)]}' { "log": [ { "commit": "b46f9353aa59f30ff3e499154baf9746dc7bce52", "tree": "035042a6dbc4847503dc11c3e58633338aeefd06", "parents": [ "0a37aa2fd0332a796de429942806f5241b2ceba5" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Thu Oct 29 22:45:32 2026 +0100" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Thu Oct 29 22:45:32 2026 +0100" }, "message": "Fix cycle match in ATR configuration\n\n[ci skip]\n" }, { "commit": "0a37aa2fd0332a796de429942806f5241b2ceba5", "tree": "52874a710be1275f8a65a30b3309b0afce9bd1aa", "parents": [ "29c638ae48817b596462f8a8354d7fd3634a5ca7" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 07:22:16 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 19:45:20 2026 +0100" }, "message": "Point ciManagement at GitHub Actions\n" }, { "commit": "29c638ae48817b596462f8a8354d7fd3634a5ca7", "tree": "340bcbbfd2f3cf58113efd2a5a7edff85b77672f", "parents": [ "08ab375556c820281973f219459fbbc9d99b4d6a" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Oct 28 21:57:06 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 09:31:56 2026 +0100" }, "message": "Test that lifecycle.xml is read from a rewritten plugin jar\n" }, { "commit": "08ab375556c820281973f219459fbbc9d99b4d6a", "tree": "d3cae2127935b3e87bae1e3711d1ebedbd6c63ba", "parents": [ "9ad830752e938e2125b78e2f723ef2d28c941c82" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Oct 28 21:51:33 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 09:31:56 2026 +0100" }, "message": "Read jar resources without the JVM jar: cache\n\nThe DI index, the core extension descriptor and lifecycle.xml were read\nwith URL.openStream(), which leaves the plugin or extension jar open in\nthe JVM-wide jar: cache for the rest of the build (JDK-8239054): it stays\nlocked on Windows and is read stale under mvnd once rebuilt.\n" }, { "commit": "9ad830752e938e2125b78e2f723ef2d28c941c82", "tree": "c1f99b7b5e353ceea5bfcd5d74d9ea9e660cdd28", "parents": [ "27b151dd8d56fc838f7778c932b50d681db3c651" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 26 11:29:47 2026 +0100" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Thu Oct 29 00:23:39 2026 +0100" }, "message": "Give each mvn.cmd run its own temp directory (#13716)\n\n%RANDOM% is seeded from the clock once per cmd.exe, so mvn.cmd processes\nstarted in the same second named their jvm.config and version temp files\nalike. Since the JVM reads the jvm.config file as an @argfile and it is kept\nuntil the JVM exits, parallel builds ran with each other\u0027s JVM arguments.\nmkdir fails on an existing name, so a retry loop yields a private directory.\n" }, { "commit": "27b151dd8d56fc838f7778c932b50d681db3c651", "tree": "7dc044d00e079bd74eb91fe001695a9a40d377e8", "parents": [ "fc5598415bb5c270f1e153d0ba05c540f8c0e9c9" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Wed Oct 28 16:24:58 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 16:24:58 2026 +0100" }, "message": "Fix race condition in concurrent builder: reactor artifact file snapshotted too early (#13728)" }, { "commit": "fc5598415bb5c270f1e153d0ba05c540f8c0e9c9", "tree": "15f2ec95a45a4f337e4e7753c2b0494a808a37aa", "parents": [ "02bbaf5320504941968e5f4761f6639cf7e621db" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 26 11:41:44 2026 +0100" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Oct 28 01:10:24 2026 +0100" }, "message": "Build the site in CI on Linux only (#13719)\n\nThe site does not depend on the operating system; building it on macOS and\nWindows too cost about 61 runner-minutes per build. Every JDK still builds\nit, since Javadoc output changes with the JDK.\n" }, { "commit": "02bbaf5320504941968e5f4761f6639cf7e621db", "tree": "f9766cacbd1861d381f3a9667bca4455ae12b750", "parents": [ "e4b9ca120a7f67c39e5e320b5ebb34327229e8c9" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 24 16:28:36 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sat Oct 24 17:51:13 2026 +0200" }, "message": "Do not cache the JDK in the lifecycle plugins update\n\nsetup-java 6 caches each installed JDK whenever cache is set; nothing here\nneeds it, and each JDK takes about 200 MB of the cache budget.\n" }, { "commit": "e4b9ca120a7f67c39e5e320b5ebb34327229e8c9", "tree": "bcaa1a147689a70be17ec83a934c38f23329382b", "parents": [ "6399a8e556e52afdfb8b85e6b83179fdf41ad0f0" ], "author": { "name": "Romain Manni-Bucau", "email": "rmannibucau@gmail.com", "time": "Fri Oct 23 12:10:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 12:10:53 2026 +0200" }, "message": "Fixes #13690, ensure to use the reactor project count as progress max counter in the logs instead of project global module count (#13691)\n\nFixes #13690, ensure to use the reactor project count as progress max counter in the logs instead of project global module count" }, { "commit": "6399a8e556e52afdfb8b85e6b83179fdf41ad0f0", "tree": "62fa0fc890b983c29552dc4a7c273dc7cdcba5b1", "parents": [ "7cf86471f294b33daa288ae8d0b3d7c991744d3e" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Fri Oct 23 10:27:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 10:27:39 2026 +0200" }, "message": "feat: internalize plexus-classworlds (fixes #11028)\n\n- Add impl/maven-classworlds: fork of plexus-classworlds with org.codehaus.plexus.classworlds implementation, backward-compat adapters under org.codehaus.classworlds, and new JPMS capabilities (module directive in m2.conf, META-INF/maven/module-access descriptor)\n- Replace external plexus-classworlds dependency with maven-classworlds across all modules\n- Remove classWorldsVersion property from root pom.xml\n- Preserve org.codehaus.classworlds compat package until eclipse-sisu/sisu-project#280 is merged and released (tracked in #13693)\n- Public API surface for classworlds deferred per review feedback\n- Prerequisite for #13491 (JLine on module-path) and #13494 (per-plugin ModuleLayer support)\n- Supersedes #11029" }, { "commit": "7cf86471f294b33daa288ae8d0b3d7c991744d3e", "tree": "c256c46e06a00f58b079bbe44905be60ee5cb8b7", "parents": [ "4b3d0318c67dd396a6c209ca35b8d6ae8ed77407" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 22 22:21:13 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 22:21:13 2026 +0200" }, "message": "Fix DependencyResolutionResult not dispatched when resolution fails (fix #8635)\n\n- LifecycleDependencyResolver dispatched the result only on the success path; on failure the exception was wrapped before the dispatch point, so listeners received the request but never a result\n- Move the dispatch into both the success and catch branches immediately after the resolution call; remove the post-try dispatch; event order on success is unchanged, aggregator builds that tolerate failure still receive the result exactly once\n- Add LifecycleDependencyResolverEventsTest: result fires once on success, once on failure, and once when an aggregator tolerates the failure" }, { "commit": "4b3d0318c67dd396a6c209ca35b8d6ae8ed77407", "tree": "696108f3d3683d84ea3fe3996e9b6b58125986ed", "parents": [ "d560929d3ed7f485f05d31b37c0d86434c8916e4" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 22 22:17:45 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 22:17:45 2026 +0200" }, "message": "Fix #13655: let an explicit localRepo argument take precedence over settings.xml in ApiRunner (#13677)\n\nApiRunner.createSession(injectorConsumer, localRepo, securityMode) checked\nsettings.xml\u0027s \u003clocalRepository\u003e before the explicit localRepo argument, so a\nuser-supplied path was silently ignored whenever settings.xml defined one.\n\nSwap the precedence: explicit argument, then settings.xml, then the default\n~/.m2/repository, matching the CLI\u0027s own LookupInvoker.localRepositoryPath()\norder." }, { "commit": "d560929d3ed7f485f05d31b37c0d86434c8916e4", "tree": "01e5085ed9f264e53213e9ac1386858077be935a", "parents": [ "f387510e08e77e82994fbff6f2bfbf793600a16a" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 22 18:38:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 18:38:39 2026 +0200" }, "message": "Fix #13459: support package-private configuration classes in plugins (#13470)\n\n* Fix #13459: support package-private configuration classes in EnhancedConfigurationConverter\n\nThe Plexus AbstractConfigurationConverter.instantiateObject() uses\nClass.newInstance() which requires a public no-arg constructor.\nThis prevents using package-private classes (or inner classes) as\n@Parameter configuration types in Maven 4 API plugins.\n\nEnhancedCompositeBeanHelper.setFieldValue() already handles non-public\nfields by calling field.setAccessible(true). This commit makes object\ninstantiation symmetric: override the call site in\nEnhancedConfigurationConverter.fromConfiguration() with a local\ninstantiate() method that uses getDeclaredConstructor() +\nsetAccessible(true), consistent with the field injection strategy.\n\n* test: add regression test for #13459 (package-private constructor instantiation)" }, { "commit": "f387510e08e77e82994fbff6f2bfbf793600a16a", "tree": "c0babb20d99a5f83cdb45b407f571bdc384cb78c", "parents": [ "fbb52784f5b6e4453e58d8cf4d425cf19eca4afe" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 22 17:47:47 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 17:47:47 2026 +0200" }, "message": "test(MNG-7131): add regression tests for maven.config one-arg-per-line contract (#13150)" }, { "commit": "fbb52784f5b6e4453e58d8cf4d425cf19eca4afe", "tree": "f370045fe7794c8174589e35c295b8d19c0985ca", "parents": [ "8b008ec5fb310713e93fc521b3036ccc20bbaf24" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 22 17:36:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 17:36:40 2026 +0200" }, "message": "Resolve the parent POM of a source against the directory of its POM (#13538)\n\nSourceWrapper, the bridge between the Source API and the ModelSource2 of the model builder, resolved a related POM with Source.resolve(String). That resolves against the path of the source itself, so the parent POM designated by ../pom.xml of /path/to/pom.xml was /path/to/pom.xml again, the POM being its own parent. Resolve against the directory which contains the file, accepting both kinds of slashes and a directory for its pom.xml, and return null when the source is not backed by a file, as FileModelSource does.\n\nAlso document in Source.resolve(String) that a path source resolves against its own path, which stays as it is for directories, and pin it with a test." }, { "commit": "8b008ec5fb310713e93fc521b3036ccc20bbaf24", "tree": "e2653be49a4ad04a156d1807f987b3a0cecb8be1", "parents": [ "1d9ad455aba7d68284890a156a8294cc9e91c847" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 22 16:20:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 16:20:29 2026 +0200" }, "message": "build: bump ognl:ognl in /compat/maven-compat/src/test/resources (#13681)\n\nBumps [ognl:ognl](https://github.com/orphan-oss/ognl) from 3.0.12 to 3.4.13.\n- [Release notes](https://github.com/orphan-oss/ognl/releases)\n- [Commits](https://github.com/orphan-oss/ognl/commits)\n\n---\nupdated-dependencies:\n- dependency-name: ognl:ognl\n dependency-version: 3.4.13\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1d9ad455aba7d68284890a156a8294cc9e91c847", "tree": "7f8018c8c3a7700f51d0920aabebf766cb58e514", "parents": [ "d3a99da13e29f1caa3b76458a688808cf3ffab20" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 22 15:04:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 15:04:26 2026 +0200" }, "message": "fix: align \u0027POM(s)\u0027 to \u0027POMs\u0027 in StrategyOrchestrator dry-run output (#13632)\n\nThe dry-run branch of logStrategyResult() was still using \u0027POM(s)\u0027\nwhile the rest of the file (and logSummary() fixed in a separate\ncommit) uses \u0027POMs\u0027. Align the production code and the matching\ntest assertion.