build(deps): bump the production-dependencies group across 1 directory with 26 updates by dependabot[bot] · Pull Request #1306 · apache/axis-axis2-java-core

dependabot · 2026-10-08T14:14:05Z

Bumps the production-dependencies group with 26 updates in the / directory:

Package	From	To
org.apache:apache	`39`	`40`
org.mockito:mockito-core	`5.23.0`	`5.24.0`
org.apache.ws.xmlschema:xmlschema-core	`2.3.2`	`2.3.3`
org.apache.neethi:neethi	`3.2.3`	`3.2.4`
org.slf4j:slf4j-api	`2.0.19`	`2.0.20`
org.slf4j:jcl-over-slf4j	`2.0.19`	`2.0.20`
org.slf4j:jcl-over-slf4j	`2.0.19`	`2.0.20`
org.apache.httpcomponents.core5:httpcore5	`5.4.3`	`5.4.4`
org.apache.httpcomponents.core5:httpcore5-h2	`5.4.3`	`5.4.4`
org.apache.httpcomponents.core5:httpcore5-h2	`5.4.3`	`5.4.4`
org.xmlunit:xmlunit-legacy	`2.13.0`	`2.14.0`
org.apache.xmlbeans:xmlbeans	`5.4.0`	`5.4.1`
org.apache.maven:maven-plugin-api	`3.9.16`	`3.10.0`
org.apache.maven:maven-core	`3.9.16`	`3.10.0`
org.apache.maven:maven-artifact	`3.9.16`	`3.10.0`
org.apache.maven:maven-compat	`3.9.16`	`3.10.0`
org.apache.maven:maven-core	`3.9.16`	`3.10.0`
org.apache.maven:maven-artifact	`3.9.16`	`3.10.0`
org.apache.maven:maven-compat	`3.9.16`	`3.10.0`
org.apache.commons:commons-lang3	`3.20.0`	`3.21.0`
com.google.guava:guava	`33.7.1-jre`	`33.7.2-jre`
com.fasterxml.woodstox:woodstox-core	`7.2.2`	`7.3.0`
org.eclipse.jetty.ee10:jetty-ee10-webapp	`12.1.13`	`12.1.14`
org.eclipse.jetty.ee10:jetty-ee10-maven-plugin	`12.1.13`	`12.1.14`
org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin	`12.1.13`	`12.1.14`
net.bytebuddy:byte-buddy	`1.18.13`	`1.18.14`
org.apache.groovy:groovy	`5.1.2`	`6.0.0`
org.apache.groovy:groovy-ant	`5.1.2`	`6.0.0`
org.apache.groovy:groovy-xml	`5.1.2`	`6.0.0`
org.apache.groovy:groovy-ant	`5.1.2`	`6.0.0`
org.apache.groovy:groovy-xml	`5.1.2`	`6.0.0`
org.eclipse.jetty.ee10:jetty-ee10-maven-plugin	`12.1.13`	`12.1.14`
org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin	`12.1.13`	`12.1.14`
org.owasp.encoder:encoder	`1.4.0`	`1.5.0`
com.fasterxml.jackson.core:jackson-databind	`2.22.2`	`2.22.3`

Updates org.apache:apache from 39 to 40

Release notes

Sourced from org.apache:apache's releases.

40

💥 Breaking changes

Replace nicoulaj checksum plugin with maveniverse checksum plugin (#599) @slawekjaranowski

#586: Use RAT0.18 and remove commons-lang3 configuration for JDK25 (#587) @ottlinger

Property version.maven-surefire was removed in apache/maven-apache-parent#588, should be replaced by version.maven-surefire-plugin, version.maven-failsafe-plugin or version.maven-surefire-report-plugin

🚀 New features and improvements

Fix several version property issues (#588) @ctubbsii

📝 Documentation updates

Update documentation for push-to-atr profile (#613) @slawekjaranowski

Restore the common wording on the download page (#596) @slachiewicz

👻 Maintenance

Add local maven configuration for ATR project name override (#614) @slawekjaranowski

Remove custom name-template for release-drafter (#604) @slawekjaranowski

Port the site documentation from APT to Markdown (#595) @slachiewicz

📦 Dependency updates

Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 (#612) @dependabot[bot]

Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 (#611) @dependabot[bot]

Bump org.apache.maven.plugins:maven-plugin-tools from 3.15.2 to 3.16.0 (#610) @slawekjaranowski

Bump surefire-plugin, failsafe-plugin, surefire-report-plugin from 3.5.6 to 3.6.0 (#605) @slawekjaranowski

Bump org.apache.tooling:atr-maven-plugin from 1.0.0-alpha-1 to 1.0.0-beta-1 (#598) @dependabot[bot]

Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 (#600) @dependabot[bot]

#586: Use RAT0.18 and remove commons-lang3 configuration for JDK25 (#587) @ottlinger

Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 (#594) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#591) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (#593) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml from 4 to 5 (#592) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#590) @dependabot[bot]

Bump org.apache.maven.plugins:maven-help-plugin from 3.5.1 to 3.5.2 (#589) @dependabot[bot]

Commits

See full diff in compare view

Updates org.mockito:mockito-core from 5.23.0 to 5.24.0

Release notes

Sourced from org.mockito:mockito-core's releases.

v5.24.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.24.0

2026-09-23 - 27 commit(s) by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]

Fix Mockito docs for -javaagent flag with Gradle [(#3866)](mockito/mockito#3866)

Kotlin example for adding Mockito as an agent is incorrect [(#3864)](mockito/mockito#3864)

Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(#3862)](mockito/mockito#3862)

Bump gradle/actions from 6.2.0 to 6.3.0 [(#3852)](mockito/mockito#3852)

Bump gradle/actions from 5 to 6.2.0 [(#3851)](mockito/mockito#3851)

Preserve method parameters when clearing inline mocks [(#3847)](mockito/mockito#3847)

Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(#3845)](mockito/mockito#3845)

Print object fields via reflection when toString() is not implemented [(#3844)](mockito/mockito#3844)

Migrate extensions-tests to JUnit Jupiter [(#3840)](mockito/mockito#3840)

Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(#3839)](mockito/mockito#3839)

docs(when-verify): fixes to explanations about redundancy [(#3838)](mockito/mockito#3838)

Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(#3837)](mockito/mockito#3837)

Bump actions/checkout from 6 to 7 [(#3836)](mockito/mockito#3836)

Fixes #2740 : Add mockMaker option to @Spy annotation [(#3835)](mockito/mockito#3835)

Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(#3834)](mockito/mockito#3834)

Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(#3833)](mockito/mockito#3833)

Bump codecov/codecov-action from 6 to 7 [(#3831)](mockito/mockito#3831)

Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(#3830)](mockito/mockito#3830)

Fix clearInlineMocks not de-registering singleton mocks [(#3829)](mockito/mockito#3829)

Fix NotAMockException when using mockSingleton with MockitoJUnit [(#3827)](mockito/mockito#3827)

NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(#3826)](mockito/mockito#3826)

Improve Gradle agent docs for configuration cache [(#3823)](mockito/mockito#3823)

Gradle documentation for setting up instrumentation with Gradle configuration cache [(#3822)](mockito/mockito#3822)

Fixes #3818 : Fix data race in InvocationContainerImpl.invocationForStubbing [(#3819)](mockito/mockito#3819)

Data race on invocationForPotentialStubbing [(#3818)](mockito/mockito#3818)

Fixes #3814 : implement package-level clinit suppression [(#3815)](mockito/mockito#3815)

Package-level clinit suppression [(#3814)](mockito/mockito#3814)

Upgrade Android Gradle Plugin to 8.13.2 [(#3812)](mockito/mockito#3812)

Replaces raw generic types with type parameters [(#3806)](mockito/mockito#3806)

Fixes #2398 : Implement global suppress static initialization leveraging java agent [(#3801)](mockito/mockito#3801)

Bump codecov/codecov-action from 5 to 6 [(#3800)](mockito/mockito#3800)

Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (#3406, #2823) [(#3795)](mockito/mockito#3795)

Fixes #3536 : Implement SpyStatic API [(#3794)](mockito/mockito#3794)

The class's MethodParameters are removed after clearAllCaches is invoked [(#3763)](mockito/mockito#3763)

[FeatureRequest / Idea] Create Mockito.spyStatic [(#3536)](mockito/mockito#3536)

Add option to specify mockmaker for @Spy [(#2740)](mockito/mockito#2740)

How can I suppress static initializer? [(#2398)](mockito/mockito#2398)

Commits

5a2f0f8 Fix Mockito docs for -javaagent flag with Gradle (#3866)
9c5f36f Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (#3862)
e7fd06d Preserve method parameters when clearing inline mocks (#3847)
5a676bc Bump gradle/actions from 6.2.0 to 6.3.0 (#3852)
508f8e7 Bump gradle/actions from 5 to 6.2.0 (#3851)
ee8a330 Print object fields via reflection when toString() is not implemented (#3844)
39b1aba Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (#3845)
d8638e1 Migrate extensions-tests to JUnit Jupiter (#3840)
0aab922 Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (#3839)
f3cf74c docs(when-verify): fixes to explanations about redundancy (#3838)
Additional commits viewable in compare view

Updates org.apache.ws.xmlschema:xmlschema-core from 2.3.2 to 2.3.3

Updates org.apache.neethi:neethi from 3.2.3 to 3.2.4

Updates org.slf4j:slf4j-api from 2.0.19 to 2.0.20

Updates org.slf4j:jcl-over-slf4j from 2.0.19 to 2.0.20

Updates org.apache.httpcomponents.core5:httpcore5 from 5.4.3 to 5.4.4

Changelog

Sourced from org.apache.httpcomponents.core5:httpcore5's changelog.

