9d3c30afcfa9fba" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 28 08:01:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 28 08:01:38 2026 +0200" }, "message": "build(deps): bump version.slf4j from 2.0.19 to 2.0.20 (#2167)\n\nBumps `version.slf4j` from 2.0.19 to 2.0.20.\n\nUpdates `org.slf4j:slf4j-api` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:slf4j-simple` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:slf4j-nop` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:jul-to-slf4j` from 2.0.19 to 2.0.20\n\n---\nupdated-dependencies:\n- dependency-name: org.slf4j:slf4j-api\n dependency-version: 2.0.20\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-simple\n dependency-version: 2.0.20\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-nop\n dependency-version: 2.0.20\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:jcl-over-slf4j\n dependency-version: 2.0.20\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:jul-to-slf4j\n dependency-version: 2.0.20\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "366bd1ffae39a1150220d4f4d9d3c30afcfa9fba", "tree": "a52501e0bc9fa251a738d6512e2264efae7a796f", "parents": [ "764255047bad014c415e9ca387cb9dc4b204149e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 28 08:01:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 28 08:01:11 2026 +0200" }, "message": "build(deps): bump org.mockito:mockito-core from 5.23.0 to 5.24.0 (#2168)\n\nBumps [org.mockito:mockito-core](https://github.com/mockito/mockito) from 5.23.0 to 5.24.0.\n- [Release notes](https://github.com/mockito/mockito/releases)\n- [Commits](https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.mockito:mockito-core\n dependency-version: 5.24.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "764255047bad014c415e9ca387cb9dc4b204149e", "tree": "f71752e40f46175a1523f43bdf6c8c2cde625844", "parents": [ "a9dc49593c3023c7c3fde50d0df55223dda98a04" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 27 22:18:38 2026 +0200" }, "committer": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 27 22:18:38 2026 +0200" }, "message": "[maven-release-plugin] prepare for next development iteration\n" }, { "commit": "a9dc49593c3023c7c3fde50d0df55223dda98a04", "tree": "0789a68f3051d92927a4784a93420ea1b8b8ec59", "parents": [ "75d5855f115ad5efcb9ff642ebeac0c1d2e45cfa" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 27 22:18:20 2026 +0200" }, "committer": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 27 22:18:20 2026 +0200" }, "message": "[maven-release-plugin] prepare release maven-resolver-2.0.24\n" }, { "commit": "75d5855f115ad5efcb9ff642ebeac0c1d2e45cfa", "tree": "0dfce345761ce13c3a8ac0f739b8c11619fdbbbd", "parents": [ "ab99a6ddfc13c3ca9a6661de9d077fb5f0b4520d" ], "author": { "name": "Jitesh Khatri", "email": "jiteshkhatri990@gmail.com", "time": "Sun Sep 27 23:24:17 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 27 19:54:17 2026 +0200" }, "message": "Fix flaky forked IPC client test (#2166)\n\nFixes #2165.\n\nThe forked IPC server process can still hold the test log and repository\nfiles when JUnit starts cleaning up the temporary directory on Windows.\n\nKeep a reference to the forked Process and wait for it to terminate after\nthe server receives the stop request. If it does not terminate within the\ntimeout, forcibly terminate it and wait again.\n\nThis ensures the forked process has released its file handles before\ntemporary-directory cleanup.\n\nTests:\n- IpcClientForkedTest#forkedServerDiagnosticsAreWrittenToLog: 20/20 runs passed\n- maven-resolver-named-locks-ipc: 14/14 tests passed\n- Checkstyle: 0 violations\n- Spotless: clean\n- RAT: clean" }, { "commit": "ab99a6ddfc13c3ca9a6661de9d077fb5f0b4520d", "tree": "d8af45fdc24e5ab019d6bacd9ba45f35a7c318cf", "parents": [ "e372e8b21772bde7c96a39197b4d852bdbdf9b0f" ], "author": { "name": "Elliotte Rusty Harold", "email": "elharo@users.noreply.github.com", "time": "Sat Sep 26 13:35:57 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 13:35:57 2026 +0000" }, "message": "docs: rewrite how-resolver-works.md to STE rules (#2046)\n\nIf anything\u0027s still incorrect, we can fix it in another PR" }, { "commit": "e372e8b21772bde7c96a39197b4d852bdbdf9b0f", "tree": "ed80253374e4dedd352e31f13df7b2fa4283fd52", "parents": [ "7a141f809326ddad64d36fa7e892c269bdd4f0e1" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Sat Sep 26 14:24:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 14:24:38 2026 +0200" }, "message": "Fix PathConflictResolver OOM on dense dependency graphs (#2153)\n\nIn highly connected graphs (e.g. a 813-module reactor where each module\ndepends on ~9 others), PathConflictResolver created an exponential number\nof Path objects: each DependencyNode reachable via N different parent paths\nwas expanded N times, causing its entire subtree to be traversed N times.\nThis resulted in OutOfMemoryError in gatherCRNodes/addChildren.\n\nFix: track which DependencyNode instances have already been expanded in\nan IdentityHashMap\u003cDependencyNode, Integer\u003e (mapping to expansion depth).\nWhen the same DependencyNode is encountered again via a different parent\npath, a Path entry is still created (so all occurrences appear in the\nconflict partition for winner selection), but its subtree is not re-\ntraversed. If the same node is later reached at a shallower depth, it is\nre-expanded at that depth, updating the recorded minimum.\n\nAlso eliminates the per-Path HashSet\u003cString\u003e copy used for O(1) cycle\n## Problem\n\n`PathConflictResolver` runs out of memory (`OutOfMemoryError: Java heap space`) on highly connected dependency graphs, such as a 813-module reactor where each module depends on ~9 others.\n\nReproduced with `-Xmx512m`:\n```\njava.lang.OutOfMemoryError: Java heap space\n at PathConflictResolver$Path.addChildren(PathConflictResolver.java:699)\n at PathConflictResolver$State.gatherCRNodes(PathConflictResolver.java:363)\n```\n\nWorkaround: `-Daether.conflictResolver.impl\u003dclassic`\n\n## Root Cause\n\n`gatherCRNodes` performs a BFS/DFS traversal that creates a new `Path` object for **every edge** in the expanded dependency tree — not just one per `DependencyNode`. When the same node is reachable via N different parent paths, its entire subtree is traversed N times, leading to exponential `Path` allocation.\n\nFor 813 modules × ~9 avg deps, this produces millions of `Path` objects instead of the ~7,500 that actually represent unique graph edges.