\n\nRaised by the review on the maven-4.0.x backport PR #13569." }, { "commit": "d3a99da13e29f1caa3b76458a688808cf3ffab20", "tree": "5a144abbf467accbc714e0baee2995a5e704899b", "parents": [ "0336b8c610a3af0293f04bd865bb4a67780f3eb4" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 22 14:51:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 14:51:40 2026 +0200" }, "message": "fix: repair Windows jvm.config handling — escape backslashes in @argfile output and pass via @argfile token\n\n- JvmConfigParser: escape backslashes (and double-quotes) in appendQuotedArguments() so @argfile-format output is correct on Windows paths (per JDK @argfile spec, backslash inside double-quoted strings is an escape character)\n- mvn.cmd: pass jvm.config to the JVM via @\"%JVM_CONFIG_TEMP%\" argfile token instead of reading file content into a cmd.exe variable; eliminates quoting/expansion/metacharacter issues and Windows Defender file-lock races\n- mvn.cmd: delete the temp file after the JVM exits (not before launch) so the @argfile reference is valid at JVM startup" }, { "commit": "0336b8c610a3af0293f04bd865bb4a67780f3eb4", "tree": "a75f7eecbdc564dc93de9d4f62cf2cb8570896d2", "parents": [ "d14adfe4092ee398986c2e49f13aebac8dd0362b" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 22 13:46:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 13:46:29 2026 +0200" }, "message": "Serialize the mojo executions of a project in the concurrent builder (#13591)\n\nWith `-b concurrent` and two or more threads, `MojoExecutor#ensureDependenciesAreResolved`\nreplaces resolved artifacts and artifact filter on the shared MavenProject before each mojo runs,\nincluding mojos with no dependency requirement (which write a null filter). The concurrent executor\nhad no project lock, so mojos of the same project could race on that shared state.\n\nThe concurrent MojoExecutor now takes a per-project lock around dependency preparation and mojo\nexecution for legacy (v4 API) mojos. Maven 4 mojos using @Resolution get their dependencies\ninjected directly and skip both ensureDependenciesAreResolved and the lock, preserving full\nintra-project concurrency for v4 plugins. Executions of different projects are never serialized.\n\nFixes #13590" }, { "commit": "d14adfe4092ee398986c2e49f13aebac8dd0362b", "tree": "35023d97af2f67919c844daeb0c9c5d773d2be85", "parents": [ "5ce3878485f0b82c31e7c2bd01afa84b0d2a77cd" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 22 13:10:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 13:10:40 2026 +0200" }, "message": "feat: add BuildInvocation API to Session\n\nIntroduces `BuildInvocation` as a v4 API type, making build invocation context (goals, CLI flags, user properties, reactor settings) available to plugins and extensions without requiring access to the v3 `MavenExecutionRequest` API.\n\n- Add `BuildInvocation` interface (`@Experimental`, `@Immutable`) in `maven-api-core` capturing goals, user properties (with sensitive-key redaction), curated system info, active profiles, selected/excluded projects, make behavior, resume-from, reactor failure behavior, offline/updateSnapshots/batchMode flags, and thread count\n- Add `MakeBehavior` enum (`UPSTREAM`, `DOWNSTREAM`, `BOTH`) and `ReactorFailureBehavior` enum (`FAIL_FAST`, `FAIL_AT_END`, `FAIL_NEVER`) in `maven-api-core`\n- Add `Session.buildInvocation()` as a default method (throws `UnsupportedOperationException` for non-build implementations)\n- Add `DefaultBuildInvocation` record in `impl/maven-core` with a `from(MavenSession)` factory (double-checked locking in `DefaultSession`)\n- Deprecate `Session.getDegreeOfConcurrency()` in favour of `buildInvocation().threads()`\n- Update `ApiRunner.DefaultSession` and `SessionStub` with `@SuppressWarnings(\"deprecation\")` on retained `getDegreeOfConcurrency()` overrides" }, { "commit": "5ce3878485f0b82c31e7c2bd01afa84b0d2a77cd", "tree": "dfaba71a4bf1b2faac8aa4345ad574fb13e5b7d2", "parents": [ "58a9a901104b13a2a0aa6b4261096b4a19cea1be" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 22 12:12:55 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 12:12:55 2026 +0200" }, "message": "fix: replace #13146 TODO with resolution note (#13645)\n\nSame-id repository shadowing from external-model profiles is already\nmitigated by REQUEST_DOMINANT merging in the dependency resolution path.\nNo additional WARN/FAIL policy is needed.\n\nCo-authored-by: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "58a9a901104b13a2a0aa6b4261096b4a19cea1be", "tree": "5310f6999f93c9a83643cbea95dba1854ee75ac2", "parents": [ "81b24d3c3bf12d05ec804f48614078d2d1488da2" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 22 10:57:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 10:57:39 2026 +0200" }, "message": "Resolve multiModuleProjectDirectory lexically instead of canonically (fix #11167) (#13650)\n\ngetCanonicalFile() asks the OS to resolve the path, which can follow a\nsymlink, a junction, or (since JDK-8355342, on JDK 25+) a mapped\nWindows network drive to a different location, corrupting the reactor\nroot that every module/parent path is resolved against.\n\nRouted through the same getCanonicalPath(Path) helper this class\nalready uses elsewhere since #11250, which only normalizes the path\nlexically." }, { "commit": "81b24d3c3bf12d05ec804f48614078d2d1488da2", "tree": "95f05f1f9ebef2bf943dedf53d97725c2391a056", "parents": [ "9e7a17eb8b12336c51ad5e92fb450b521e052c80" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Thu Oct 22 09:09:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 09:09:56 2026 +0200" }, "message": "Use ubuntu-26.04 instead of ubuntu-latest (#13664)\n\n* Use ubuntu-26.04 instead of ubuntu-latest\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Install Graphviz neato layout plugin on Ubuntu 26.04\n\nGraphviz 14 on Ubuntu 26.04 ships layout engines as separate plugin\npackages; fdp used by ReactorGraph is in libgvplugin-neato-layout8.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "9e7a17eb8b12336c51ad5e92fb450b521e052c80", "tree": "0c8cef891eb3f860ec9e077d985710acad6964c9", "parents": [ "321a3db32c4414d52175f66bd6d8a9c5ed0648db" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Wed Oct 21 07:36:57 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 07:36:57 2026 +0200" }, "message": "Cascading profile activation (#1774)\n\nCascading profile activation allows a profile to set a property that immediately\ntriggers the activation of subsequent profiles within the same POM.\n\nImplementation:\n- DefaultProfileSelector now iterates profile activation in a loop until stable\n- Cascaded properties are stored in a separate map (DefaultProfileActivationContext)\n isolated from main model properties to avoid interference with settings profiles\n- Model properties (including cascaded ones) are only consulted for POM profile\n activation (Profile.SOURCE_POM), never for settings profiles — prevents cascaded\n properties from overriding Maven system properties that affect repository resolution\n- Property priority: user properties \u003e system properties \u003e model properties (POM only)\n- Cascaded properties are cleared after each activation round\n\nThe full IT suite (1034 tests) passes locally." }, { "commit": "321a3db32c4414d52175f66bd6d8a9c5ed0648db", "tree": "fbec33f544e3735f51f7d8941c58ba6a5951d152", "parents": [ "e5becaccf3548740af334553cef9e627a4eadedc" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 06:22:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 06:22:52 2026 +0200" }, "message": "build: bump org.ow2.asm:asm from 9.11 to 9.11.1 (#13659)\n\nBumps org.ow2.asm:asm from 9.11 to 9.11.1.\n\n---\nupdated-dependencies:\n- dependency-name: org.ow2.asm:asm\n dependency-version: 9.11.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e5becaccf3548740af334553cef9e627a4eadedc", "tree": "96c8f6ffa0ffa1b9c09f35ef5647a350a0e06a50", "parents": [ "4ad4d3cb8d9c6ca493a063dd89b9abe0c68ce503" ], "author": { "name": "HARSHA B", "email": "harshab1062006@gmail.com", "time": "Tue Oct 20 19:56:04 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 16:26:04 2026 +0200" }, "message": "Detect recursive configuration property references (#13643, fixes #13638)\n\nCyclic `configProps` references (e.g. `a\u003d${a}` or mutually referencing\n`a\u003d${b}, b\u003d${a}`) caused a `StackOverflowError` because `resolveVariable`\nreturned raw, uninterpolated values from `configProps` without passing\nthem through the cycle-detection machinery.\n\nFix: when a `configProps` lookup returns a value that itself contains\n`${...}`, pass it through `doSubstVars` with the existing `cycleMap`.\nThis hooks the recursive interpolation into the same cycle-detection path\nalready used for direct variable loops, turning infinite recursion into a\nclean `InterpolatorException`.\n\nNew tests in `DefaultInterpolatorTest`:\n- `testSelfReferencingConfigPropertyDifferentCurrentKey` — direct\n self-reference with a different current key\n- `testSelfReferencingConfigPropertyNullCurrentKey` — direct\n self-reference when `currentKey` is null\n- `testIndirectCycleConfigProperties` — indirect two-variable cycle\n (`a→b→a`)\n- `testValidChainedReferenceConfigProperties` — valid chained reference\n (`a→b→\"hello\"`) still resolves correctly\n\nFixes #13638" }, { "commit": "4ad4d3cb8d9c6ca493a063dd89b9abe0c68ce503", "tree": "442bab0bb433fec22afc440543ff5616f1891ccc", "parents": [ "92814f6f62f7eb2a6608802149e43d045c368730" ], "author": { "name": "CHARAN GOWDA M D", "email": "charangowdamd@gmail.com", "time": "Tue Oct 20 19:52:11 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 16:22:11 2026 +0200" }, "message": "deprecate XmlNode.merge(XmlNode, XmlNode, Boolean) in favor of XmlService.merge() (fix #13629) (#13634)\n\nDeprecate XmlNode.merge(XmlNode, XmlNode, Boolean) in favor of XmlService.merge() (#13629)\n\n`XmlNode.merge(XmlNode, XmlNode, Boolean)` and its implementation in\n`XmlNodeImpl` were left without a deprecation marker after `XmlService`\nbecame the canonical merge entry point. This creates confusion for\ncallers who don\u0027t know which API to prefer.\n\nChanges:\n- Add `@Deprecated(since \u003d \"4.0.0\", forRemoval \u003d true)` to\n `XmlNode.merge(XmlNode, XmlNode, Boolean)` with a Javadoc pointer to\n `XmlService#merge(XmlNode, XmlNode, Boolean)`.\n- Add the same annotation to `XmlNodeImpl.merge(XmlNode, XmlNode, Boolean)`.\n- Migrate the only in-tree caller (`MojoExtension.finalizeConfig`) to\n `XmlService.merge(...)`.\n- Add `XmlNodeImplTest.testDeprecatedMergeMethods()` which verifies via\n reflection that both deprecated methods carry the correct annotation\n attributes (`since \u003d \"4.0.0\"`, `forRemoval \u003d true`) and that calling\n the deprecated path produces results identical to `XmlService.merge()`.