Release 5.4.4

This maintenance release optimizes HTTP/1.1 message buffer configuration and corrects the handling of asynchronous entity producer state resets after interrupted writes.

Change Log

HTTPCORE-800: Fixed hexadecimal encoding of control characters in HttpException messages. Contributed by Arturo Bernal

HTTPCORE-799: Corrected the handling of asynchronous entity producer state resets after interrupted writes. Contributed by Matthias Kurz <m.kurz at irregular.at>

Fixed URIBuilder encoding policy documentation and null reset behavior. Contributed by Praful Gupta

Increased the default HTTP/1.1 buffer size to 32 KiB. Contributed by Arturo Bernal

Commits

d40892e HttpCore 5.4.4 release
698b2b6 Updated release notes for HttpCore 5.4.4 release
8ada43a HTTPCORE-800: Fix hexadecimal encoding of control characters
9cb751e HTTPCORE-799: Reset async entity producer state after interrupted writes
e871fa0 Fix URIBuilder encoding policy documentation and null reset
34542fc Increase default HTTP/1.1 buffer size to 32 KiB
a79f87e Add details to solve compatibility issues.
93421d3 Upgraded HttpCore version to 5.4.4-SNAPSHOT
See full diff in compare view

Updates org.apache.httpcomponents.core5:httpcore5-h2 from 5.4.3 to 5.4.4

Changelog

Sourced from org.apache.httpcomponents.core5:httpcore5-h2's changelog.

Release 5.4.4

This maintenance release optimizes HTTP/1.1 message buffer configuration and corrects the handling of asynchronous entity producer state resets after interrupted writes.

Change Log

HTTPCORE-800: Fixed hexadecimal encoding of control characters in HttpException messages. Contributed by Arturo Bernal

HTTPCORE-799: Corrected the handling of asynchronous entity producer state resets after interrupted writes. Contributed by Matthias Kurz <m.kurz at irregular.at>

Fixed URIBuilder encoding policy documentation and null reset behavior. Contributed by Praful Gupta

Increased the default HTTP/1.1 buffer size to 32 KiB. Contributed by Arturo Bernal

Commits

d40892e HttpCore 5.4.4 release
698b2b6 Updated release notes for HttpCore 5.4.4 release
8ada43a HTTPCORE-800: Fix hexadecimal encoding of control characters
9cb751e HTTPCORE-799: Reset async entity producer state after interrupted writes
e871fa0 Fix URIBuilder encoding policy documentation and null reset
34542fc Increase default HTTP/1.1 buffer size to 32 KiB
a79f87e Add details to solve compatibility issues.
93421d3 Upgraded HttpCore version to 5.4.4-SNAPSHOT
See full diff in compare view

Updates org.apache.httpcomponents.core5:httpcore5-h2 from 5.4.3 to 5.4.4

Changelog

Sourced from org.apache.httpcomponents.core5:httpcore5-h2's changelog.

Release 5.4.4

This maintenance release optimizes HTTP/1.1 message buffer configuration and corrects the handling of asynchronous entity producer state resets after interrupted writes.

Change Log

HTTPCORE-800: Fixed hexadecimal encoding of control characters in HttpException messages. Contributed by Arturo Bernal

HTTPCORE-799: Corrected the handling of asynchronous entity producer state resets after interrupted writes. Contributed by Matthias Kurz <m.kurz at irregular.at>

Fixed URIBuilder encoding policy documentation and null reset behavior. Contributed by Praful Gupta

Increased the default HTTP/1.1 buffer size to 32 KiB. Contributed by Arturo Bernal

Commits

d40892e HttpCore 5.4.4 release
698b2b6 Updated release notes for HttpCore 5.4.4 release
8ada43a HTTPCORE-800: Fix hexadecimal encoding of control characters
9cb751e HTTPCORE-799: Reset async entity producer state after interrupted writes
e871fa0 Fix URIBuilder encoding policy documentation and null reset
34542fc Increase default HTTP/1.1 buffer size to 32 KiB
a79f87e Add details to solve compatibility issues.
93421d3 Upgraded HttpCore version to 5.4.4-SNAPSHOT
See full diff in compare view

Updates org.xmlunit:xmlunit-legacy from 2.13.0 to 2.14.0

Release notes

Sourced from org.xmlunit:xmlunit-legacy's releases.