\n\n## Fix\n\nTwo complementary changes:\n\n**1. Expansion deduplication** (the OOM fix): \nTrack which `DependencyNode` instances have already been expanded in an `IdentityHashMap\u003cDependencyNode, Integer\u003e` (mapped to expansion depth). When the same `DependencyNode` is encountered again via a different parent path, a `Path` entry is still created for it (so all occurrences appear in the conflict partition for winner selection), but its subtree is **not re-traversed**. If the same node is later reached at a shallower depth, it is re-expanded and the recorded minimum is updated.\n\n**2. Remove per-Path `HashSet` copy** (CPU/memory fix): \nThe `HashSet\u003cString\u003e conflictIdsOnPath` that was copied on every `Path` construction is dropped. Since expansion deduplication already bounds total path count to O(graph edges), the O(depth) parent-chain walk for `hasConflictIdOnPathToRoot` is sufficient and cheaper. This also eliminates the per-node allocation that was identified as a JFR hotspot in the prior PR #2075.\n\n## Testing\n\n- All 463 `maven-resolver-util` tests pass\n- Regression test `denseGraphDoesNotOom` added: 3-level shared graph (100×100×100), would create ~1M `Path` objects and OOM without the fix, completes in \u003c100ms with it\n- Both `path` and `classic` resolvers produce identical results on the reproducer\n\n## Performance — 813-module reproducer (813 modules × 9 deps \u003d 7,317 edges)\n\nBenchmarked on the exact reproducer topology (circular dependency graph, all nodes shared):\n\n**Minimum heap to complete without OOM:**\n| Resolver | Min heap |\n|---|---|\n| `PathConflictResolver` (fixed) | **28 MB** |\n| `ClassicConflictResolver` | **48 MB** |\n\n**First-run latency (cold JIT, as in a real build):**\n| Resolver | Time |\n|---|---|\n| `PathConflictResolver` (fixed) | **~260 ms** |\n| `ClassicConflictResolver` | **~5,400 ms** |\n\n**Warmed latency (JIT steady state):**\n| Resolver | Time |\n|---|---|\n| `PathConflictResolver` (fixed) | **~2–3 ms** |\n| `ClassicConflictResolver` | **~50–90 ms** |\n\nThe fixed `PathConflictResolver` is **×21 faster cold** and **×30 faster warmed** than `ClassicConflictResolver`, while also requiring 40% less heap. The classic resolver\u0027s 5 s cold time is dominated by GC pressure when the heap is near its minimum: it allocates heavily during traversal and spends most of the first run collecting garbage.\n\n_Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_\n\n\nCo-authored-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e" }, { "commit": "7a141f809326ddad64d36fa7e892c269bdd4f0e1", "tree": "dc376a73e11a4591ced123cd791503b6b1912b97", "parents": [ "ea7524026be57e822ca0da42443854b62eef6dfe" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Sat Sep 26 15:18:15 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 14:18:15 2026 +0200" }, "message": "fix: synchronize IPC stream access (#2163)\n\n## Summary\n\n- Synchronize access to the IPC input and output streams with the existing client monitor.\n- Keep stream references consistent with `close()` while receiving and sending requests.\n\nFixes #1991\n\n## Testing\n\n- `mvn -pl maven-resolver-named-locks-ipc -am -DskipITs test` — passed with OpenJDK 21 (all selected modules; IPC module: 13 tests)\n- `mvn -pl maven-resolver-named-locks-ipc -DskipTests spotless:check` — passed with OpenJDK 21\n- `git diff --check` — passed\n\nAI assistance: Codex assisted with analysis, implementation, and validation. The change was reviewed locally and the submitted commit includes DCO sign-off.\n\n\nAssisted-by: Codex (GPT-5)\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e" }, { "commit": "ea7524026be57e822ca0da42443854b62eef6dfe", "tree": "3a572288754f8be607a9133af1a47679f6c58bdd", "parents": [ "26b4de33b03cab608ce970b741b928537f649ab2" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Sat Sep 26 15:17:39 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 14:17:39 2026 +0200" }, "message": "fix: propagate fatal errors from Jetty request content (#2161)\n\n## Summary\n\nStop converting fatal JVM errors raised while reading or rewinding Jetty request content into ordinary failed content chunks.\n\n## Changes\n\n- Catch `Exception` rather than `Throwable` in `PutTaskRequestContent` for recoverable channel failures.\n- Add regression coverage proving that errors from both `read()` and `rewind()` propagate to the caller.\n\n## Testing\n\n- `mvn -pl maven-resolver-transport-jetty -am -DskipITs -Drat.skip -Dspotless.skip\u003dtrue verify` — passed.\n- Focused pre-fix regression test failed as expected, then passed after the fix: `PutTaskRequestContentTest` (2 tests).\n- Full relevant reactor tests: 103 Jetty tests passed (10 skipped), with all upstream reactor tests passing.\n- Checkstyle and `git diff --check` — passed.\n- Spotless could not complete on the installed Java 27 runtime because the bundled Palantir formatter raises `NoSuchFieldError`; this is an environment/tooling compatibility issue affecting existing files.\n\n## Notes\n\n- No overlapping open PR was found for #1988 or `PutTaskRequestContent`.\n- The complete diff was reviewed by the submitter; AI assistance was used during implementation.\n\nFixes #1988\n\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e" }, { "commit": "26b4de33b03cab608ce970b741b928537f649ab2", "tree": "f742a1d33d893833feff9634163167cd42e057b0", "parents": [ "7c17f06506259d1588ddf724b5e5464902874575" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Sat Sep 26 15:17:17 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 14:17:17 2026 +0200" }, "message": "Use structured logging in the IPC server (#2157)\n\n## Summary\n\nFixes #1989 by routing `IpcServer` diagnostics through SLF4J instead of writing directly to `System.out`.\n\n## Changes\n\n- Add an SLF4J logger to `IpcServer`.\n- Route debug, informational, and error messages through the logger.\n- Preserve throwable details for error diagnostics.\n\n## Testing\n\n- `mvn -pl maven-resolver-named-locks-ipc -am -DskipITs -DskipTests\u003dfalse -Dspotless.apply.skip\u003dtrue -Dspotless.check.skip\u003dtrue test` — PASS (reactor build; all tests passed).\n- `git diff --check` — PASS.\n- Spotless formatting was not run because the repository configured Palantir formatter is incompatible with the available JDK 27 runtime; the source follows existing formatting and the build Checkstyle and RAT checks passed.\n\n## Notes\n\n- No overlapping open PR was found for issue #1989 or the IpcServer logging change during the final duplicate check.\n- The commit is signed and includes the required DCO sign-off.\n- AI assistance was used to prepare this change; the submitter has reviewed the implementation and test results.