\n\nFixes #13629\n\nCo-authored-by: Charan Gowda \u003ccharangowdamd-cmd@users.noreply.github.com\u003e" }, { "commit": "92814f6f62f7eb2a6608802149e43d045c368730", "tree": "d1e75ac04233e0589ff5ec72bb33f5f8bf73a393", "parents": [ "4f33a500a21b1a754455b6f5fe497f1e3de30bb7" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 20 14:06:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 14:06:17 2026 +0200" }, "message": "fix: fail on misconfigured plugin-requested toolchains (#13606)\n\nPort of 3.10.x fix (commit 2ba1bbcd7c) to master.\n\nIn the compat v3-to-v4 factory bridge, MisconfiguredToolchainException was\nwrapped as a plain RuntimeException that escaped the impl\u0027s catch block\nfor ToolchainFactoryException. This could cause raw exception propagation\nwithout the contextual toolchain type info.\n\nFix: wrap MisconfiguredToolchainException as ToolchainFactoryException in\nthe v3-to-v4 bridge so the impl\u0027s createToolchain() catch block captures\nit and produces a proper ToolchainManagerException with the type info.\n\nThe pure v4 path (DefaultJavaToolchainFactory) already throws\nToolchainFactoryException which is properly caught and wrapped.\n\nCo-authored-by: Guillaume Nodet \u003cguillaume.nodet@gmail.com\u003e\nCo-authored-by: Václav Haisman \u003cvhaisman@gmail.com\u003e" }, { "commit": "4f33a500a21b1a754455b6f5fe497f1e3de30bb7", "tree": "e20acadab5e1a9ce775e68969d2155feae1b7bf9", "parents": [ "349d6370fbee645e54c5097d019cada0245aff81" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 20 10:06:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 10:06:58 2026 +0200" }, "message": "build: bump com.github.siom79.japicmp:japicmp-maven-plugin (#13640)\n\nBumps [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) from 0.26.3 to 0.26.5.\n- [Release notes](https://github.com/siom79/japicmp/releases)\n- [Changelog](https://github.com/siom79/japicmp/blob/master/release.py)\n- [Commits](https://github.com/siom79/japicmp/compare/japicmp-base-0.26.3...japicmp-base-0.26.5)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.siom79.japicmp:japicmp-maven-plugin\n dependency-version: 0.26.5\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "349d6370fbee645e54c5097d019cada0245aff81", "tree": "c8c35bfd359b39e1cbcfa9d1d2c501b42ac14225", "parents": [ "766e5ad89a38a2edc5c740e0b432ef1c6169de78" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 20 10:00:16 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 10:00:16 2026 +0200" }, "message": "Fix #11759: add maven.site.lifecycle.disabled system property to opt out of the site lifecycle (#13546)\n\nWhen set to true, the site lifecycle is excluded from the DefaultLifecycleRegistry\nstream, so Maven will not resolve or bind the maven-site-plugin unless it is\nexplicitly configured in the POM.\n\nThis is an opt-in system property (-Dmaven.site.lifecycle.disabled\u003dtrue) that\npreserves full backward compatibility.\n\nPort of #11970 (merged on maven-3.10.x) to master." }, { "commit": "766e5ad89a38a2edc5c740e0b432ef1c6169de78", "tree": "e3908f62ab755c366675f4c6bb7425fff71220b9", "parents": [ "63c33108afbb2ae57d41fbf2ee8d21f1e8b4c96f" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 23:48:11 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 23:48:11 2026 +0200" }, "message": "fix: ensure MavenProject#getPluginManagement never returns null\n\n- Return an empty PluginManagement instead of null when pluginManagement\n is absent from the effective model (e.g. after it was removed from\n the Super POM), preventing NullPointerExceptions in plugins that\n assume a non-null return value\n- Consistent with how getModelBuild() already ensures a non-null Build\n- Add MavenProjectTest#pluginManagementShouldReturnNotNull to verify\n the guarantee on a fresh MavenProject\n\nPort of 3.10.x fix (commit 835209b, author: Slawomir Jaranowski)\n\nCo-authored-by: Slawomir Jaranowski \u003cs.jaranowski@gmail.com\u003e" }, { "commit": "63c33108afbb2ae57d41fbf2ee8d21f1e8b4c96f", "tree": "330c20b6b92866cadf56d57cd05ff67b42475ab3", "parents": [ "cda9dc830021141423ff63ff3d9ffec158c02ef9" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 23:41:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 23:41:42 2026 +0200" }, "message": "fix: separate interpolation properties from model properties in activation context (#13556)\n\nFix a logical gap between two independent fixes that both landed on master today:\n\n- #10375 (`ce26838575`) — activate parent file profiles with the parent\u0027s properties,\n using `start(Map)` → `model.withProperties(parentProps)`\n- #13390 (`d3cc17bc22`) — stop POM properties from self-activating profiles in external builds\n\nThe problem: `start(Map)` still calls `model.withProperties(modelProperties)`, which means\n`getModelProperty()` returns the parent POM\u0027s own declared properties. This directly\ncontradicts the design intent of #13390: POM-declared properties must not drive profile\nactivation in external builds.\n\nThis commit (backported from #13545) reconciles both fixes:\n\n- Introduces a separate `interpolationProperties` field used **only** inside `interpolate()`\n for path placeholder resolution (e.g. `${message.file}` in file-condition profiles)\n- `start(Map)` no longer calls `model.withProperties(...)` — the model\u0027s own properties\n remain unchanged, so `getModelProperty()` stays clean\n- A parent POM\u0027s declared properties can now be used to resolve path placeholders in its\n file-based profiles without being able to self-activate its property-based or\n condition-based profiles\n\nThe Javadoc on both the field and `start(Map)` explains the #10375/#13390 relationship.\n\nBackport: #13545" }, { "commit": "cda9dc830021141423ff63ff3d9ffec158c02ef9", "tree": "5054c4edfd0a002f623f771786d000590ad8d3d0", "parents": [ "a99adeb2b234ffd3ac56850fb802a03bdb4f6bcb" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 22:35:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 22:35:00 2026 +0200" }, "message": "Deprecate project.baseUri in favor of project.basedir.uri (#2184, fixes #9801)" }, { "commit": "a99adeb2b234ffd3ac56850fb802a03bdb4f6bcb", "tree": "9f70c0c24c628387ed3ac35b187167bbd48368f6", "parents": [ "a6682711d118d1d62f590a34202332c4aff7d9db" ], "author": { "name": "Romain Manni-Bucau", "email": "rmannibucau@gmail.com", "time": "Mon Oct 19 21:30:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 21:30:00 2026 +0200" }, "message": "fix: add central to each empty repository list independently in settings (#13581)\n\nThe backward-compat guard in DefaultSettingsBuilder used \u0026\u0026 to check\nwhether both repositories and pluginRepositories were empty before\nadding central. This meant that settings defining \u003crepositories\u003e but\nnot \u003cpluginRepositories\u003e (or vice versa) would leave one list without\ncentral. In Resolver 1.x this was harmless because cached artifacts\nwere served without origin verification, but Resolver 2.x rejects\ncached artifacts whose origin repository is absent from the resolution\ncontext — causing plugin resolution failures in pom-less builds and\nany configuration where only one list was populated.\n\nChange the condition to || and add central to each list independently.\n\nFixes #13384" }, { "commit": "a6682711d118d1d62f590a34202332c4aff7d9db", "tree": "dc4b7179c44a3eee768f6687a0e9f8a00dd6c4d5", "parents": [ "267e65f4aa8dbce0fdb472cb7d11946010cf0b11" ], "author": { "name": "HARSHA B", "email": "harshab1062006@gmail.com", "time": "Mon Oct 19 22:16:20 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:46:20 2026 +0200" }, "message": "feat: add Packaging.producesMainArtifact() and delegate artifact production to Project\n\n- Add Packaging.producesMainArtifact() as a pure type-level check (determines whether a packaging type produces a main artifact, e.g. jar/war, vs not, e.g. pom)\n- Move module source hierarchy logic from Packaging into DefaultProject.producesMainArtifact() to avoid leaking project-level mutable state into the @Immutable Packaging type\n- Remove DelegatingPackaging wrapper; DefaultProject.packaging() now returns a stable field, restoring the @Immutable contract\n- Narrow catch (Exception e) to catch (IllegalArgumentException | LookupException e) with LOGGER.debug() to avoid swallowing programming errors\n- Remove dead pkg !\u003d null guard in ReactorReader.producesMainArtifact() since requirePackaging() is @Nonnull and throws on failure\n- Add test coverage in ReactorReaderTest, DefaultPackagingRegistryTest, DefaultProjectManagerTest" }, { "commit": "267e65f4aa8dbce0fdb472cb7d11946010cf0b11", "tree": "acd39b1c02ab0b890bbde732400b9c4d9ea12f4a", "parents": [ "d7c77db99d1891558526da46a4c277c6e00542ab" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 18:13:31 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:13:31 2026 +0200" }, "message": "Fix #10375/#13390: use separate interpolationProperties for parent path interpolation (#13555)\n\nThe start(Map\u003cString,String\u003e) method previously passed the parent\u0027s\nproperties via model.withProperties(), which made them accessible through\ngetModelProperty() and thus able to self-activate property-based and\ncondition-based profiles — exactly the regression that #13390 aimed to fix.\n\nIntroduce a dedicated interpolationProperties field that is checked only\ninside interpolate(), before the model\u0027s own properties. This lets parent\nfile profiles resolve path placeholders (e.g. ${message.file}) correctly\n(#10375) without exposing those properties to ProfileActivationContext\ncallers that drive profile activation (#13390).\n\nBackported from PR #13545 (maven-4.0.x)." }, { "commit": "d7c77db99d1891558526da46a4c277c6e00542ab", "tree": "73aac2282ee08e2fc36c7d2125a9a1a098adb0ae", "parents": [ "c9f777d62177db4135fc8817d3c9c33488b2eed6" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 18:10:44 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 18:10:44 2026 +0200" }, "message": "fix: use maven-plugin-plugin to generate @After descriptor in MNG-12534 IT\n\n- Replace handcrafted V2 plugin descriptor (plugin.xml), DI factory class\n (TouchMojoFactory.java), and service file with maven-plugin packaging\n so maven-plugin-plugin generates the descriptor from @After annotations\n- Converts MNG-12534 IT from testing runtime parsing of handcrafted\n descriptors to testing the full chain end-to-end: annotation scanning\n → descriptor generation → DAG edge creation\n- Uses maven-plugin-plugin 4.0.0-beta-3 which supports @After scanning\n (merged into maven-plugin-tools on 2026-09-06)\n- Fix resource-filtering conflict: use resources-filtered/pom.xml with\n maven-plugin-plugin enabled, remove duplicate non-filtered pom.xml" }, { "commit": "c9f777d62177db4135fc8817d3c9c33488b2eed6", "tree": "afdfec11b13197e0a13d83cfb4179080e92ab31e", "parents": [ "61afec0d10d040961b1ae453a0ecf430c30cbeb9" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 17:03:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 17:03:29 2026 +0200" }, "message": "fix: repair jvm.config LF-only handling on Windows (mvn.cmd retry and test isolation) (#13587)\n\nThe \u0027if not defined JVM_CONFIG_MAVEN_OPTS\u0027 guard in mvn.cmd never triggered the\nWindows-Defender retry because the variable is initialized to an empty string\n(\u0027SET JVM_CONFIG_MAVEN_OPTS\u003d\u0027) earlier in the script. In cmd.exe an empty-string\nassignment counts as *defined*, so \u0027if not defined\u0027 evaluates to false even when\nset /p read nothing. The guard should compare against the empty string instead:\n\n if \"%JVM_CONFIG_MAVEN_OPTS%\"\u003d\u003d\"\" (retry…)\n\nThis caused jvm.config options to be silently dropped when JvmConfigParser wrote\nits output file but set /p had not yet received the data (e.g. because Windows\nDefender briefly held a file-read lock). After commit b28f385ca5 precompiled\nJvmConfigParser the startup latency dropped from ~450 ms (source-launch JVM) to\n~30 ms, making the race window far more likely to be hit.