XMLUnit for Java 2.14.0

With this release the dependency of xmlunit-core on the JAXB API has been marked optional. If you need the JAXB parts of XMLUnit you now must explicitly add a dependency on the API version matching your implementation. There is no other change compared to version 2.13.0.

Changelog

Sourced from org.xmlunit:xmlunit-legacy's changelog.

XMLUnit for Java 2.14.0 - /Released 2026-09-18/

marked jakarta.xml.bind-api as optional in xmlunit-core. PR #340 by @arimu1

Commits

c74255f prepare release 2.14.0
a5dcffe Merge pull request #342 from xmlunit/add-new-key
2b3d856 record #340
900097f add new key
dfa47c9 Merge pull request #340 from arimu1/fix/339-optional-jakarta-bind-api
00e4ba3 Mark jakarta.xml.bind-api optional in xmlunit-core (#339)
963cfe6 Merge pull request #338 from xmlunit/bump-cyclonedx-plugin
79c9fed bump cyclonedx plugin
ed72f1f Merge pull request #337 from xmlunit/release-1.13.0
5894610 prepare next iteration
See full diff in compare view

Updates org.apache.xmlbeans:xmlbeans from 5.4.0 to 5.4.1

Updates org.apache.maven:maven-plugin-api from 3.9.16 to 3.10.0

Release notes

Sourced from org.apache.maven:maven-plugin-api's releases.

3.10.0

🚀 New features and improvements

Maven 3.10.x should use Maven 3.1 validation in strict mode (#1542) @gnodet

Do not depend on maven-resolver-supplier-mvn3 (#13266) @cstamas

[MNG-6797] - Remember if Maven model problems were encountered. (#298) @wilx

feat: add relativePath validation (#12742) @cstamas

Add validation for Plexus-based plugin dependency injection (#12651) @slawekjaranowski

Introduce validation control (#12549) @cstamas

Update to Resolver 2.0.21 (#12504) @cstamas

[MNG-5913] - Allow defining aliases for existing server configurations in settings.xml (#12475) @slawekjaranowski

🐛 Bug Fixes

Issue #13265: let a settings server declare the repository origins its credentials may be used with (#13275) @slawekjaranowski

Backport #13040: treat reactor BOM imports as ProjectSorter edges so -am includes them (#13263) @gnodet

[MNG-8174] - Fix NPE when a property references itself in a plugin configuration (backport #12932) (#12936) @elharo

Fix #13200: publish a complete set from MavenProject.getArtifacts (#13204) @gnodet

Fixes #13135: ensure completeness of the reactor summary, privilege f… (#13173) @rmannibucau

[3.10.x] Fix #13084: sandbox profile activation context for external model builds (#13114) @gnodet

Fix #13100: honor repositories from legitimately-active external model profiles (#13116) @gnodet

Add support for MAVEN_PROJECTBASEDIR substitution in jvm.config (backport of MNG-8598 to 3.10.x) (#13115) @gnodet

Scope server credentials and validate legacy relocation coordinates (#12954) @slachiewicz

Honour configured policy and validate inputs on the legacy compat paths (#12978) @gnodet

Add unit test for #12600 null-guard in forked executions (#12923) @gnodet

Fix: make ProjectIndex thread-safe for parallel builds (backport #12832) (#12927) @gnodet

Fail on misconfigured plugin-requested toolchains (#12616) @wilx

Resolve classified POM artifacts from the reactor in Maven 3.x (#12659) @wilx

[3.10.x] Convert paths for MSYS2 and jvm.config placeholders in bin/mvn (#12567) @gnodet

Preserve dependency scope in plugin artifacts - fix #12497 (#12503) @slawekjaranowski

📝 Documentation updates

docs: document plugin.xml V4 vs V3 (#13261) @gnodet

[maven-3.10.x] Port the site documentation from APT to Markdown (#12712) @slachiewicz

improve doc about deprecating plugin descriptor's requirement (#12555) @hboutemy

Drop mention of Plexus XML (#12482) @cstamas

👻 Maintenance

[3.10.x] maintenance: Align use of profiles (#13274) @cstamas

Remove version from rat directory deployment (#13046) @slawekjaranowski

Update NOTICE file in distribution packages (#13044) @slawekjaranowski

Restrict what a repository-resolved model contributes to the build (#12953) @slachiewicz

Validate coordinates and repository precedence during artifact resolution (#12952) @slachiewicz

[MNG-8129] - Clarify relativePath validation comment (#12966) @gnodet

[12811] Keep plexus-cipher at 2.0: POM note (#12879) @slachiewicz

[3.10.x] Use try-with-resources (#12845) @slachiewicz

... (truncated)