\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e\n\n* Preserve forked IPC diagnostics\n\n* test: bound forked IPC diagnostics test\n\n* fix: clean up IPC server shutdown state\n\n* test: always close forked IPC client\n\n---------\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e" }, { "commit": "7c17f06506259d1588ddf724b5e5464902874575", "tree": "0ebf186e774c385c8b79a60bb56279aa3be17eed", "parents": [ "1e41e1e2ad31fa3e92bb9d58e476c3fd56b0f4dc" ], "author": { "name": "Jitesh Khatri", "email": "jiteshkhatri990@gmail.com", "time": "Sat Sep 26 17:46:02 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 14:16:02 2026 +0200" }, "message": "[MRESOLVER-2142] Increase HTTP3 port allocation retries (#2150)\n\n## Description\n\nIncrease the number of attempts to find a port that is free for both TCP and UDP from 20 to 100.\n\nThis reduces the likelihood of the flaky HTTP/3 test failing when the same port number is occupied in the UDP port space.\n\nFixes #2142" }, { "commit": "1e41e1e2ad31fa3e92bb9d58e476c3fd56b0f4dc", "tree": "a0e015ad1476fee7d091b440234fbddb2477b610", "parents": [ "2b510a5136193269735bb9259e0cbc49c98dd29b" ], "author": { "name": "Goutam Adwant", "email": "8672451+goutamadwant@users.noreply.github.com", "time": "Sat Sep 26 05:15:50 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 14:15:50 2026 +0200" }, "message": "Honor system proxy credentials in Apache transport (#2148)\n\nRelated to #2139.\n\nWith `aether.connector.http.useSystemProperties\u003dtrue`, the Apache transport uses the configured proxy but ignores its username and password, causing HTTP 407. Use matching HTTP or HTTPS system proxy credentials when explicit Resolver authentication is unavailable.\n\nKeep fallback credentials scoped to the actual proxy, separate from repository authentication. Clear their authentication state when a redirect changes proxy or becomes direct. The opt-in remains disabled by default; this adds no public API or runtime dependency.\n\nTests cover GET/HEAD/PUT, HTTPS CONNECT, explicit credential precedence, missing or mismatched properties, origin isolation, and redirects. The native regression fails with HTTP 407 on unchanged master.\n\nValidation on Java 21 with Maven 3.9.16:\n\n- `mvn verify`: all 31 modules passed; 2,082 tests, zero failures/errors, 87 existing skips.\n- `mvn -Prun-its verify`: passed, including 107 integration tests and one Invoker build.\n- All 19 new proxy cases ran without skips.\n\nThis targets Resolver 2.x. The corresponding 1.9.x backport covers the lineage used by Maven 3.9.16.\n\n- [x] The pull request addresses one issue without unrelated changes.\n- [x] The description explains what changed, how, and why.\n- [x] The commit has a meaningful subject and body.\n- [x] Regression tests fail without the runtime fix.\n- [x] `mvn verify` passed.\n- [x] `mvn -Prun-its verify` passed.\n- [x] I hereby declare this contribution to be licenced under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0).\n- [ ] File an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf), as applicable." }, { "commit": "2b510a5136193269735bb9259e0cbc49c98dd29b", "tree": "424821f38958d8cf7e041d282fd159fcf1b2b379", "parents": [ "41d4c664bed1db862af7dc5f1c3dae5241a08b44" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Sat Sep 26 14:44:17 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 13:44:17 2026 +0200" }, "message": "docs: refresh resolver misconception references (#2158)\n\n## Summary\n\n- Update the “Important Consequences” documentation to reflect that MASSEMBLY-1008 was fixed in Maven Assembly 3.7.0.\n- Retain MRESOLVER-391 as related background rather than presenting it as the same unresolved bug.\n\n## Testing\n\n- `mvn -N -DskipTests -Dspotless.check.skip\u003dtrue -Dspotless.apply.skip\u003dtrue site` — passed.\n- `mvn -DskipTests -Dspotless.check.skip\u003dtrue -Dspotless.apply.skip\u003dtrue site` — the root and first 12 modules rendered successfully; the reactor stopped at `maven-resolver-transport-apache` because its existing test dependency `maven-resolver-test-http:2.0.24-SNAPSHOT` was not available in the reactor.\n- `git diff --check` — passed.\n\n- [x] I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004.\n\nFixes #2038\n\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e" }, { "commit": "41d4c664bed1db862af7dc5f1c3dae5241a08b44", "tree": "10e9cfdeee69143899e0a9e70cc0864592ab863b", "parents": [ "105490a8100a7db31cb89eff4d84d474b1861ae3" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Sat Sep 26 14:32:12 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 13:32:12 2026 +0200" }, "message": "docs: clarify checksum trust boundaries (#2162)\n\n## Summary\n\nClarify the distinction between transport-provided checksums, which verify integrity, and trusted checksums, which can detect changes to a local repository when independently protected.\n\n## Changes\n\n- Refine the checksum overview to scope its integrity and trust statements to transport-provided checksums.\n- Explain the independent provenance and protection assumptions for trusted checksums.\n\n## Testing\n\n- `git diff --check` — passed\n- Compared the branch against `master` — only the two intended documentation files changed.\n\nNo overlapping open pull request was found for #2042 or the checksum trust documentation. AI assistance was used to prepare this patch; the changes were reviewed for accuracy and scope.\n\nFixes #2042" }, { "commit": "105490a8100a7db31cb89eff4d84d474b1861ae3", "tree": "a243a2d3f7244c1f6a29f3a0b946ef8e9ed583bd", "parents": [ "255230f8f5ec6009c9a51078d2f48920cccaf60d" ], "author": { "name": "Aman Sharma", "email": "amansha@kth.se", "time": "Sat Sep 26 13:30:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Sep 26 13:30:52 2026 +0200" }, "message": "Fix expected-checksums.md: correct config filename to .mvn/maven.config (#2152)\n\nThe docs instruct readers to add CLI flags to `.mvn/config`, but Maven only reads `.mvn/maven.config` for project-level CLI arguments — `.mvn/config` is silently ignored.\n\nCo-authored-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "255230f8f5ec6009c9a51078d2f48920cccaf60d", "tree": "4c86dfef0880ec7bcfe329f2d44757f724d32ac9", "parents": [ "9628bb4acecd6c5648fd417cb39a29f3362f8a08" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Sep 25 12:15:26 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Sep 25 21:08:26 2026 +0200" }, "message": "Use inputExcludes for apache-rat 0.18\n\nRemove leftover java17+ profile from root pom that was\nleft from earlier manual conversion. Keep only pluginManagement\nconfig; profile activation is handled by parent.\n" }, { "commit": "9628bb4acecd6c5648fd417cb39a29f3362f8a08", "tree": "e2d86c306cfde4ca5a6f6381d4dd52bbda454cce", "parents": [ "a90b7f7f8a05b961c2880ac48ca880b3640b3545" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 23 05:23:48 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Fri Sep 25 21:08:26 2026 +0200" }, "message": "Bump org.apache.maven:maven-parent from 49 to 50\n\nBumps [org.apache.maven:maven-parent](https://github.com/apache/maven-parent) from 49 to 50.