\n\nAlso isolate the MNG-6255 IT variants so each line-ending test (lf, crlf, cr)\nwrites its jvm.config into its own project copy (\u0027mng-6255-lf/\u0027, \u0027mng-6255-crlf/\u0027\netc.) instead of sharing a single directory. Sharing the same directory means a\nsequential test run can see a leftover jvm.config written by the previous variant,\nand any future parallelisation would introduce a real race." }, { "commit": "61afec0d10d040961b1ae453a0ecf430c30cbeb9", "tree": "54eb5f1c17acf78a618990c8d1ed2aae0d5b4d16", "parents": [ "a9841632cf5f221bbc040ff67e2d19dd11ecf106" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 16:57:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 16:57:30 2026 +0200" }, "message": "feat: Resolver 2.x update policy control via CLI\n\n- Add --UA / --update-artifacts and --UM / --update-metadata CLI flags to force artifact/metadata updates (always policy)\n- Add --artifacts-update-policy and --metadata-update-policy options for fine-grained update control; supported values: always, daily, interval:N, never, and explicit (new, updates only if not already cached)\n- Warn when new-style policies are mixed with legacy -U / -nsu flags\n- New MavenExecutionRequest.setArtifactsUpdatePolicy() / setMetadataUpdatePolicy() API; DefaultRepositorySystemSessionFactory dispatches to new policies when set, falling back to existing -U / -nsu behavior\n- Fix jvm.config LF-only handling on Windows (mvn.cmd retry logic)\n- Port of #11948 to master" }, { "commit": "a9841632cf5f221bbc040ff67e2d19dd11ecf106", "tree": "cfb16061209120f864ba99a7756e04729d97ad70", "parents": [ "969f535c5f97983429d74ab69bfc4f68f8d5d53d" ], "author": { "name": "Sebastian Tiemann", "email": "setie@mailbox.org", "time": "Mon Oct 19 16:53:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 16:53:26 2026 +0200" }, "message": "fix #13521: restore phase config merging for null input\n\n- Remove the null guard introduced in DefaultLifecycleExecutionPlanCalculator that broke merging of phase plugin configurations when the input is null; the merge method is null-safe and the guard caused regressions in Surefire ITs\n- Add integration test covering the null-configuration merge path to prevent regression" }, { "commit": "969f535c5f97983429d74ab69bfc4f68f8d5d53d", "tree": "c15a6bff47e55dad6f4b9433f57671a0a81b5019", "parents": [ "efe9af765923f8f0d57d76986407fa2b473c6b58" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Mon Oct 19 16:42:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 16:42:14 2026 +0200" }, "message": "Keep the progress number of a project that is built again (fix #10291) (#13577)\n\nAn aggregator goal on the command line builds a project once more after the reactor, and the progress counter took it for one more project, so that the output went past the total, as in [13/12]. A project built again now shows the number it was given the first time." }, { "commit": "efe9af765923f8f0d57d76986407fa2b473c6b58", "tree": "1b8fab470161d5e12e29a6bccf86d9f18f6b71a3", "parents": [ "8f633f5bbb9d479750334199ee8f34f8667aa7a8" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Mon Oct 19 12:39:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 12:39:18 2026 +0200" }, "message": "fix: settings interpolation for non-String fields and strict parsing mode\n\n- Raw XML interpolation before parsing: non-String settings fields\n (e.g. proxy.port as int, proxy.active as boolean) containing\n ${...} property placeholders now resolve correctly instead of\n failing to parse or silently using default values\n- XML-escape interpolated values before re-parsing to prevent parse\n errors when property values contain XML-special characters (MNG-4625)\n- Strict parsing mode: settings XML parse errors are now reported at\n ERROR level with fail-fast behaviour when strict parsing is enabled\n via the MAVEN_SETTINGS_STRICT_PARSING constant\n- Tests: proxy interpolation with integer/boolean fields, strict\n parsing failure test, stream-close behaviour coverage" }, { "commit": "8f633f5bbb9d479750334199ee8f34f8667aa7a8", "tree": "87c08c098e337f4875ac33e5a2a8499d08e69136", "parents": [ "a916bb83b32d207b3ffcc4bce5309039b8100425" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 11:32:34 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 11:32:34 2026 +0200" }, "message": "build: bump actions/setup-java from 6.0.1 to 6.1.0 (#13618)\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 6.0.1 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: 6.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a916bb83b32d207b3ffcc4bce5309039b8100425", "tree": "93523ada8ff0112fc9217f8c9d3bb7611814b09c", "parents": [ "20a9c73ba1eb9b4a461376d577d04dd8fe03bb49" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 11:32:28 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 11:32:28 2026 +0200" }, "message": "build: bump net.bytebuddy:byte-buddy from 1.18.14 to 1.18.15 (#13619)\n\nBumps [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) from 1.18.14 to 1.18.15.\n- [Release notes](https://github.com/raphw/byte-buddy/releases)\n- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)\n- [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.14...byte-buddy-1.18.15)\n\n---\nupdated-dependencies:\n- dependency-name: net.bytebuddy:byte-buddy\n dependency-version: 1.18.15\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "20a9c73ba1eb9b4a461376d577d04dd8fe03bb49", "tree": "04cceab090e0d2dfc36c7025edc78c605da19ffc", "parents": [ "fe6481feefeb1e7d51c4ace5636e8c1ea26daf84" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Wed Oct 14 13:46:21 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Sun Oct 18 13:06:26 2026 +0200" }, "message": "Read the + prefix of -P and -pl tokens after trimming\n\nThe - and ! checks read the trimmed token but the + check read the raw one, so in\n-P \"a, +b\" the profile was taken as \"+b\", and \" +?e\" lost its optional marker.\n" }, { "commit": "fe6481feefeb1e7d51c4ace5636e8c1ea26daf84", "tree": "c5f7a30cc4646771cac693fffc3e25933ff85328", "parents": [ "889ccadfa9c7d519b57735ffb814bd401f979c44" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 18 11:22:06 2026 +0200" }, "committer": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sun Oct 18 12:22:40 2026 +0200" }, "message": "Use push for PR Automation\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "889ccadfa9c7d519b57735ffb814bd401f979c44", "tree": "9996cf30efd0285a554f1d1105b503cde4eed937", "parents": [ "954d8fcbdf8495acfaf6e3194476e085c1ee4278" ], "author": { "name": "Slawomir Jaranowski", "email": "s.jaranowski@gmail.com", "time": "Sat Oct 17 08:53:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 08:53:32 2026 +0200" }, "message": "Use workflow_run for PR check (#13586)\n\n* Use workflow_run for PR check\n\nPR check runs on workflow_run after PR Signal instead of\npull_request_target. PR Signal no longer reacts to closed and\nsynchronize, and the test PR Signal Consumer is removed.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Restore synchronize in PR Signal\n\nPR check reports a commit status on the PR head, so it has to run\nagain for every new head commit.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n* Rename the PR check workflow to PR Check\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "954d8fcbdf8495acfaf6e3194476e085c1ee4278", "tree": "394d19c92b9f5872d7658a34232508af84ffe4ad", "parents": [ "50d17ebe4a6d97579e7bb29c7fd9c867f75ad275" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Fri Oct 16 19:25:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 19:25:43 2026 +0200" }, "message": "Revert \"fix: project-extension visibility for Packaging, Type, and Lifecycle registries\" (#13574)\n\nThis reverts commit 9bd2e535274fa1c313bfc4489076771f69084e5a." }, { "commit": "50d17ebe4a6d97579e7bb29c7fd9c867f75ad275", "tree": "67b0cb0f7cf5dbdb8c835881aa170b48f7e25cc3", "parents": [ "14568289f15bf79edf58ff0d7bcfa65d2daa9965" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Fri Oct 16 10:59:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 10:59:54 2026 +0200" }, "message": "Report an invalid parent of an attached artifact instead of a NullPointerException (fix #8393)\n\nAttachedArtifact.getVersion() returned the version of the parent, but the superclass constructor validates its arguments before the parent is set. When the validation failed, building the error message called getVersion() on a null parent and a NullPointerException hid the real error. Fall back to the version of the superclass until the parent is set.\n\nFixes #8393" }, { "commit": "14568289f15bf79edf58ff0d7bcfa65d2daa9965", "tree": "41cd55927a9254b552cbb8135b165052ae8892c3", "parents": [ "2b2e88f005fccbc03163eaa5a6c015cd996a47fa" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Fri Oct 16 10:48:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 10:48:53 2026 +0200" }, "message": "fix: address review nits in BuildPlan merge method (#13548)\n\n- Fix comment to only mention $plan$ (the only key actually checked)\n- Filter skipped steps in fallback frontier to stay consistent with\n the primary frontier computation\n\nFollow-up to #13532\n\nCo-authored-by: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e" }, { "commit": "2b2e88f005fccbc03163eaa5a6c015cd996a47fa", "tree": "93a92cf42a86c1e6dfa24d712c7d274a0f31983a", "parents": [ "215988f2f70a7d5e4b82265752f48ea8baead9f5" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Fri Oct 16 10:48:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 10:48:20 2026 +0200" }, "message": "test: port profile.pom.condition assertion from backport PR #13544 (#13552)\n\nThe assertion was inadvertently dropped when the test was updated on master.\nThe backport PR restores it with an updated comment explaining why\ndoReadAsParentModel() now activates POM-property-based conditions.\n\nPorts test change from #13544." }, { "commit": "215988f2f70a7d5e4b82265752f48ea8baead9f5", "tree": "85ce3d9d29c573384a55e42c7c5eb437db59151e", "parents": [ "bea3243aaebeafabc1030a4acd21ad4946ecb178" ], "author": { "name": "Sharang Gupta", "email": "sharang@sharanggupta.dev", "time": "Thu Oct 15 22:12:13 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 23:12:13 2026 +0200" }, "message": "Document the session-only PluginParameterExpressionEvaluator constructor (#13498)\n\n* Fix NPE in PluginParameterExpressionEvaluator without a MojoExecution\n\nPluginParameterExpressionEvaluator can be created with a MavenSession\nonly, but evaluate() dereferenced the MojoExecution for every\nexpression, so such an evaluator failed with a NullPointerException\neven for ${project} or ${session}.\n\nThe mojo descriptor is now looked up only if there is a mojo execution,\nand the expressions about the plugin evaluate to null without one, as\nthe expressions about the mojo already did through\nReflectionValueExtractor.\n\nFixes #8052 (MNG-6982)\n\n* Keep only the constructor documentation on top of the fix in master\n\n#8052 is fixed on master by dd815500df, which also adds\ntestEvaluationWithoutMojoExecution and a test for the mojo and plugin\nexpressions. Remove the test of the same name added here, which no\nlonger compiles next to it, and the null check that the fix in master\nmakes unreachable, so that only the documentation of the session-only\nconstructor remains.