Commits

c43a36b [maven-release-plugin] prepare release maven-3.10.0
095eb17 Fix wrong links.
bec033e Use staged Maven Resolver 2.0.24
b39f8a7 deps: Update to Maven Resolver 2.0.24 (#13271)
ae59501 Issue #13265: let a settings server declare the repository origins its creden...
6ab2433 [3.10.x] maintenance: Align use of profiles (#13274)
f68413c Do not depend on maven-resolver-supplier-mvn3 (#13266)
3a0026c [Backport maven-3.10.x] Fix #11397: treat reactor BOM imports as ProjectSorte...
82a0f20 docs: document plugin.xml V4 vs V3 [Backport maven-3.10.x]
0fb1c8b [MNG-6797] Remember if Maven model problems were encountered. (#298)
Additional commits viewable in compare view

Updates org.apache.maven:maven-core from 3.9.16 to 3.10.0

Updates org.apache.maven:maven-artifact from 3.9.16 to 3.10.0

Updates org.apache.maven:maven-compat from 3.9.16 to 3.10.0

Release notes

Sourced from org.apache.maven:maven-compat's releases.

3.10.0

🚀 New features and improvements

Maven 3.10.x should use Maven 3.1 validation in strict mode (#1542) @gnodet

Do not depend on maven-resolver-supplier-mvn3 (#13266) @cstamas

[MNG-6797] - Remember if Maven model problems were encountered. (#298) @wilx

feat: add relativePath validation (#12742) @cstamas

Add validation for Plexus-based plugin dependency injection (#12651) @slawekjaranowski

Introduce validation control (#12549) @cstamas

Update to Resolver 2.0.21 (#12504) @cstamas

[MNG-5913] - Allow defining aliases for existing server configurations in settings.xml (#12475) @slawekjaranowski

🐛 Bug Fixes

Issue #13265: let a settings server declare the repository origins its credentials may be used with (#13275) @slawekjaranowski

Backport #13040: treat reactor BOM imports as ProjectSorter edges so -am includes them (#13263) @gnodet

[MNG-8174] - Fix NPE when a property references itself in a plugin configuration (backport #12932) (#12936) @elharo

Fix #13200: publish a complete set from MavenProject.getArtifacts (#13204) @gnodet

Fixes #13135: ensure completeness of the reactor summary, privilege f… (#13173) @rmannibucau

[3.10.x] Fix #13084: sandbox profile activation context for external model builds (#13114) @gnodet

Fix #13100: honor repositories from legitimately-active external model profiles (#13116) @gnodet

Add support for MAVEN_PROJECTBASEDIR substitution in jvm.config (backport of MNG-8598 to 3.10.x) (#13115) @gnodet

Scope server credentials and validate legacy relocation coordinates (#12954) @slachiewicz

Honour configured policy and validate inputs on the legacy compat paths (#12978) @gnodet

Add unit test for #12600 null-guard in forked executions (#12923) @gnodet

Fix: make ProjectIndex thread-safe for parallel builds (backport #12832) (#12927) @gnodet

Fail on misconfigured plugin-requested toolchains (#12616) @wilx

Resolve classified POM artifacts from the reactor in Maven 3.x (#12659) @wilx

[3.10.x] Convert paths for MSYS2 and jvm.config placeholders in bin/mvn (#12567) @gnodet

Preserve dependency scope in plugin artifacts - fix #12497 (#12503) @slawekjaranowski

📝 Documentation updates

docs: document plugin.xml V4 vs V3 (#13261) @gnodet

[maven-3.10.x] Port the site documentation from APT to Markdown (#12712) @slachiewicz

improve doc about deprecating plugin descriptor's requirement (#12555) @hboutemy

Drop mention of Plexus XML (#12482) @cstamas

👻 Maintenance

[3.10.x] maintenance: Align use of profiles (#13274) @cstamas

Remove version from rat directory deployment (#13046) @slawekjaranowski

Update NOTICE file in distribution packages (#13044) @slawekjaranowski

Restrict what a repository-resolved model contributes to the build (#12953) @slachiewicz

Validate coordinates and repository precedence during artifact resolution (#12952) @slachiewicz

[MNG-8129] - Clarify relativePath validation comment (#12966) @gnodet

[12811] Keep plexus-cipher at 2.0: POM note (#12879) @slachiewicz

[3.10.x] Use try-with-resources (#12845) @slachiewicz

... (truncated)