\n- [Release notes](https://github.com/apache/maven-parent/releases)\n- [Commits](https://github.com/apache/maven-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-parent\n dependency-version: \u002750\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "a90b7f7f8a05b961c2880ac48ca880b3640b3545", "tree": "41b3de793ba80f1b08867bcfc87f25525cf693c5", "parents": [ "180c4cd2c3abb73e0a9bd0aadb57e069f2c116f9" ], "author": { "name": "Konrad Windszus", "email": "kwin@apache.org", "time": "Tue Sep 15 12:12:51 2026 +0200" }, "committer": { "name": "Konrad Windszus", "email": "konrad@windszus.net", "time": "Wed Sep 16 20:06:12 2026 +0200" }, "message": "Use configuration key as link label\n\nThe underlying field name is not-known and irrelevant to users.\nThis closes #2146" }, { "commit": "180c4cd2c3abb73e0a9bd0aadb57e069f2c116f9", "tree": "f93b3c2d952adeb7537216fcfdeb5b7bf9f99079", "parents": [ "f7d00ef1dc3da84c621e27ab182dd34b7811b2b6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 16 19:14:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 19:14:07 2026 +0200" }, "message": "Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#2145)\n\nBumps [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) from 3.6.1 to 3.6.2.\n- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)\n- [Commits](https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.1...3.6.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.mojo:build-helper-maven-plugin\n dependency-version: 3.6.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f7d00ef1dc3da84c621e27ab182dd34b7811b2b6", "tree": "9c3f264b90e63ddbca934c0e09ec29b9f16d5c41", "parents": [ "659a32ec396dc702bae5028299278364f39169cb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Sep 16 19:13:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 16 19:13:44 2026 +0200" }, "message": "Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 (#2144)\n\nBumps [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) from 3.6.3 to 3.6.4.\n- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases)\n- [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/3.6.3...3.6.4)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.mojo:exec-maven-plugin\n dependency-version: 3.6.4\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "659a32ec396dc702bae5028299278364f39169cb", "tree": "73169964cb6492203d21513adabbc7bf5531a15f", "parents": [ "9527a2f3da3c550701887e249aa58341027266fd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 14 19:01:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 14 19:01:40 2026 +0200" }, "message": "Bump dev.sigstore:sigstore-java from 2.2.0 to 2.3.0 (#2141)\n\nBumps [dev.sigstore:sigstore-java](https://github.com/sigstore/sigstore-java) from 2.2.0 to 2.3.0.\n- [Release notes](https://github.com/sigstore/sigstore-java/releases)\n- [Changelog](https://github.com/sigstore/sigstore-java/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/sigstore/sigstore-java/compare/v2.2.0...v2.3.0)\n\n---\nupdated-dependencies:\n- dependency-name: dev.sigstore:sigstore-java\n dependency-version: 2.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9527a2f3da3c550701887e249aa58341027266fd", "tree": "2d431b392f74c3e15e395af7ad608ac3657a84f1", "parents": [ "3cc91ea267616918bc6e2a17417edf053f8e92dc" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 13 21:24:16 2026 +0200" }, "committer": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 13 21:24:16 2026 +0200" }, "message": "[maven-release-plugin] prepare for next development iteration\n" }, { "commit": "3cc91ea267616918bc6e2a17417edf053f8e92dc", "tree": "883fd2694d820eaa310231100563da10af74adae", "parents": [ "b703cdbb98d57b1a98c39c7721b7c934937b9a69" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 13 21:24:00 2026 +0200" }, "committer": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 13 21:24:00 2026 +0200" }, "message": "[maven-release-plugin] prepare release maven-resolver-2.0.23\n" }, { "commit": "b703cdbb98d57b1a98c39c7721b7c934937b9a69", "tree": "babc50c4efd59562c4b4c32131decad99dec1ed1", "parents": [ "a719e8d0113312563b3647877f0dbc5947e4fed6" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Sun Sep 13 20:51:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Sep 13 20:51:58 2026 +0200" }, "message": "Finish the repo key story (#2135)\n\nThe `f013` triggered an avalanche of issues, so instead to \"hack it in\", let\u0027s solve it properly. This is all about unfinished \"repository key functions\" story, that was there, but unfinished. \n\nThis PR does:\n* next to existing `system repo key` introduces equal rights `tracking repo key`. Former is used to coalesce remote repositories (RemoteRepositoryManager), latter is used always when \"file path and remote repository\" are being dealt with (so composing file paths).\n* introduced several extra options as well, while removed (coalesced) some others\n* cleaned up key usage, so now consistently tracking repo key is used across all subsystems that deal with disk and remote reposes\n* ingested #2134 \n\nCo-authored-by: Guillaume Nodet \u003cgnodet@gmail.com\u003e" }, { "commit": "a719e8d0113312563b3647877f0dbc5947e4fed6", "tree": "d235d993717ac80c944ab82033253a15d0a49d6b", "parents": [ "d1d8d940a94c20b04306e6e6214d316e42501948" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Fri Sep 11 23:13:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 23:13:41 2026 +0200" }, "message": "test: move from minio docker image (#2140)\n\nIt has be just dropped. Quick\u0027n\u0027dirty replacement is\nfork of it:\nhttps://hub.docker.com/r/pgsty/silo" }, { "commit": "d1d8d940a94c20b04306e6e6214d316e42501948", "tree": "eaa937810318026a33d3f3911afdb07da9c5a103", "parents": [ "18753daa30739a699ea56e30865e8de7f4e58369" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Sep 11 18:13:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Sep 11 18:13:18 2026 +0200" }, "message": "Bump org.apache.maven.plugin-tools:maven-plugin-tools-api (#2136)\n\nBumps [org.apache.maven.plugin-tools:maven-plugin-tools-api](https://github.com/apache/maven-plugin-tools) from 3.15.2 to 3.16.0.\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugin-tools:maven-plugin-tools-api\n dependency-version: 3.16.