\n\n---------\n\nCo-authored-by: Guillaume Nodet \u003cgnodet@gmail.com\u003e" }, { "commit": "bea3243aaebeafabc1030a4acd21ad4946ecb178", "tree": "72a857d6da4855a2ccf97deafeb1cdafe7ad9d52", "parents": [ "6acd660b8749fe2d30e1630e78456bea17ec8eb6" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 15 23:10:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 23:10:03 2026 +0200" }, "message": "Fix DefaultArtifactManager.getPath() to honor explicitly-set paths over project artifact file (#13543)\n\nCheck the `paths` map first in `getPath()`: any path explicitly registered via `setPath()` takes precedence over `project.getArtifact().getFile()`.\n\nPreviously, the project artifact loop ran before checking the `paths` map, causing `install:install` (which calls `setPath(pomArtifact, pomPath)` then `getPath(pomArtifact)`) to return the JAR file instead of the registered POM path when `jar:jar` was run on a pom-packaged project.\n\n- Check the `paths` map first before the project artifact loop in `DefaultArtifactManager.getPath()`\n- Unit test added: `DefaultArtifactManagerTest.setPathTakesPrecedenceOverProjectArtifactFile()`\n- Integration test in maven-install-plugin: MINSTALL-315\n\nFixes MINSTALL-315.\n\n(cherry picked from commit cf37a2029387e88ffe676d6d4639ae5a116d5406)" }, { "commit": "6acd660b8749fe2d30e1630e78456bea17ec8eb6", "tree": "668167c2a8e4d10254428cb63216582ffd2eee92", "parents": [ "9bd2e535274fa1c313bfc4489076771f69084e5a" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 15 23:00:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 23:00:15 2026 +0200" }, "message": "fix: honour quotes in MAVEN_ARGS in bin/mvn (fix #13413)\n\n- Quote MAVEN_ARGS when passing it to the JVM so the shell preserves quoted values and does not split on spaces\n- Fixes broken builds in workspaces with spaces in the path (e.g. Jenkins Pipeline Maven Plugin passing --settings or -Dmaven.repo.local)\n- One side effect: shell glob expansion of unquoted patterns like * in MAVEN_ARGS is no longer performed, which is the correct behavior\n- Add integration test test-mvn-args.sh (shell-script-tests profile) covering quoted values, mixed/empty words, tabs, newlines, backslash, no globbing, sub-commands, debug log — 13 of 25 assertions fail on the previous script\n- Integration test runs Maven launcher directly to validate -Dmaven.repo.local with a spaced path" }, { "commit": "9bd2e535274fa1c313bfc4489076771f69084e5a", "tree": "31b26dcc1c87184bb0732e9a9fcbb6e537162213", "parents": [ "d3cc17bc22c1d98b20200f4e6622b9e192e16e6c" ], "author": { "name": "Goutam Adwant", "email": "8672451+goutamadwant@users.noreply.github.com", "time": "Thu Oct 15 11:18:35 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 20:18:35 2026 +0200" }, "message": "fix: project-extension visibility for Packaging, Type, and Lifecycle registries\n\n- DefaultExtensibleEnumRegistry: new Lookup-aware constructor; on each\n lookup() call, queries Lookup.lookupList(providerType) first so SISU\n applies project-scope filtering before falling back to statically\n registered values\n- DefaultPackagingRegistry: delegates dynamic lookup to super via\n PackagingProvider.class; retains legacy LifecycleMapping as last resort\n- DefaultTypeRegistry: queries TypeProvider list uncached before the\n ArtifactHandler fallback cache, preventing type leaks across reactor\n projects\n- DefaultLifecycleRegistry: Lookup-aware constructor; stream() merges\n injected and dynamically discovered lifecycles, deduplicating by id\n with dynamic providers taking priority\n- Tests: DefaultExtensibleEnumRegistryTest (builtins, dynamic lookup,\n priority, no-leak-across-projects), DefaultPackagingRegistryTest,\n DefaultTypeRegistryTest, and MavenITgh13306PackagingProviderTest IT\n that builds a real extension contributing app-client packaging and\n verifies isolation across reactor projects\n\nFixes: #13306" }, { "commit": "d3cc17bc22c1d98b20200f4e6622b9e192e16e6c", "tree": "e3eb2e1d6fc30f23b3aefb995d6940a577cc02d0", "parents": [ "f5778f50800cba5bcbf82a6b3495f472a6fa5dc8" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 15 14:18:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 14:18:24 2026 +0200" }, "message": "Fix #13390: stop POM properties from self-activating profiles in external builds\n\n- Remove POM-property merge from the external-model activation sandbox in DefaultModelBuilder\n and DefaultProfileActivationContext (both compat and impl stacks); only system properties\n and negated-property checks drive profile activation, restoring 3.9.x semantics\n- PropertyProfileActivator: update comments to reflect new semantics\n- ProfileActivationContext: update Javadoc on model/project properties\n- Add jruby-style regression test (MNG-13390) and resteasy-style non-regression test (MNG-13084)" }, { "commit": "f5778f50800cba5bcbf82a6b3495f472a6fa5dc8", "tree": "6416d619d192ec0221cfd00c92fd04d8e8ed6066", "parents": [ "1e32f12f5f5885bca306922686703ace9af5e2d9" ], "author": { "name": "Ivan Khanas", "email": "xeno@altlinux.org", "time": "Thu Oct 15 14:13:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 14:13:59 2026 +0200" }, "message": "fix: prefer default bindings for unqualified lookups in standalone injector\n\nFixes #13469.\n\nWhen ApiRunner requests an unqualified Session, the standalone injector could return a named provider (e.g. mvnup\u0027s) instead of the default one when both have equal priority, causing ApiRunner to lose the requested local repository.\n\n- Injector now prefers default binding when priorities tie on an unqualified lookup\n- Equal default bindings produce an ambiguity error (rather than arbitrary selection)\n- Distinct named providers remain available through List\u003cT\u003e and Map\u003cString, T\u003e injection\n- Repeat registrations of the same provider are collapsed\n- Added tests: InjectorImplTest, BindingSelectionTest, ApiRunnerSettingsTest" }, { "commit": "1e32f12f5f5885bca306922686703ace9af5e2d9", "tree": "520e6159d2969eb5f2c238c81df664a9c41cec88", "parents": [ "0942fa837a9e1ab55222e6d7c18f075673cd8b80" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Thu Oct 15 14:09:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 14:09:40 2026 +0200" }, "message": "fix: concurrent builder drops later lifecycle phases when merging overlapping task segments\n\n- Unskip the surviving step when the merged-in step is active in\n BuildPlan.merge(BuildStep), so plan() can bind mojos via addMojo()\n- Insert non-lifecycle steps at the \"active frontier\" instead of after\n after:ALL, ensuring correct ordering (package → javadoc → install)\n- Check both directions before adding ordering edges in\n BuildStep.executeAfter() to prevent cycles\n- Disable advanced merge logic for computeForkPlan merges (detected by\n \"$plan$\" in the add map) to avoid dangling fork step references\n\nFixes #13529" }, { "commit": "0942fa837a9e1ab55222e6d7c18f075673cd8b80", "tree": "7c0b0c04c01b045c2602da1a202c0f786a3cd858", "parents": [ "e0a0248519c54c8293cdeaa43bb4c5d40b61f8bb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 11:52:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 11:52:52 2026 +0200" }, "message": "build: bump org.codehaus.mojo:versions-maven-plugin (#13533)\n\nBumps [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) from 2.22.0 to 2.23.0.\n- [Release notes](https://github.com/mojohaus/versions/releases)\n- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)\n- [Commits](https://github.com/mojohaus/versions/compare/2.22.0...2.23.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.mojo:versions-maven-plugin\n dependency-version: 2.23.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "e0a0248519c54c8293cdeaa43bb4c5d40b61f8bb", "tree": "36d69ac54227bcb7e216d6c66e850e920505c6aa", "parents": [ "7d902a49eb2386b312bbb393028373ef5f418b2f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 15 11:52:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 11:52:43 2026 +0200" }, "message": "build: bump jlineVersion from 4.4.7 to 4.4.8 (#13535)\n\nBumps `jlineVersion` from 4.4.7 to 4.4.8.\n\nUpdates `org.jline:jline-reader` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-style` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-builtins` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-console` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-console-ui` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-terminal` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-terminal-ffm` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-terminal-jni` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jline-native` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\nUpdates `org.jline:jansi-core` from 4.4.7 to 4.4.8\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline-reader\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-style\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-builtins\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-console\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-console-ui\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-terminal\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-terminal-ffm\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-terminal-jni\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jline-native\n dependency-version: 4.4.8\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: org.jline:jansi-core\n dependency-version: 4.4.8\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "7d902a49eb2386b312bbb393028373ef5f418b2f", "tree": "2e5c1a666db6050eff4af22a5a9f070787eaf0c3", "parents": [ "fdd7fd62ea1c732ca3cbd090e03e94f7a359947b" ], "author": { "name": "TARUN N", "email": "tn2848236@gmail.com", "time": "Thu Oct 15 13:19:29 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 09:49:29 2026 +0200" }, "message": "Refactor: use instanceof pattern matching in ListItem#normalize and add regression test for hyphenated zeros" }, { "commit": "fdd7fd62ea1c732ca3cbd090e03e94f7a359947b", "tree": "783f28e6ca6e6869a110a98486be3e651d384141", "parents": [ "ce26838575407bc4a784dee58ebb5d65bcf639f2" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Thu Oct 15 09:27:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 09:27:46 2026 +0200" }, "message": "[MNG-8250] Invoke ModelParser#parse when a parser locates the project directory\n\n- DefaultModelProcessor#read was searching the parent of the located path for a model\n- When a ModelParser returns the project directory itself as its source (as locateExistingPom allows), the processor was asking parsers to locate in the directory above, so parse was never called and the XML reader failed with \"Is a directory\"\n- Fix: use the path itself when it is a directory\n- Regression test added to DefaultModelProcessorTest" }, { "commit": "ce26838575407bc4a784dee58ebb5d65bcf639f2", "tree": "ce5df0161dd17495f4de4c479892dd17b44e2c3f", "parents": [ "ba6049869ac6b450814e23e20dd570ec0634726e" ], "author": { "name": "Mathias Nicolajsen Kjærgaard", "email": "mnk@mnk.dk", "time": "Thu Oct 15 09:15:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 09:15:50 2026 +0200" }, "message": "Fix #10375: activate parent file profiles with the parent\u0027s properties\n\nWhen reading a parent for a child, ParentModelFrame activated the parent\u0027s profiles against a context derived from the child\u0027s pre-inheritance model. That model has the right basedir for per-module file checks but lacks the parent\u0027s properties, so property placeholders (e.g. ${message.file}) did not interpolate and the profile stayed inactive.