Commits

c43a36b [maven-release-plugin] prepare release maven-3.10.0
095eb17 Fix wrong links.
bec033e Use staged Maven Resolver 2.0.24
b39f8a7 deps: Update to Maven Resolver 2.0.24 (#13271)
ae59501 Issue #13265: let a settings server declare the repository origins its creden...
6ab2433 [3.10.x] maintenance: Align use of profiles (#13274)
f68413c Do not depend on maven-resolver-supplier-mvn3 (#13266)
3a0026c [Backport maven-3.10.x] Fix #11397: treat reactor BOM imports as ProjectSorte...
82a0f20 docs: document plugin.xml V4 vs V3 [Backport maven-3.10.x]
0fb1c8b [MNG-6797] Remember if Maven model problems were encountered. (#298)
Additional commits viewable in compare view

Updates org.apache.maven:maven-core from 3.9.16 to 3.10.0

Updates org.apache.maven:maven-artifact from 3.9.16 to 3.10.0

Updates org.apache.maven:maven-compat from 3.9.16 to 3.10.0

Release notes

Sourced from org.apache.maven:maven-compat's releases.

3.10.0

🚀 New features and improvements

Maven 3.10.x should use Maven 3.1 validation in strict mode (#1542) @gnodet

Do not depend on maven-resolver-supplier-mvn3 (#13266) @cstamas

[MNG-6797] - Remember if Maven model problems were encountered. (#298) @wilx

feat: add relativePath validation (#12742) @cstamas

Add validation for Plexus-based plugin dependency injection (#12651) @slawekjaranowski

Introduce validation control (#12549) @cstamas

Update to Resolver 2.0.21 (#12504) @cstamas

[MNG-5913] - Allow defining aliases for existing server configurations in settings.xml (#12475) @slawekjaranowski

🐛 Bug Fixes

Issue #13265: let a settings server declare the repository origins its credentials may be used with (#13275) @slawekjaranowski

Backport #13040: treat reactor BOM imports as ProjectSorter edges so -am includes them (#13263) @gnodet

[MNG-8174] - Fix NPE when a property references itself in a plugin configuration (backport #12932) (#12936) @elharo

Fix #13200: publish a complete set from MavenProject.getArtifacts (#13204) @gnodet

Fixes #13135: ensure completeness of the reactor summary, privilege f… (#13173) @rmannibucau

[3.10.x] Fix #13084: sandbox profile activation context for external model builds (#13114) @gnodet

Fix #13100: honor repositories from legitimately-active external model profiles (#13116) @gnodet

Add support for MAVEN_PROJECTBASEDIR substitution in jvm.config (backport of MNG-8598 to 3.10.x) (#13115) @gnodet

Scope server credentials and validate legacy relocation coordinates (#12954) @slachiewicz

Honour configured policy and validate inputs on the legacy compat paths (#12978) @gnodet

Add unit test for #12600 null-guard in forked executions (#12923) @gnodet

Fix: make ProjectIndex thread-safe for parallel builds (backport #12832) (#12927) @gnodet

Fail on misconfigured plugin-requested toolchains (#12616) @wilx

Resolve classified POM artifacts from the reactor in Maven 3.x (#12659) @wilx

[3.10.x] Convert paths for MSYS2 and jvm.config placeholders in bin/mvn (#12567) @gnodet

Preserve dependency scope in plugin artifacts - fix #12497 (#12503) @slawekjaranowski

📝 Documentation updates

docs: document plugin.xml V4 vs V3 (#13261) @gnodet

[maven-3.10.x] Port the site documentation from APT to Markdown (#12712) @slachiewicz

improve doc about deprecating plugin descriptor's requirement (#12555) @hboutemy

Drop mention of Plexus XML (#12482) @cstamas

👻 Maintenance

[3.10.x] maintenance: Align use of profiles (#13274) @cstamas

Remove version from rat directory deployment (#13046) @slawekjaranowski

Update NOTICE file in distribution packages (#13044) @slawekjaranowski

Restrict what a repository-resolved model contributes to the build (#12953) @slachiewicz