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "18753daa30739a699ea56e30865e8de7f4e58369", "tree": "cab582b68d616b67b412a40af4d5ae5e5db06591", "parents": [ "0a74153d40a5982adf2d6a7ee45ac0a6fccff7a3" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Sep 08 17:24:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 17:24:38 2026 +0200" }, "message": "fix: accept legacy ID-only tracking entries via backward-compatible fallback (#2133)\n\n## Summary\n\nWhen the tracking key function is URL-qualified (`nid_hurl`, the default since 2.0.23 / commit 339161b), tracking entries written by an older resolver using ID-only keys (`nid` format, e.g. `artifact\u003ecentral\u003d`) are invisible to the new lookup which expects `artifact\u003ecentral-\u003csha1\u003e\u003d`.\n\nThis causes **all** artifacts cached in the local repository before the upgrade to appear as \"present but unavailable\", triggering full re-downloads from remote repositories. In CI environments and integration tests that use fake/file-based repositories (like maven-integration-testing), this breaks resolution entirely — see [apache/maven#13078 (comment)](https://github.com/apache/maven/pull/13078#issuecomment-5583775310).\n\n## Root Cause\n\nThe tracking key change from `nid` to `nid_hurl` (finding f013 in the security audit) makes existing `_remote.repositories` entries invisible:\n\n- **Old entry**: `maven-core-3.8.6.pom\u003ecentral\u003d`\n- **New lookup**: `maven-core-3.8.6.pom\u003ecentral-\u003csha1 of repo URL\u003e\u003d` → no match\n\nThe `isTracked()` check finds the old `central\u003d` entry, so the artifact is treated as \"tracked but not for the current repo\" rather than \"untracked\" — the untracked inter-op fallback does not apply, and the artifact is rejected.\n\n## Fix\n\nAdd a backward-compatible fallback in `applyTracking()`: when the URL-qualified (`nid_hurl`) lookup misses, try the system-wide key function (`nid` by default) as a fallback. If that matches, accept the artifact and log a debug message. The legacy entry will be upgraded to the new key format on the next download.\n\nThis preserves the f013 security improvement (URL-qualified tracking prevents same-id-different-URL repository poisoning for *new* entries) while providing a smooth upgrade path from older resolvers.\n\n## Tests\n\n- Updated `testUrlQualifiedTrackingTreatsLegacyIdOnlyEntriesAsStale` → `testUrlQualifiedTrackingAcceptsLegacyIdOnlyEntriesViaFallback`: legacy entries from a matching repo are now accepted\n- Added `testUrlQualifiedTrackingRejectsLegacyIdOnlyEntriesFromDifferentRepo`: legacy entries from a *different* repo are still rejected\n- `testUrlQualifiedTrackingDistinguishesSameIdDifferentUrl`: unchanged — URL-qualified entries still prevent same-id-different-URL poisoning" }, { "commit": "0a74153d40a5982adf2d6a7ee45ac0a6fccff7a3", "tree": "c28e40f9962679c6e9f558fb040f5da378167f35", "parents": [ "bd7421fc65fffff6ad3054cae7634441f622df1a" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Sep 08 10:33:49 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 10:33:49 2026 +0200" }, "message": "Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108)\n\n### Summary of Fixes\n\n1. **[#1990](https://github.com/apache/maven-resolver/issues/1990)**: `ChainedRepositoryListener` and `ChainedTransferListener` now log exceptions from listeners at WARNING level in `handleError()` instead of silently swallowing them. Added unit tests verifying that an exception in one listener does not disrupt delivery to subsequent listeners in the multicast chain.\n2. **[#1992](https://github.com/apache/maven-resolver/issues/1992)**: Refactored `DefaultArtifactResolver` and `DefaultMetadataResolver` to eliminate redundant internal/finally `SyncContext.close()` calls, ensuring `SyncContext` instances are closed strictly once. Added unit test `testSyncContextIsClosedExactlyOnce` verifying single-close lifecycle.\n3. **[#1350](https://github.com/apache/maven-resolver/issues/1350) ([MRESOLVER-674])**: Seeded `Random` in `GenericVersionTest.testCompareUuidRandom` with a fixed seed to ensure deterministic, reproducible test runs across CI environments." }, { "commit": "bd7421fc65fffff6ad3054cae7634441f622df1a", "tree": "4dc56caf4ec018e6abade846129d88efacff7c48", "parents": [ "534e16e8fb161a82f36a3a863b526340389c68cb" ], "author": { "name": "Jitesh Khatri", "email": "jiteshkhatri990@gmail.com", "time": "Tue Sep 08 13:52:19 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 10:22:19 2026 +0200" }, "message": "[docs] Clarify trusted checksum sources (#2127)\n\n## Summary\n\nAddresses #2043.\n\nThis documentation update expands the Trusted Checksums documentation to explain the Sparse Directory trusted checksum source in more detail.\n\n### Changes\n\n* Documented how Sparse Directory trusted checksums are initially generated.\n* Documented Sparse Directory configuration, including `basedir` and `originAware`.\n* Explained how trusted checksums are verified.\n* Documented the `failIfMissing` behavior.\n* Added guidance on choosing between the Summary File and Sparse Directory trusted checksum sources." }, { "commit": "534e16e8fb161a82f36a3a863b526340389c68cb", "tree": "e57896f4142684b4740569f910446ae9bf4a4eca", "parents": [ "f786540666bc450132bf08dc7832f5d9d768669b" ], "author": { "name": "jjj-n", "email": "1357598741@qq.com", "time": "Tue Sep 08 16:22:03 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 10:22:03 2026 +0200" }, "message": "[MRESOLVER-379] Preserve relocated range candidates (#2114)\n\n## Summary\n\n- Continue processing version-range candidates after handling a relocation in both the BF and DF dependency collectors.\n- Update the existing range-plus-relocation dirty-tree fixtures so that all relocated candidates are retained.\n- Preserve the collector-specific ordering: descending for BF and resolver order for DF.\n\n## Problem\n\nFor a dependency such as `A:1 -\u003e B:[1,3]`, where `B:1`, `B:2`, and\n`B:3` relocate to `C:1`, `C:2`, and `C:3`, the relocation branch\nreturned from `processDependency` after processing one range candidate.\n\nAs a result:\n\n- DF retained only `C:1`.\n- BF retained only `C:3`, because BF iterates range candidates in\n descending order.\n\nThe remaining versions from `VersionRangeResult` were never processed.\n\n## Fix\n\nReplace the method-level `return` with a loop-level `continue` in the\nrelocation branches of both collectors.\n\nThis completes processing of the current relocation chain and then\nresumes the surrounding range-candidate loop. Version selection and\nconflict resolution behavior are unchanged.\n\n## Tests\n\nThe existing\n`testTransitiveDepsUseRangesAndRelocationDirtyTree` test is inherited by\nall three concrete collector test variants.\n\nRed phase, before the runtime change:\n\n- DF expected 3 candidates but received 1 (`C:1`).\n- BF with skipper expected 3 candidates but received 1 (`C:3`).\n- BF without skipper expected 3 candidates but received 1 (`C:3`).\n\nGreen phase:\n\n- Focused regression tests: 3 passed.\n- Full BF/DF collector suites: 65 passed.