\n\n- Activate parent profiles in a fresh recording context (new DefaultProfileActivationContext.start(Map)) whose model properties are those of the assembled parent, keeping the child\u0027s basedir, packaging and artifactId\n- The recording context also serves as the parent-model cache key, so it is not mutated in place with setModel(parent) to avoid stale cache hits across grandparent records\n- Add a new replayRecordIntoContext overload that replays the activation record without model properties, so parent-derived values don\u0027t pollute child lookups\n- Add DefaultModelBuilderTest case and core IT MavenITmng8710\n\nFixes https://github.com/apache/maven/issues/10375 (MNG-8710)" }, { "commit": "ba6049869ac6b450814e23e20dd570ec0634726e", "tree": "6bb69db6e5c6eae7be6969e5290cb62d80d03f60", "parents": [ "d3c5617d6e2c7795896a79875273b93c14d3e670" ], "author": { "name": "Yashi Singhal", "email": "yashi.singhal410@gmail.com", "time": "Thu Oct 15 03:09:36 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 23:39:36 2026 +0200" }, "message": "Fix #13405: Do not capture JVM stderr notices into jvm.config options\n\n- Separate stdout from stderr in bin/mvn when executing JvmConfigParser.java\n- Redirect stderr to a temporary file; display it only on non-zero exit to avoid polluting MAVEN_OPTS with JVM tool notices (JAVA_TOOL_OPTIONS, JDK_JAVA_OPTIONS, _JAVA_OPTIONS)\n- Add test-mvn-jvm-config.sh to verify JVM notices do not pollute JVM arguments and parser errors are still reported\n- Register the test script in the shell-script-tests profile in apache-maven/pom.xml" }, { "commit": "d3c5617d6e2c7795896a79875273b93c14d3e670", "tree": "3881fb4753c56777b5a745c85e69024852df382b", "parents": [ "174be4650bab6049dc622dd0f7fa1b70621b76f5" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 23:36:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 23:36:07 2026 +0200" }, "message": "build: bump org.codehaus.woodstox:stax2-api from 4.3.1 to 4.3.2 (#13509)\n\nBumps [org.codehaus.woodstox:stax2-api](https://github.com/FasterXML/stax2-api) from 4.3.1 to 4.3.2.\n- [Commits](https://github.com/FasterXML/stax2-api/compare/stax2-api-4.3.1...stax2-api-4.3.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.woodstox:stax2-api\n dependency-version: 4.3.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "174be4650bab6049dc622dd0f7fa1b70621b76f5", "tree": "bf692136a20d482b26b4dc08c2f1f8fcdeecee15", "parents": [ "dd815500df5fd8e73b70e2a6f4e4a5e4d0375bf1" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 23:35:49 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 23:35:49 2026 +0200" }, "message": "build: bump org.ow2.asm:asm from 9.10.1 to 9.11 (#13508)\n\nBumps org.ow2.asm:asm from 9.10.1 to 9.11.\n\n---\nupdated-dependencies:\n- dependency-name: org.ow2.asm:asm\n dependency-version: \u00279.11\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "dd815500df5fd8e73b70e2a6f4e4a5e4d0375bf1", "tree": "87c71f2deea7f117199e86a27a6e635a6a1394b4", "parents": [ "7d6b608964b6aaa1fe8afe37078e1cafffac4e8e" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Wed Oct 14 23:32:21 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 23:32:21 2026 +0200" }, "message": "fix: Evaluate expressions without a mojo execution (fix #8052)\n\n- `PluginParameterExpressionEvaluator(MavenSession)` failed with NullPointerException when evaluate() was called without a MojoExecution, because every expression attempted mojoExecution.getMojoDescriptor()\n- Fix: guard the mojo descriptor read behind a null-check on the mojo execution; `mojo.*` and `plugin.*` expressions now correctly return null/empty when no execution is present\n- All other expressions (`session`, `project`, `basedir`, user/system/project properties, nested expressions) are evaluated as before\n- Two new tests in PluginParameterExpressionEvaluatorTest cover the no-execution constructor: one for expressions independent of mojo execution, one for mojo/plugin expressions" }, { "commit": "7d6b608964b6aaa1fe8afe37078e1cafffac4e8e", "tree": "21f53daad7c7a67e6a971120396bda9b27dca103", "parents": [ "7f2bc3a809d28c9f97b1ee31be8331cb75c4b74a" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Wed Oct 14 21:43:28 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 21:43:28 2026 +0200" }, "message": "Introduce TempFileService and lifecycle cleanup participant\n\n- Add TempFileService: experimental API to create temporary files/directories tracked per session\n- Add Constants.MAVEN_TEMPFILE_KEEP for the maven.tempfile.keep system property (with @Config, @since 4.1.0)\n- Add DefaultTempFileService: implementation via SessionData + ConcurrentHashMap-backed set; recursive deletion with Files.walkFileTree; best-effort cleanup (failures logged, don\u0027t block other deletions)\n- Add TempFileCleanupParticipant: AbstractMavenLifecycleParticipant that calls cleanup() at afterSessionEnd\n- Add DefaultTempFileServiceTest: unit tests for creation, recursive deletion, register, keep-property bypass, lifecycle participant delegation, and exception swallowing" }, { "commit": "7f2bc3a809d28c9f97b1ee31be8331cb75c4b74a", "tree": "2eb79bdcaf7f4892fafac8781eda0461b97c62ff", "parents": [ "622904a844ec0e40c01dd2bf89b8cad533b0fa8e" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Wed Oct 14 18:18:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 18:18:40 2026 +0200" }, "message": "Treat all loopback hosts as local for external mirror rules (fix #8320) (#13496)\n\nexternal:* and external:http:* only treated localhost and 127.0.0.1 as local. Other addresses of the 127.0.0.0/8 range and IPv6 loopback addresses were considered external, and a bracketed IPv6 host was not even parsed. Recognise both, without resolving any name, in the v3 bridge and in the compat mirror selector.\n\nFixes #8320" }, { "commit": "622904a844ec0e40c01dd2bf89b8cad533b0fa8e", "tree": "cf9b343fc124fe73ac11409e847abf35ebf9a77f", "parents": [ "7df9ecaf068b59816a8f510667c8e3225710ff58" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Wed Oct 14 16:27:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 16:27:58 2026 +0200" }, "message": "improve: improve reactor BOM import warning with coordinates and actual risk\n\n- Add BOM coordinates (g:a:v) to the warning so the user knows which import is affected\n- Explain the actual risk: BOM is evaluated in CONSUMER_DEPENDENCY mode, which skips conditional profile activation (file/property/condition), potentially producing an incomplete dependencyManagement compared to the BOM\u0027s own build\n- Suggest parent POM inheritance as the preferred alternative\n- Mention that downstream consumers of the BOM may be affected as well" }, { "commit": "7df9ecaf068b59816a8f510667c8e3225710ff58", "tree": "e0b408e76036809eb9927144f567eeb99b968db5", "parents": [ "63d89a6bf9d06c12409b0e6d894bfa0e7571af91" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Wed Oct 14 16:09:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 16:09:26 2026 +0200" }, "message": "Clarify that Maven does not maintain distributionManagement/status (fix #13349) (#13444)\n\nThe description suggested that the field is updated as part of the build\nlifecycle. Maven only copies an existing value when merging models and\nthe validator rejects it in a project POM, so state that Maven itself\nnever sets it and that it is meant for repository tooling.\n\nCo-authored-by: Guillaume Nodet \u003cgnodet@apache.org\u003e" }, { "commit": "63d89a6bf9d06c12409b0e6d894bfa0e7571af91", "tree": "2297864f9fa04ecab97c2844792c79b8413b8380", "parents": [ "f4ddd1829d4aaac468db9e643796614da9a1b55b" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Wed Oct 14 16:08:15 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 16:08:15 2026 +0200" }, "message": "Expose resolution metadata through Node (#13485)\n\nAdd winner(), premanagedVersion(), premanagedScope() and originalScope() to Node, backed by the data the Resolver already keeps on the dependency node. The values are only present when the graph was collected in verbose mode, and filtered nodes keep them.\n\nAddresses #13151\n\nCo-authored-by: Guillaume Nodet \u003cgnodet@gmail.com\u003e" }, { "commit": "f4ddd1829d4aaac468db9e643796614da9a1b55b", "tree": "1c2db0528cfdc2c6a65f5a17da55a493ec490efa", "parents": [ "b245782f09cc3d132703127d3cb632699030cd15" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Wed Oct 14 14:51:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 14:51:59 2026 +0200" }, "message": "fix: print usage when no goals and no POM are specified, improve -f error messages\n\n- Print usage (same output as `mvn -h`) and exit 0 when `mvn` is invoked with no arguments and no POM is found; avoids confusing BUILD FAILURE for new users\n- Clean up -f/--file missing-file error: log the self-explanatory IAE message directly instead of wrapping it in an opaque \u0027Error determining top directory\u0027 prefix\n- Fix double error message when -f points to a non-existent POM file\n- Fix shell scripts (mvn, mvn.cmd) to not exit when -f argument does not exist; add [ERROR] prefix to Windows cmd error messages\n- Catch IllegalArgumentException in ProjectModelResolver and wrap as ModelBuilderException to avoid unexpected exception propagation\n- Style: collapse duplicate catch blocks into multi-catch" }, { "commit": "b245782f09cc3d132703127d3cb632699030cd15", "tree": "ab0c284230d0d37d956bcd1296e88692124a420d", "parents": [ "48e72f8eb45c7d797c61aaab9b1f49af8d333705" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Wed Oct 14 14:49:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 14:49:08 2026 +0200" }, "message": "fix: keep location of inherited plugins (fix #10717)\n\n- DefaultInheritanceAssembler lost the element location (empty key) when merging an inherited plugin or report plugin into a new instance; the location is now preserved\n- Affects tools (e.g. OpenRewrite Maven plugin) that resolve config paths against the declaring POM via getLocation(\"\")\n- Test: DefaultInheritanceAssemblerTest#testInheritedPluginKeepsItsLocation covers build and report plugins inherited from a parent" }, { "commit": "48e72f8eb45c7d797c61aaab9b1f49af8d333705", "tree": "9d840fd4d6412a7102a4625704376a138ee06d87", "parents": [ "4fa35fc9f7171b9b9b24859d05af90ccd195e225" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Wed Oct 14 14:34:36 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 14:34:36 2026 +0200" }, "message": "maintenance: Remove commented-out implementation attribute code from MojoExtension (#12975)\n\n- Remove dead commented-out code in `MojoExtension.finalizeConfig` that attempted to copy a parameter\u0027s `implementation` into configuration attributes\n- The new API `Parameter` (`api/maven-api-plugin plugin.mdo`) has no `implementation` property (only `Mojo` does); the block was unreachable\n- Cleanup only — no behavior change" }, { "commit": "4fa35fc9f7171b9b9b24859d05af90ccd195e225", "tree": "ca696d35c31ea80b5601b1a233b07a667210acff", "parents": [ "4d7b67b5529a1ab0d5ec3292cc9336b5ee67bb28" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Wed Oct 14 15:32:33 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 14:32:33 2026 +0200" }, "message": "Fix #13448: isolate model builder test roots" }, { "commit": "4d7b67b5529a1ab0d5ec3292cc9336b5ee67bb28", "tree": "13029cdc1a05ce525db9860d85874e14da6a5245", "parents": [ "d7b3d0305082fd3968b76b50c122e8a6896ad4fd" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Wed Oct 14 10:02:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 10:02:59 2026 +0200" }, "message": "Verify the cygpath on the PATH converts to usable Windows paths\n\nPort of #13429 to `master`.