Validate coordinates and repository precedence during artifact resolution (

…y with 26 updates Bumps the production-dependencies group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [org.apache:apache](https://github.com/apache/maven-apache-parent) | `39` | `40` | | [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` | | org.apache.ws.xmlschema:xmlschema-core | `2.3.2` | `2.3.3` | | org.apache.neethi:neethi | `3.2.3` | `3.2.4` | | org.slf4j:slf4j-api | `2.0.19` | `2.0.20` | | org.slf4j:jcl-over-slf4j | `2.0.19` | `2.0.20` | | org.slf4j:jcl-over-slf4j | `2.0.19` | `2.0.20` | | [org.apache.httpcomponents.core5:httpcore5](https://github.com/apache/httpcomponents-core) | `5.4.3` | `5.4.4` | | [org.apache.httpcomponents.core5:httpcore5-h2](https://github.com/apache/httpcomponents-core) | `5.4.3` | `5.4.4` | | [org.apache.httpcomponents.core5:httpcore5-h2](https://github.com/apache/httpcomponents-core) | `5.4.3` | `5.4.4` | | [org.xmlunit:xmlunit-legacy](https://github.com/xmlunit/xmlunit) | `2.13.0` | `2.14.0` | | org.apache.xmlbeans:xmlbeans | `5.4.0` | `5.4.1` | | [org.apache.maven:maven-plugin-api](https://github.com/apache/maven) | `3.9.16` | `3.10.0` | | org.apache.maven:maven-core | `3.9.16` | `3.10.0` | | org.apache.maven:maven-artifact | `3.9.16` | `3.10.0` | | [org.apache.maven:maven-compat](https://github.com/apache/maven) | `3.9.16` | `3.10.0` | | org.apache.maven:maven-core | `3.9.16` | `3.10.0` | | org.apache.maven:maven-artifact | `3.9.16` | `3.10.0` | | [org.apache.maven:maven-compat](https://github.com/apache/maven) | `3.9.16` | `3.10.0` | | org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` | | [com.google.guava:guava](https://github.com/google/guava) | `33.7.1-jre` | `33.7.2-jre` | | [com.fasterxml.woodstox:woodstox-core](https://github.com/FasterXML/woodstox) | `7.2.2` | `7.3.0` | | org.eclipse.jetty.ee10:jetty-ee10-webapp | `12.1.13` | `12.1.14` | | org.eclipse.jetty.ee10:jetty-ee10-maven-plugin | `12.1.13` | `12.1.14` | | org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin | `12.1.13` | `12.1.14` | | [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.13` | `1.18.14` | | [org.apache.groovy:groovy](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` | | [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` | | [org.apache.groovy:groovy-xml](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` | | [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` | | [org.apache.groovy:groovy-xml](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` | | org.eclipse.jetty.ee10:jetty-ee10-maven-plugin | `12.1.13` | `12.1.14` | | org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin | `12.1.13` | `12.1.14` | | [org.owasp.encoder:encoder](https://github.com/OWASP/owasp-java-encoder) | `1.4.0` | `1.5.0` | | [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.2` | `2.22.3` | Updates `org.apache:apache` from 39 to 40 - [Release notes](https://github.com/apache/maven-apache-parent/releases) - [Commits](https://github.com/apache/maven-apache-parent/commits) Updates `org.mockito:mockito-core` from 5.23.0 to 5.24.0 - [Release notes](https://github.com/mockito/mockito/releases) - [Commits](mockito/mockito@v5.23.0...v5.24.0) Updates `org.apache.ws.xmlschema:xmlschema-core` from 2.3.2 to 2.3.3 Updates `org.apache.neethi:neethi` from 3.2.3 to 3.2.4 Updates `org.slf4j:slf4j-api` from 2.0.19 to 2.0.20 Updates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20 Updates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20 Updates `org.apache.httpcomponents.core5:httpcore5` from 5.4.3 to 5.4.4 - [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.4/RELEASE_NOTES.txt) - [Commits](apache/httpcomponents-core@rel/v5.4.3...rel/v5.4.4) Updates `org.apache.httpcomponents.core5:httpcore5-h2` from 5.4.3 to 5.4.4 - [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.4/RELEASE_NOTES.txt) - [Commits](apache/httpcomponents-core@rel/v5.4.3...rel/v5.4.4) Updates `org.apache.httpcomponents.core5:httpcore5-h2` from 5.4.3 to 5.4.4 - [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.4/RELEASE_NOTES.txt) - [Commits](apache/httpcomponents-core@rel/v5.4.3...rel/v5.4.4) Updates `org.xmlunit:xmlunit-legacy` from 2.13.0 to 2.14.0 - [Release notes](https://github.com/xmlunit/xmlunit/releases) - [Changelog](https://github.com/xmlunit/xmlunit/blob/main/RELEASE_NOTES.md) - [Commits](xmlunit/xmlunit@v2.13.0...v2.14.0) Updates `org.apache.xmlbeans:xmlbeans` from 5.4.0 to 5.4.1 Updates `org.apache.maven:maven-plugin-api` from 3.9.16 to 3.10.0 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.9.16...maven-3.10.0) Updates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0 Updates `org.apache.maven:maven-artifact` from 3.9.16 to 3.10.0 Updates `org.apache.maven:maven-compat` from 3.9.16 to 3.10.0 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.9.16...maven-3.10.0) Updates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0 Updates `org.apache.maven:maven-artifact` from 3.9.16 to 3.10.0 Updates `org.apache.maven:maven-compat` from 3.9.16 to 3.10.0 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.9.16...maven-3.10.0) Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0 Updates `com.google.guava:guava` from 33.7.1-jre to 33.7.2-jre - [Release notes](https://github.com/google/guava/releases) - [Commits](https://github.com/google/guava/commits) Updates `com.fasterxml.woodstox:woodstox-core` from 7.2.2 to 7.3.0 - [Commits](FasterXML/woodstox@woodstox-core-7.2.2...woodstox-core-7.3.0) Updates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.1.13 to 12.1.14 