\n- `maven-resolver-impl` and prerequisite reactor modules: 1,223 tests,\n 0 failures, 0 errors.\n- Checkstyle, Spotless, and Apache RAT passed.\n- Windows/JDK 21 full `mvn verify`: the first 14 reactor modules passed\n before `FileTransporterTest` hit three unrelated symbolic-link\n privilege errors.\n- After excluding that environment-blocked test class, the first 28\n reactor modules passed, including all production modules. The\n unrelated `maven-resolver-demo-snippets` module later failed while\n downloading Guava 19.0 from Maven Central with a connection timeout.\n\nFixes #1051\n\n*This change was created with AI assistance and manually reviewed and tested.*\n\nFollowing this checklist to help us incorporate your\ncontribution quickly and easily:\n\n- [x] This pull request addresses one issue without unrelated changes.\n- [x] The pull request description explains what changes, how, and why.\n- [x] The commit has a meaningful subject and body.\n- [x] The behavioral regression test fails without the runtime change.\n- [ ] Full `mvn verify` completed successfully. It was attempted; all\n production modules passed, but local verification was blocked by\n Windows symbolic-link privileges and a Maven Central connection timeout.\n- [ ] `mvn -Prun-its verify` completed successfully. The additional IT\n profiles are unrelated to the modified collector behavior and were\n not run after the external-network failure above.\n- [x] I hereby declare this contribution to be licenced under the\n [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)\n- [ ] In any other case, please file an\n [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf)." }, { "commit": "f786540666bc450132bf08dc7832f5d9d768669b", "tree": "53c5ec990a2145f96f7818fb5c7349c4210cc6ba", "parents": [ "dec4ec3e908c68fa2ee3b6e41d2c2afcaf998f3d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Sep 08 09:47:48 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 09:47:48 2026 +0200" }, "message": "Bump version.slf4j from 2.0.18 to 2.0.19 (#2130)\n\nBumps `version.slf4j` from 2.0.18 to 2.0.19.\n\nUpdates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:slf4j-nop` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:jul-to-slf4j` from 2.0.18 to 2.0.19\n\n---\nupdated-dependencies:\n- dependency-name: org.slf4j:slf4j-api\n dependency-version: 2.0.19\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-simple\n dependency-version: 2.0.19\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-nop\n dependency-version: 2.0.19\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:jcl-over-slf4j\n dependency-version: 2.0.19\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.slf4j:jul-to-slf4j\n dependency-version: 2.0.19\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "dec4ec3e908c68fa2ee3b6e41d2c2afcaf998f3d", "tree": "727977890e4874c20b6df66c97912289886733c7", "parents": [ "bfc634f5bac2de83eb78e0afcf64ca43eec609fe" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Sep 08 09:47:19 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 09:47:19 2026 +0200" }, "message": "Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (#2131)\n\nBumps [org.eclipse.jetty:jetty-bom](https://github.com/jetty/jetty.project) from 12.1.12 to 12.1.13.\n- [Release notes](https://github.com/jetty/jetty.project/releases)\n- [Commits](https://github.com/jetty/jetty.project/compare/jetty-12.1.12...jetty-12.1.13)\n\n---\nupdated-dependencies:\n- dependency-name: org.eclipse.jetty:jetty-bom\n dependency-version: 12.1.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "bfc634f5bac2de83eb78e0afcf64ca43eec609fe", "tree": "77a0b9e714d3d6fb935f847d906c0977b6b25eda", "parents": [ "a05268a034ad3a46376b5fe0fc6c574f42d41553" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Sep 07 12:50:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 12:50:36 2026 +0200" }, "message": "Bump com.github.siom79.japicmp:japicmp-maven-plugin (#2129)\n\nBumps [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) from 0.26.1 to 0.26.2.\n- [Release notes](https://github.com/siom79/japicmp/releases)\n- [Changelog](https://github.com/siom79/japicmp/blob/master/release.py)\n- [Commits](https://github.com/siom79/japicmp/compare/japicmp-base-0.26.1...japicmp-base-0.26.2)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.siom79.japicmp:japicmp-maven-plugin\n dependency-version: 0.26.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a05268a034ad3a46376b5fe0fc6c574f42d41553", "tree": "d1b1e768dcffffaaeb070fca051a3f2ac7a85947", "parents": [ "1947adc905d59edc749fefa246dae92146bd6be0" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Sep 02 10:13:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 10:13:39 2026 +0200" }, "message": "Create the local repository directory before resolving its real path (#2111)\n\nSince #2104 `EnhancedLocalRepositoryManager` resolves the real path of its base directory in the constructor, and `Path.toRealPath()` requires the path to exist.\n\nA local repository that has not been created yet (first build on a machine, or a new `-Dmaven.repo.local`) therefore made the enhanced factory throw `NoLocalRepositoryManagerException`. `DefaultLocalRepositoryProvider` treats that as \"try the next factory\" and quietly selected `SimpleLocalRepositoryManager`, so the whole first session ran without `_remote.repositories` tracking. Before #2104 the real path was computed lazily, only for files that already existed, so the directory was always present.\n\nThe fix creates the directory before resolving it. Maven creates it on first write anyway and the enhanced manager needs it for its tracking files, so nothing observable changes for a usable local repository; an unwritable location still fails the same way it did before.\n\nTwo tests cover the factory directly and the provider\u0027s fallback selection with a not-yet-existing base directory; both fail on master with the `NoSuchFileException` cause.\n\n*This change was created with AI assistance.*" }, { "commit": "1947adc905d59edc749fefa246dae92146bd6be0", "tree": "8d8c2802d436bba3624f13b580e28a02d9a4e434", "parents": [ "323ce6e111331f60e7e0e80c6ad5322c7a4489af" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Sep 01 21:18:50 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Sep 01 21:20:38 2026 +0200" }, "message": "Ignore plexus-utils 4.x for maven-resolver-1.9.x in Dependabot\n\nplexus-utils 4.x extracted org.codehaus.plexus.util.xml.* into plexus-xml, causing binary incompatibility with the Maven 3.9.x runtime baseline.\n" }, { "commit": "323ce6e111331f60e7e0e80c6ad5322c7a4489af", "tree": "b4c06c6ab85efde59583c90a326e7231a6bdfa7a", "parents": [ "4f27db9dface3f4940f98d527678f5f8d3232d5d" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Sep 01 12:29:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 12:29:46 2026 +0200" }, "message": "Optimize TrackingFileManager unit tests and fix potential lock leaks (#2094) (#2102)\n\n### Summary\n1. **Prevent File Descriptor Exhaustion in Tests**: Reduces iteration count in `TrackingFileManagerTestSupport` from 1,000 to 100 in leak checks and canonical path locking tests.\n2. **Lock Leak Hardening**:\n - `NamedLockFactoryAdapter`: Ensures `namedLock.close()` is invoked if lock acquisition fails/times out or is interrupted, preventing a permanent +1 reference count leak.\n - `CompositeNamedLock`: Automatically unlocks previously acquired sub-locks if a thread is interrupted or encounters an exception mid-way during multi-lock acquisition.\n\n### Root Cause Analysis (macOS / CI FD Exhaustion)\n* In `TrackingFileManagerTestSupport`, each loop iteration creates a new temporary file with a distinct path, creating a distinct `NamedLockKey` and lock file.\n* `FileLockNamedLockFactory` maintains an LRU pool of up to `MAX_CACHED_CHANNELS \u003d 200` open file channels for closed locks.\n* Running 1,000 iterations per test method saturates the 200-channel cache. On macOS (where default `ulimit -n` is 256), combining 200 cached channels with JVM/Surefire baseline descriptors (~50 FDs) directly exhausts the 256 FD limit and throws `Too many open files`.\n* Lowering iterations to 100 ensures channel cache growth peaks at ~100 FDs per test method (staying safely below 256), while still thoroughly verifying leak-free behavior and canonical path deduplication.\n* Reduces test runtime from 18.8s to 5.0s (-73% speedup).\n\nResolves #2094; relates to #2096." }, { "commit": "4f27db9dface3f4940f98d527678f5f8d3232d5d", "tree": "119e6d46c1daac53666bd7a2976fcd66c7063bbb", "parents": [ "02fbe5ca36347fdda3c098996bcac28099f356a3" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Tue Sep 01 12:24:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 12:24:15 2026 +0200" }, "message": "Fix: tidy up f013 (#2104)\n\nInstead of lazy+volatile, just create the real basedir in ctor. The ctor change is okay, as it is package private and it is factory that should create it anyway." }, { "commit": "02fbe5ca36347fdda3c098996bcac28099f356a3", "tree": "2e6b42c3c98cc2fe07dd203515094633a38a0317", "parents": [ "832dd2b08ad16e7505be947963d27aca3eedefe7" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Mon Aug 31 15:55:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 15:55:14 2026 +0200" }, "message": "Fix: log only once the warning in DefRemoteRepoMan (#2100)\n\nCurrent code logs overwhelming amount of WARNs onto console. Also, bail out when logging not needed." }, { "commit": "832dd2b08ad16e7505be947963d27aca3eedefe7", "tree": "37476ed422deda062634de07434346fa061f3798", "parents": [ "f690ba07d23881866dfb69533ca2e3d2a91f002b" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Aug 31 15:53:05 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 15:53:05 2026 +0200" }, "message": "Validate the repository key used in checksum summary file names (#2099)\n\nFollow-up to the review notes on #2089 and #2091: `SummaryFileTrustedChecksumsSource` splices the repository key into the summary file name without the point-of-use validation the sparse source received, so this adds the same `PathUtils.validatePathComponent` guard. The built-in key functions already sanitize; the guard matters for custom `RepositoryKeyFunction` implementations, and the new test wires a non-sanitizing key function to exercise it. Also adds the `GAECVNameMapperTest` that was noted as missing." }, { "commit": "f690ba07d23881866dfb69533ca2e3d2a91f002b", "tree": "1da9333fe27e78928c07712b51f035eb01707534", "parents": [ "dec766d5f5d5f8d8aec64b64dd9b001120a026b4" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Aug 31 15:49:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 15:49:40 2026 +0200" }, "message": "Fix #2096: harden NamedLocksTrackingFileManagerTest against CI load (#2098)\n\n## Summary\n\n- Increase per-operation lock timeout from 5s → 30s in `NamedLocksTrackingFileManagerTest`\n- Add proper `FileLockNamedLockFactory.shutdown()` in `@AfterEach` to close idle channels and lock files\n\n## Root cause analysis\n\nThe test runs 4 threads × 1000 iterations of concurrent `read(shared)` + `update(exclusive)` against the same file, exercising the full `FileLockNamedLock` contention path. Each exclusive lock attempt retries with a 100ms sleep between attempts.\n\nThe 5-second timeout was **already bumped from 1s → 5s** in [194128ae](https://github.com/apache/maven-resolver/commit/194128ae) (\"Seems timeout of 1s is not enough?\"). Recent performance optimizations (#1937) changed the lock acquisition timing characteristics:\n\n1. The **lock-free fast path** in `NamedLockFactorySupport.getLockAndRefTrack()` makes `getLock()` much faster, allowing threads to re-acquire locks more rapidly and increasing file lock contention\n2. The **idle channel pool** in `FileLockNamedLockFactory` (from the FD leak fix) adds a small amount of work inside `locks.compute()`, marginally extending the time the ConcurrentHashMap bucket lock is held\n\nNeither change introduces a concurrency bug — the channel management is correctly serialized by `locks.compute()` bucket locks, and the `tryIncRef` CAS sentinel correctly prevents revival of destroyed holders. However, on loaded CI machines, the changed timing profile can push borderline operations past the 5s threshold.\n\nThe factory was also never shut down after tests, leaking idle `FileChannel` instances." }, { "commit": "dec766d5f5d5f8d8aec64b64dd9b001120a026b4", "tree": "4fedd606a565044c1cf5a7eeea382726de0805c6", "parents": [ "b884f6b2599faf678852f415ec606ecec4e7b96a" ], "author": { "name": "Tamas Cservenak", "email": "tamas@cservenak.net", "time": "Mon Aug 31 14:04:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 14:04:59 2026 +0200" }, "message": "Deps: bump to BC provider 1.85.2 (#2097)\n\nAs it contains relevant fixes\nhttps://www.bouncycastle.org/download/bouncy-castle-java/?filter\u003djava%3Drelease-1-85-2" }, { "commit": "b884f6b2599faf678852f415ec606ecec4e7b96a", "tree": "7bedcc0260b0e370d239452f7a5a5ffca59c7e45", "parents": [ "7006fc33cfb2c48e01718edbede04aff9f2bbc0a" ], "author": { "name": "Jamison-J", "email": "jiangzhen0929@163.com", "time": "Mon Aug 31 20:04:20 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 14:04:20 2026 +0200" }, "message": "Fix #2058: Add links to configuration page (#2060)\n\n## Summary\n\n- generate local Javadoc links for resolved custom configuration types, including nested types\n- add stable anchors for configuration keys and link configuration-field references to those anchors\n- cover intermediate metadata and rendered Markdown with focused doclet tests\n\nFixes #2058\n\n## Verification\n\n- [x] Focused ConfigurationCollectorDocletTest: 4 tests, 0 failures or errors\n- [x] Reactor package through maven-resolver-tools with the focused test and Checkstyle, Spotless, and RAT\n- [x] spotless:check and checkstyle:check for maven-resolver-tools\n- [x] git diff --check\n- [ ] Full mvn verify: the broader Windows run is blocked in the unchanged maven-resolver-transport-file tests because the current account cannot create symbolic links\n- [ ] Integration tests with the run-its profile were not run\n\n## Contribution checklist\n\n- [x] This pull request addresses one issue without unrelated changes.\n- [x] The commit has a meaningful subject and body.\n- [x] Unit tests cover the behavioral changes.\n- [x] I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004." }, { "commit": "7006fc33cfb2c48e01718edbede04aff9f2bbc0a", "tree": "7e3980d2b8bf79e1b9d3af0d960be20d82115c32", "parents": [ "339161be2872b8d15ce657439569b3f3e90773dc" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Aug 31 13:37:21 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 13:37:21 2026 +0200" }, "message": "fix: bound response reads and sanitize remote-derived strings (#2081)\n\n## Summary\n\nFixes 4 findings from the maven-resolver security audit (scan-maven-resolver-20260811):\n\n| Finding | Severity | Description |\n|---------|----------|-------------|\n| f004 | MEDIUM | HTTP error-response bodies read unbounded into memory (decompression-amplified OOM) |\n| f024 | LOW | Hostile remote checksum file causes unbounded allocation |\n| f026 | LOW | Server Last-Modified future date permanently pins artifact against refresh |\n| f028 | LOW | Remote-derived strings reach console logs without control-character sanitization |\n\n**Root cause:** Response bodies, checksum files, timestamps, and strings from the remote side are consumed with no size cap, no plausibility clamp, and no control-character sanitization.\n\n**Fix:** Bound before allocating: cap error-body and checksum reads, clamp timestamps, sanitize control characters in log messages." }, { "commit": "339161be2872b8d15ce657439569b3f3e90773dc", "tree": "4b6b212e138ac276c8bf7fead113b70f6b851ac1", "parents": [ "89da7279c501fdc495829fadd451c9b7eb43eb86" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Aug 31 13:30:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 13:30:32 2026 +0200" }, "message": "fix: earn trust labels through verification and bind tracking to URL (#2080)\n\n## Summary\n\nFixes 5 findings from the maven-resolver security audit (scan-maven-resolver-20260811):\n\n| Finding | Severity | Description |\n|---------|----------|-------------|\n| f005 | MEDIUM | Existence-check peek re-labels cached foreign-repo bytes without checksum verification |\n| f006 | MEDIUM | Snapshot-normalized copy is untracked and later treated as locally installed |\n| f013 | MEDIUM | Repo-id-only keying lets wire-injected repository poison shared local repo |\n| f019 | MEDIUM | Case-colliding coordinates poison distinct GAVs on case-insensitive filesystems |\n| f021 | LOW | Stale tracking-file cache flips repo-id rejection into local-install acceptance |\n\n**Root cause:** The enhanced local repository manager\u0027s availability decision rests on tracking state that can be weaker than the file it judges: fail-open interop branch, id-only tracking keys, case-insensitive filesystem aliasing, and re-labeling without verification.\n\n**Fix:** Make trust labels earned and identity-bound: require verification before re-labeling, bind tracking keys to URLs, use filesystem-faithful comparison, invalidate cache after writes." }, { "commit": "89da7279c501fdc495829fadd451c9b7eb43eb86", "tree": "5261d002309769bbd2b6e885ed65dab08558b3aa", "parents": [ "55252d5fedb9cc64b08c7a77b923a39e495ef8bb" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Aug 31 13:30:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 13:30:01 2026 +0200" }, "message": "fix: bind credentials to origin and reject TLS downgrade redirects (#2085)\n\n## Summary\n\nFixes 5 findings from the maven-resolver security audit (scan-maven-resolver-20260811):\n\n| Finding | Severity | Description |\n|---------|----------|-------------|\n| f002 | MEDIUM | Settings credentials attached by bare ID to POM-declared repositories |\n| f008 | MEDIUM | Apache transport silently follows https-to-http downgrade redirects |\n| f009 | MEDIUM | JDK transport Authenticator hands credentials to any challenging host |\n| f016 | MEDIUM | Jetty transport follows https-to-http redirects without a downgrade guard |\n| f027 | LOW | Operator-configured static auth headers follow redirects cross-origin |\n\n**Root cause:** Credential release decisions ignore where the request is actually going: selectors match on bare repository id with no host binding, authenticators answer any challenger, redirect handling follows cross-origin and https-to-http hops.\n\n**Fix:** Enforce one rule across all transports: credentials go only to the configured origin, and https never silently becomes http." }, { "commit": "55252d5fedb9cc64b08c7a77b923a39e495ef8bb", "tree": "b6111e94320393833df56e2e46c1efb6b73e5476", "parents": [ "a7104fab29aec520b53a42968fa02356482c4301" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Aug 31 13:08:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 13:08:23 2026 +0200" }, "message": "fix: prevent remote signals from weakening operator-configured policy (#2082)\n\n## Summary\n\nFixes 5 findings from the maven-resolver security audit (scan-maven-resolver-20260811):\n\n| Finding | Severity | Description |\n|---------|----------|-------------|\n| f011 | MEDIUM | Metadata checksum policy silently downgraded by release/snapshot weakest-wins merge |\n| f012 | MEDIUM | Descriptor cache ignores repository context: poisoned POM resolution replayed build-wide |\n| f014 | MEDIUM | Single remote probe drops the entire prefixes dependency-confusion filter |\n| f015 | MEDIUM | Remote POM repository declaration downgrades mirror checksum policy to ignore |\n| f018 | MEDIUM | Cached not-found converts transient denial into persistent source rerouting |\n\n**Root cause:** Policy merges, filter state, negative caches, and the descriptor cache all accept remotely-influenced input as authoritative, allowing hostile POMs to silently weaken operator-configured verification controls.\n\n**Fix:** Input from a remote repository must never weaken an operator-configured verification or filtering decision. Merge strongest-wins, include repository context in cache keys, allow only verified paths instead of dropping filters." } ], "next": "a7104fab29aec520b53a42968fa02356482c4301" }