\n\nA `cygpath(1)` from an unrelated POSIX emulation layer (e.g. Anaconda) can be\nfound on the PATH first. It re-roots every POSIX path under its own prefix,\ncausing a bare `ClassNotFoundException` at launch. This adds a sanity-probe:\nconvert the current directory with the `cygpath` found, and require its Windows\nform to exist on disk. On failure, warn and fall back to POSIX paths — same\nposture as the missing-cygpath case introduced in #12567.\n\n- Add cygpath sanity-check: verify the Windows path returned by cygpath exists on disk\n- On failure, warn and fall back to POSIX paths\n- Add test coverage in `test-mvn-path-conversion.sh` for the bogus-cygpath scenario\n\nCloses #13414" }, { "commit": "d7b3d0305082fd3968b76b50c122e8a6896ad4fd", "tree": "c3fc89d925e11ac5d004c716fe4f290251c45435", "parents": [ "fc1451cfba93059d9d61f23a3f4929f4b696c2d3" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 13 22:16:33 2026 +0000" }, "committer": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 13 22:16:33 2026 +0000" }, "message": "Revert \"test: improve ProjectModelResolver tests - add wrong range format cases and clean up throws declarations\"\n\nThis reverts commit 07ab96a1729efb1588c340412a96629ffbb09698.\n" }, { "commit": "fc1451cfba93059d9d61f23a3f4929f4b696c2d3", "tree": "413a31333ea180cdaf3791bacdc0ae171976dcaa", "parents": [ "b28f385ca5a352d854c47247bcfa3c71052eb1b2" ], "author": { "name": "HARSHA B", "email": "harshab1062006@gmail.com", "time": "Wed Oct 14 01:30:12 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 22:00:12 2026 +0200" }, "message": "MNG-8488: Document RepositoryFactory methods\n\nAdd Javadoc to all four methods in `RepositoryFactory` (maven-api-core):\n\n- `createLocal(Path)`: documents the path-to-absolute conversion\n- `createRemote(String, String)`: documents default layout and release/snapshot policies\n- `createRemote(Repository)`: documents model translation (policies, enabled state, checksum policy)\n- `aggregate(...)`: documents precedence rules, ordering, and `processRecessive` flag semantics\n\nCloses #10735 (MNG-8488)" }, { "commit": "b28f385ca5a352d854c47247bcfa3c71052eb1b2", "tree": "c0142fe5f6edb605d9ecaa79ed267fbe27ed2eae", "parents": [ "31fcdd068d083a4703a2402a7d67bc3db7577442" ], "author": { "name": "Arturo Bernal", "email": "abernal@apache.org", "time": "Tue Oct 13 21:58:07 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 21:58:07 2026 +0200" }, "message": "fix: precompile JvmConfigParser to eliminate per-run source-launch overhead (#13431)\n\nShip `JvmConfigParser` as a precompiled class instead of running it in source-launch mode.\n\n- Add a dedicated `compile-jvm-config-parser` compiler execution in `apache-maven/pom.xml` to compile the parser at build time\n- Include `JvmConfigParser.class` in `bin/` via the assembly descriptor; remove `.java` from the `*.cmd` fileset\n- Update `bin/mvn` and `bin/mvn.cmd` to invoke the parser with `-cp $MAVEN_HOME/bin JvmConfigParser` instead of source-launch\n- Update `test-mvn-path-conversion.sh` stub to match the new invocation style (positional argument shifts)\n- Source-launch compilation cost was ~455 ms per invocation with a `.mvn/jvm.config`; precompiled cost is ~30 ms\n\nFixes #13404" }, { "commit": "31fcdd068d083a4703a2402a7d67bc3db7577442", "tree": "c53ea398a3386eac8a4d8d9ea9ca70e08a38b980", "parents": [ "05b8933ed20b4b6773f0b0a8624582a6469c0663" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 13 17:50:13 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 13 18:03:32 2026 +0200" }, "message": "Build with Maven 4.0.0-rc-7 in CI\n" }, { "commit": "05b8933ed20b4b6773f0b0a8624582a6469c0663", "tree": "531348e76a5dcfb027990b702de287a8778ccc78", "parents": [ "f215871e7baffcd2091a5be430cf79d60fe04956" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 13 16:39:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 16:39:23 2026 +0200" }, "message": "Fix #13362: restore the java.util.logging root handlers after an invocation\n\n[LookupInvoker] save the root logger\u0027s handlers before activateLogging() and restore them in the finally block, so that embedded/resident Maven invocations do not leave a stale SLF4JBridgeHandler on the host JVM root logger. Add MavenInvokerTest.restoresJavaUtilLoggingRootHandlers." }, { "commit": "f215871e7baffcd2091a5be430cf79d60fe04956", "tree": "72c2a5ee4afc5dc685c5f0861e2b19377811b8e4", "parents": [ "c65f40a1281139bd705f8fe24708a376d3a7c5e3" ], "author": { "name": "Burak Kalaycı", "email": "kalayciburak1996@gmail.com", "time": "Tue Oct 13 17:29:14 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 16:29:14 2026 +0200" }, "message": "fix: restore DependencyNode from PluginRealmCache on cache hit\n\n- PluginRealmCache.CacheRecord now carries the DependencyNode; 3-arg\n constructor and getDependencyNode() accessor added (2-arg preserved\n for compatibility)\n- DefaultMavenPluginManager.setupPluginRealm stores the node in the\n CacheRecord on cache miss and restores it on cache hit, so a second\n execution of a plugin no longer gets a null dependency node and avoids\n a NullPointerException in MojoExecution.getPlugin().getDependencies()\n- PluginRealmCache SPI: the default get(Key, PluginRealmSupplier) was\n calling put(key, realm, artifacts), silently dropping the node for\n custom implementations; it now returns the supplier\u0027s CacheRecord\n directly and delegates storage via a new 4-arg put() default method\n- DefaultPluginRealmCache overrides 4-arg put() to store the full record\n- Test: DefaultMavenPluginManagerRealmCacheTest verifies the node is\n restored on cache hit and the resolver is invoked exactly once\n\nFixes #13307" }, { "commit": "c65f40a1281139bd705f8fe24708a376d3a7c5e3", "tree": "0b2f2af9925b202ec38f8d0e59e5dcfe4c356a58", "parents": [ "788c99875b09f99f6f1d16fdab393bd0a1717c80" ], "author": { "name": "Keith E Campbell", "email": "stamp.versioned@knowledge.design", "time": "Tue Oct 13 07:23:47 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 16:23:47 2026 +0200" }, "message": "Fix #13295: treat a missing or null snapshotVersion classifier as empty when merging\n\nA \u003csnapshotVersion\u003e element written without a \u003cclassifier\u003e child (as Maven 3 and\nrepository managers such as Nexus 3 do) reads back with a null classifier. A new artifact\nwithout a classifier has \"\". The keys \"null:pom\" and \":pom\" never matched, so\nRemoteSnapshotMetadata.merge kept the previous build\u0027s entry beside the new one, producing\nduplicate entries after the first deploy onto Maven-3-written metadata.\n\nNormalize null to \"\" in getKey, applied to all four copies of the method:\n- impl/maven-impl: MavenSnapshotMetadata (remote) and LocalSnapshotMetadata (local)\n- compat/maven-resolver-provider: both identical copies, kept in sync\n\nNew RemoteSnapshotMetadataTest verifies that:\n- a new build replaces an entry with no \u003cclassifier\u003e element\n- entries for other classifiers that were not redeployed are preserved\n- an entry with an empty \u003cclassifier\u003e element is also replaced" }, { "commit": "788c99875b09f99f6f1d16fdab393bd0a1717c80", "tree": "b6ec4d80b05e741d55085ab81587fb06e3302297", "parents": [ "07ab96a1729efb1588c340412a96629ffbb09698" ], "author": { "name": "Usman Ejaz", "email": "121238357+UsmanEjaz10@users.noreply.github.com", "time": "Tue Oct 13 19:20:16 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 16:20:16 2026 +0200" }, "message": "[MNG-8092] Only warn about extension in reactor for projects actually built\n\n- Move extension-in-reactor validation from `build()` to `reactorDependencyGraph()`, after all trimming steps (`trimProjectsToRequest`, `trimSelectedProjects`, `trimResumedProjects`, `trimExcludedProjects`), so only active projects are checked\n- Rename method to `validateExtensionIsNotPartOfReactor` and simplify key lookup from a `Map` to a `Set\u003cString\u003e` (no more `MavenExecutionRequest` dependency)\n- Add IT coverage in `MavenITmng5572ReactorPluginExtensionsTest` verifying no warning when the extension plugin is excluded via `-pl !plugin`" }, { "commit": "07ab96a1729efb1588c340412a96629ffbb09698", "tree": "eb74cc488afb538bd465590e89f20ed92a60d9e0", "parents": [ "0626123ea838dfaf1514039fde1dec826ec4f6e0" ], "author": { "name": "Michael Hausegger", "email": "hausegger.michael@googlemail.com", "time": "Tue Oct 13 16:02:24 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 16:02:24 2026 +0200" }, "message": "test: improve ProjectModelResolver tests - add wrong range format cases and clean up throws declarations\n\n- Add testResolveParentThrowsUnresolvableModelExceptionWhenUsingWrongRangeFormat: verifies that an invalid version range format (e.g. [1:2)) is rejected with a clear error for parent resolution\n- Add testResolveDependencyThrowsUnresolvableModelExceptionWhenUsingWrongRangeFormat: same coverage for dependency resolution\n- Remove unnecessary throws Exception declarations from 6 existing test methods that use assertThrows (no checked exceptions escape)" }, { "commit": "0626123ea838dfaf1514039fde1dec826ec4f6e0", "tree": "a7c7e98631caf639e2ca398f2a68028b920e4604", "parents": [ "0b31e29d66904c45220f5432a11ba8566168217d" ], "author": { "name": "HARSHA B", "email": "harshab1062006@gmail.com", "time": "Tue Oct 13 18:12:05 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 14:42:05 2026 +0200" }, "message": "[MNG-13349] Deprecate DistributionManagement.status in API model\n\nAdd @Deprecated(since \u003d \"4.0.0\") annotation to the DistributionManagement.status field in maven.mdo.\n\nThe field has been rejected by the model validator since Maven 2 and is never read or acted on by Maven itself. The existing Javadoc already marked it deprecated; this adds the formal Java annotation so IDEs and tooling get a machine-readable deprecation signal." }, { "commit": "0b31e29d66904c45220f5432a11ba8566168217d", "tree": "99b8df1b7514d066cff7826b1e65560a4b3057f1", "parents": [ "feccef73e6e725ae5296dc888f14fd67c492c411" ], "author": { "name": "Christian Munier", "email": "christian@munier.eu", "time": "Tue Oct 13 14:40:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 14:40:38 2026 +0200" }, "message": "fix: accept documented lowercase values for maven.resolver.validation\n\nThe property is documented as accepting `default`, `mild`, and `off`, but `MavenValidatorFactory` used `ConfigUtils.getEnum()` / `Enum.valueOf()` which is case-sensitive — so `-Dmaven.resolver.validation\u003dmild` failed with an `IllegalArgumentException`.\n\n- Parse the value ignoring case and surrounding whitespace, so both the documented lowercase values and the uppercase equivalents are accepted\n- Report unknown values with the property name and the list of supported values\n- Add `MavenValidatorFactoryTest` with parameterized tests covering case variants and the error message (4 of 5 tests fail without the fix)" }, { "commit": "feccef73e6e725ae5296dc888f14fd67c492c411", "tree": "223cb36ae757d0e6323005993a4ccfaa17ee8348", "parents": [ "8782d8d07811783b7c172a4ec08c69d79e11fa65" ], "author": { "name": "Efe", "email": "gokdemirefe1903@gmail.com", "time": "Tue Oct 13 15:19:53 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 14:19:53 2026 +0200" }, "message": "fix: clarify mvnup check dry-run output\n\n- Track dry-run state in UpgradeContext and expose it via isDryRun()\n so all strategies can branch on planned vs applied wording\n- Switch all upgrade strategies (InferenceStrategy, PluginUpgradeStrategy,\n ModelUpgradeStrategy, CompatibilityFixStrategy, DeduplicateDependenciesStrategy,\n DuplicateElementStrategy, EnforcerVersionRangeStrategy,\n ModuleNameFixStrategy, NashornCompatibilityStrategy,\n RepositoryHttpsUpgradeStrategy, ResourceFilteringStrategy,\n SourceStrategy, ToolchainPluginStrategy) to use conditional phrasing\n (\"would be modified\" / \"would add\" etc.) when running under `mvnup check`\n- Consolidate per-strategy dry-run branches through the existing\n AbstractUpgradeStrategy.logChange() helper to avoid duplication\n- Add UpgradeContextTest, CheckTest and StrategyOrchestratorTest to\n cover dry-run state and orchestrator output wording\n\nFixes: #13250\n\nSigned-off-by: Efe Gökdemir \u003cefe@rexcode.co.uk\u003e" }, { "commit": "8782d8d07811783b7c172a4ec08c69d79e11fa65", "tree": "7d5fa5a05012914e8f5dfd292a8b99d7e27b8764", "parents": [ "cc76fd30a4f8bbede171e3e377e2372aea1fcf8a" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 13 14:05:54 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 14:05:54 2026 +0200" }, "message": "Introduce named constants for interpolation operators and improve Interpolator Javadoc\n\n- Add OP_DEFAULT \u003d \":-\" and OP_ALTERNATE \u003d \":+\" constants in DefaultInterpolator, consistent with existing DELIM_START / DELIM_STOP / MARKER pattern\n- Replace all four inline literal occurrences in processSubstitution()\n- Remove the unreachable else-throw branch (op is always one of the two constants)\n- Expand Interpolator interface Javadoc to document ${var:-default} and ${var:+alternate} operators including nesting and chaining, which were supported but undocumented\n- Add testUnknownOperatorTreatedAsVariableName() to document that unrecognised operator characters are resolved as plain variable names" }, { "commit": "cc76fd30a4f8bbede171e3e377e2372aea1fcf8a", "tree": "bdec43525ab9a291fa410766be47252582225c1e", "parents": [ "dabd7b20b4526da443b67d50708373ab3a1b20fa" ], "author": { "name": "Guillaume Nodet", "email": "gnodet@gmail.com", "time": "Tue Oct 13 14:03:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 14:03:20 2026 +0200" }, "message": "feat: make MojoExecution @Immutable with noun-based accessors\n\n- Replace get-prefixed abstract methods on MojoExecution with noun-based equivalents (plugin(), model(), descriptor(), executionId(), goal(), lifecyclePhase(), configuration()) matching the pattern established by ExecutionEvent, Node, etc.\n- Remove deprecated get-prefixed bridge methods (since GA 4.0.0 has not shipped yet, no shim retention is needed); update two internal callers (PluginParameterExpressionEvaluatorV4Test, MojoExtension)\n- DefaultMojoExecution now captures all fields at construction time (after plan calculation is complete) and drops the live reference to mutable legacy MojoExecution; @Immutable is now honest\n- lifecyclePhase() and executionId() return Optional\u003cString\u003e to model nullable CLI-invoked goals correctly; deprecated bridges return @Nullable\n- Eagerly capture lifecycle mappings in buildPlugin snapshot\n- Add noun-based fallback in ReflectionValueExtractor: when no prefixed method is found for a ${mojo.*} expression, try the property name as-is, fixing PluginParameterExpressionEvaluatorV4Test failures for prefixless noun accessors; add test coverage and javadoc for the fallback\n- Add null-guard on DependencyNode and MojoDescriptor in buildPlugin(), merge function on Collectors.toMap() to avoid ISE on duplicate keys, requireNonNull guard for goal field, log at debug when lifecycle mappings cannot be loaded\n- Update MojoExecutionStub to implement new noun-based abstract methods" }, { "commit": "dabd7b20b4526da443b67d50708373ab3a1b20fa", "tree": "ecd12ee16c02fe36b95035029f9a34dca7a444ed", "parents": [ "98450184198f3c40557eef4af6445ddeb6876312" ], "author": { "name": "Ivan Khanas", "email": "xeno@altlinux.org", "time": "Tue Oct 13 11:31:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 11:31:33 2026 +0200" }, "message": "[MNG-8650] Add mvnval, a tool to validate POMs without building them\n\n- Add `ModelBuilderSession.validate()` API method that collects all problems (errors and warnings) instead of throwing on the first error; declared default so existing implementations keep compiling unchanged\n- Add `mvnval` CLI tool reachable as `mvnval`, `mvn --val`, and from `mvnsh`; takes any number of POM files (defaults to `./pom.xml`), writes text or JSON output, and returns structured exit codes: 0\u003dclean, 1\u003derrors, 2\u003dbad usage, 3\u003dcancelled, 4\u003dwarnings-only\n- Two validation modes: `--mode raw` (no repository access, works offline and on unpublished POMs) and `--mode effective` (default, resolves parents and BOMs, runs all checks including those needing inherited values)\n- Bundle workspace reader for effective mode: pre-scans all given POMs to build a GAV index so parent/BOM lookups among the bundle are answered from disk, making the verdict order-independent and avoiding redundant downloads\n- Honour `-o`/`--offline` in effective mode; refuse `-s`/`-ps`/`-is` (cannot redirect the settings ApiRunner reads at session-creation time)\n- Security hardening: no core extensions loaded, no container stood up, no `maven.ext.class.path` honoured; `.mvn/jvm.config` still reaches the launcher (documented in THREAT_MODEL.md)\n- `--local-repository` and `--temp-local-repository` options to aim or isolate the local repository; throwaway directory deleted on exit and on SIGTERM\n- Text output shows coloured severity labels and surrounding XML source context around each problem location; JSON output keeps absolute paths\n- Deduplicate POMs named multiple times (normalise to real path via `toRealPath`); print paths relative to working directory in text output\n- Integration tests covering raw/effective validation, bundle workspace reader, offline mode, and `mvnsh` registration" }, { "commit": "98450184198f3c40557eef4af6445ddeb6876312", "tree": "a5e23b3b2bbaa3522271ef4b2d8957c0fbce5f92", "parents": [ "6c8d7c0c9e3b511945a16ed534b7d73218504ac8" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 13 10:15:31 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 13 10:37:03 2026 +0200" }, "message": "Upload the Mimir caches only when they will be consolidated\n\nconsolidate-caches saves only on push when the POM-hash key is not stored yet; on pull requests and on a stored key the 19 uploads, about 6 GB per run, were never read.\n" }, { "commit": "6c8d7c0c9e3b511945a16ed534b7d73218504ac8", "tree": "be998a98eae28723de1974b9456348a7e39e99b7", "parents": [ "f7782b69618d85e62611722e614b8e60acd9fef1" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 13 08:46:11 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Tue Oct 13 10:12:11 2026 +0200" }, "message": "Key the Mimir cache on the POMs instead of the run\n\nA run-id key saved about 0.5 GB per OS on every push that no later run could match; the POM hash saves a new entry only when the POMs change, and restore still falls back to the newest one.\n" }, { "commit": "f7782b69618d85e62611722e614b8e60acd9fef1", "tree": "b1b183c0663dcd2a5824cf7276264e1624dd8c71", "parents": [ "1b33df52ea038850e0a8060d6cf51684834137dd" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 21:13:06 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 12 23:22:22 2026 +0200" }, "message": "build: bump actions/upload-artifact from 7.0.1 to 7.0.2\n\nBumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n dependency-version: 7.0.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "1b33df52ea038850e0a8060d6cf51684834137dd", "tree": "cde4fb7a0458c66dcdc4fcd432b7032f6e114554", "parents": [ "8aa4ae18d4a0a514a8319a40c800ad13368bc48a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 23:20:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 23:20:38 2026 +0200" }, "message": "build: bump org.apache.maven.resolver:maven-resolver-impl (#13360)\n\nBumps [org.apache.maven.resolver:maven-resolver-impl](https://github.com/apache/maven-resolver) from 1.8.1 to 2.0.24.\n- [Release notes](https://github.com/apache/maven-resolver/releases)\n- [Commits](https://github.com/apache/maven-resolver/compare/maven-resolver-1.8.1...maven-resolver-2.0.24)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.resolver:maven-resolver-impl\n dependency-version: 2.0.24\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8aa4ae18d4a0a514a8319a40c800ad13368bc48a", "tree": "3817ce227a06fa9f57f0edda756fb1685e633afb", "parents": [ "d7f9c28ae8aa68265ed857b2a5fe535b2de0d763" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 12 22:04:49 2026 +0200" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 12 23:10:54 2026 +0200" }, "message": "Activate the JDK 27 Spotless profile by property, not \u003cjdk\u003e\n\nThe model builder tests in maven-impl build the root POM in sessions\nwithout java.version, where a \u003cjdk\u003e activation is an error.\n" }, { "commit": "d7f9c28ae8aa68265ed857b2a5fe535b2de0d763", "tree": "73c29f50fea6e8329db299b496da1464cf2505df", "parents": [ "054488084e9180625f878c10110d596fdc5712d7" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 12 19:22:29 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 12 23:10:54 2026 +0200" }, "message": "Skip Spotless on JDK 27 through a POM profile\n\nThe profile applies to local builds as well as CI, so the -Dspotless.skip\narguments leave the workflow. Drop it once maven-parent ships a\npalantir-java-format that runs on JDK 27 (palantir/palantir-java-format#1786).\n" }, { "commit": "054488084e9180625f878c10110d596fdc5712d7", "tree": "509d726a9291c152d15940b422c6b942448451d1", "parents": [ "a7090143405568252e57f80b39e589371ba3e649" ], "author": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 12 14:32:45 2026 +0000" }, "committer": { "name": "Sylwester Lachiewicz", "email": "slachiewicz@apache.org", "time": "Mon Oct 12 23:10:54 2026 +0200" }, "message": "Skip Spotless in the JDK 27 site build too\n\nThe javadoc report forks a build that runs spotless:check, which crashes on\nJDK 27 like the main build (palantir/palantir-java-format#1786).\n" }, { "commit": "a7090143405568252e57f80b39e589371ba3e649", "tree": "41c769bf5cc7955dbe366aad4c327169d0107ee2", "parents": [ "4375a6ee82f553cb33c5cf6da304951ee967e98d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 22:45:30 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 22:45:30 2026 +0200" }, "message": "build: bump actions/download-artifact from 8.0.1 to 8.0.2 (#13418)\n\nBumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.1 to 8.0.2.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333)\n\n---\nupdated-dependencies:\n- dependency-name: actions/download-artifact\n dependency-version: 8.0.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" } ], "next": "4375a6ee82f553cb33c5cf6da304951ee967e98d" }