Updates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.13 to 12.1.14 Updates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.13 to 12.1.14 Updates `net.bytebuddy:byte-buddy` from 1.18.13 to 1.18.14 - [Release notes](https://github.com/raphw/byte-buddy/releases) - [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md) - [Commits](raphw/byte-buddy@byte-buddy-1.18.13...byte-buddy-1.18.14) Updates `org.apache.groovy:groovy` from 5.1.2 to 6.0.0 - [Commits](https://github.com/apache/groovy/commits) Updates `org.apache.groovy:groovy-ant` from 5.1.2 to 6.0.0 - [Commits](https://github.com/apache/groovy/commits) Updates `org.apache.groovy:groovy-xml` from 5.1.2 to 6.0.0 - [Commits](https://github.com/apache/groovy/commits) Updates `org.apache.groovy:groovy-ant` from 5.1.2 to 6.0.0 - [Commits](https://github.com/apache/groovy/commits) Updates `org.apache.groovy:groovy-xml` from 5.1.2 to 6.0.0 - [Commits](https://github.com/apache/groovy/commits) Updates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.13 to 12.1.14 Updates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.13 to 12.1.14 Updates `org.owasp.encoder:encoder` from 1.4.0 to 1.5.0 - [Release notes](https://github.com/OWASP/owasp-java-encoder/releases) - [Changelog](https://github.com/OWASP/owasp-java-encoder/blob/main/CHANGELOG.md) - [Commits](OWASP/owasp-java-encoder@v1.4.0...v1.5.0) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.2 to 2.22.3 - [Commits](FasterXML/jackson-databind@jackson-databind-2.22.2...jackson-databind-2.22.3) --- updated-dependencies: - dependency-name: org.apache:apache dependency-version: '40' dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: org.mockito:mockito-core dependency-version: 5.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.ws.xmlschema:xmlschema-core dependency-version: 2.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.apache.neethi:neethi dependency-version: 3.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.slf4j:slf4j-api dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.slf4j:jcl-over-slf4j dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.slf4j:jcl-over-slf4j dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.apache.httpcomponents.core5:httpcore5 dependency-version: 5.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.apache.httpcomponents.core5:httpcore5-h2 dependency-version: 5.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.apache.httpcomponents.core5:httpcore5-h2 dependency-version: 5.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.xmlunit:xmlunit-legacy dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.xmlbeans:xmlbeans dependency-version: 5.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.apache.maven:maven-plugin-api dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.maven:maven-core dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.maven:maven-artifact dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.maven:maven-compat dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.maven:maven-core dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.maven:maven-artifact dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.maven:maven-compat dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.apache.commons:commons-lang3 dependency-version: 3.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: com.google.guava:guava dependency-version: 33.7.2-jre dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: com.fasterxml.woodstox:woodstox-core dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp dependency-version: 12.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin dependency-version: 12.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin dependency-version: 12.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: net.bytebuddy:byte-buddy dependency-version: 1.18.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.apache.groovy:groovy dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: org.apache.groovy:groovy-ant dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: org.apache.groovy:groovy-xml dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: org.apache.groovy:groovy-ant dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: org.apache.groovy:groovy-xml dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin dependency-version: 12.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin dependency-version: 12.1.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: org.owasp.encoder:encoder dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 8, 2026

cortlepp merged commit ac5fa0f into master Oct 9, 2026
5 checks passed

dependabot Bot deleted the dependabot/maven/production-dependencies-f793d7056e branch October 9, 2026 07:27

Navigation Menu

Repository navigation

build(deps): bump the production-dependencies group across 1 directory with 26 updates - #1306

build(deps): bump the production-dependencies group across 1 directory with 26 updates#1306
cortlepp merged 1 commit into
masterfrom
dependabot/maven/production-dependencies-f793d7056e

dependabot Bot commented on behalf of github Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 8, 2026

40

💥 Breaking changes

🚀 New features and improvements

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

v5.24.0

5.24.0

Release 5.4.4

Change Log

Release 5.4.4

Change Log

Release 5.4.4

Change Log

XMLUnit for Java 2.14.0

XMLUnit for Java 2.14.0 - /Released 2026-09-18/

3.10.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

3.10.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

3.10.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant