[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
maven (source)	3.9.15 → 3.10.0

---

Release Notes

apache/maven (maven)

v3.10.0: 3.10.0

Compare Source

🚀 New features and improvements

• Maven 3.10.x should use Maven 3.1 validation in strict mode (#​1542) @​gnodet
• Do not depend on maven-resolver-supplier-mvn3 (#​13266) @​cstamas
• [MNG-6797] - Remember if Maven model problems were encountered. (#​298) @​wilx
• feat: add relativePath validation (#​12742) @​cstamas
• Add validation for Plexus-based plugin dependency injection (#​12651) @​slawekjaranowski
• Introduce validation control (#​12549) @​cstamas
• Update to Resolver 2.0.21 (#​12504) @​cstamas
• [MNG-5913] - Allow defining aliases for existing server configurations in settings.xml (#​12475) @​slawekjaranowski

🐛 Bug Fixes

• Issue #​13265: let a settings server declare the repository origins its credentials may be used with (#​13275) @​slawekjaranowski
• Backport #​13040: treat reactor BOM imports as ProjectSorter edges so -am includes them (#​13263) @​gnodet
• [MNG-8174] - Fix NPE when a property references itself in a plugin configuration (backport #​12932) (#​12936) @​elharo
• Fix #​13200: publish a complete set from MavenProject.getArtifacts (#​13204) @​gnodet
• Fixes #​13135: ensure completeness of the reactor summary, privilege f… (#​13173) @​rmannibucau
• [3.10.x] Fix #​13084: sandbox profile activation context for external model builds (#​13114) @​gnodet
• Fix #​13100: honor repositories from legitimately-active external model profiles (#​13116) @​gnodet
• Add support for MAVEN_PROJECTBASEDIR substitution in jvm.config (backport of MNG-8598 to 3.10.x) (#​13115) @​gnodet
• Scope server credentials and validate legacy relocation coordinates (#​12954) @​slachiewicz
• Honour configured policy and validate inputs on the legacy compat paths (#​12978) @​gnodet
• Add unit test for #​12600 null-guard in forked executions (#​12923) @​gnodet
• Fix: make ProjectIndex thread-safe for parallel builds (backport #​12832) (#​12927) @​gnodet
• Fail on misconfigured plugin-requested toolchains (#​12616) @​wilx
• Resolve classified POM artifacts from the reactor in Maven 3.x (#​12659) @​wilx
• [3.10.x] Convert paths for MSYS2 and jvm.config placeholders in bin/mvn (#​12567) @​gnodet
• Preserve dependency scope in plugin artifacts - fix #​12497 (#​12503) @​slawekjaranowski

📝 Documentation updates

• docs: document plugin.xml V4 vs V3 (#​13261) @​gnodet
• [maven-3.10.x] Port the site documentation from APT to Markdown (#​12712) @​slachiewicz
• improve doc about deprecating plugin descriptor's requirement (#​12555) @​hboutemy
• Drop mention of Plexus XML (#​12482) @​cstamas

👻 Maintenance

• [3.10.x] maintenance: Align use of profiles (#​13274) @​cstamas
• Remove version from rat directory deployment (#​13046) @​slawekjaranowski
• Update NOTICE file in distribution packages (#​13044) @​slawekjaranowski
• Restrict what a repository-resolved model contributes to the build (#​12953) @​slachiewicz
• Validate coordinates and repository precedence during artifact resolution (#​12952) @​slachiewicz
• [MNG-8129] - Clarify relativePath validation comment (#​12966) @​gnodet
• [12811] Keep plexus-cipher at 2.0: POM note (#​12879) @​slachiewicz
• [3.10.x] Use try-with-resources (#​12845) @​slachiewicz
• Migrate the embedder-test-project fixture to JUnit 5 (#​12717) @​slachiewicz
• [maven-3.10.x] Port the site documentation from APT to Markdown (#​12712) @​slachiewicz
• Migrate legacy plugin Javadoc annotations in Maven Embedder tests (#​12708) @​wilx
• Replace custom GraphLogger with DependencyGraphDumper in dependency resolution (#​12639) @​slawekjaranowski
• Fix UT: do not use checkout directly (#​12483) @​cstamas

🔧 Build

• Replace nicoulaj checksum plugin with maveniverse checksum plugin (#​13053) @​slawekjaranowski
• 3.10.x Build by JDK 25, limit JDK to min and max LTS in build (#​12848) @​slawekjaranowski
• Update Maven version to 3.10.0-rc-1 in GH configuration (#​12847) @​slawekjaranowski

📦 Dependency updates

• [3.10.x] deps: Update to Maven Resolver 2.0.24 (#​13271) @​cstamas
• build: bump xmlunitVersion from 2.13.0 to 2.14.0 (#​13237) @​dependabot[bot]
• build: bump org.apache.maven:maven-parent from 49 to 50 (#​13242) @​dependabot[bot]
• Resolver 2.0.23 and validation cleanup (#​13078) @​cstamas
• Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#​13134) @​dependabot[bot]
• Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.3.0 to 3.3.1 (#​13132) @​dependabot[bot]
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 (#​13130) @​dependabot[bot]
• Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.27 to 1.28 (#​13129) @​dependabot[bot]
• Bump actions/setup-java from 6.0.0 to 6.0.1 (#​13110) @​dependabot[bot]
• Bump jlineVersion from 3.30.16 to 3.30.17 (#​13111) @​dependabot[bot]
• Bump slf4jVersion from 2.0.18 to 2.0.19 (#​13074) @​dependabot[bot]
• Bump org.codehaus.modello:modello-maven-plugin from 2.8.0 to 2.8.1 (#​13028) @​dependabot[bot]
• [12811] Keep plexus-cipher at 2.0: POM note (#​12879) @​slachiewicz
• Bump actions/setup-java from 5.7.0 to 6.0.0 (#​12860) @​dependabot[bot]
• Deps: Bump to Resolver 2.0.22 (#​12803) @​cstamas
• Bump resolverVersion from 2.0.21 to 2.0.22 (#​12823) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0 (#​12825) @​dependabot[bot]
• Bump com.google.guava:guava from 33.7.0-jre to 33.7.1-jre (#​12796) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (#​12795) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-testing from 2.1.0 to 2.2.0 (#​12794) @​dependabot[bot]
• Bump org.codehaus.modello:modello-maven-plugin from 2.7.0 to 2.8.0 (#​12793) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-classworlds from 2.12.0 to 2.12.1 (#​12792) @​dependabot[bot]
• Bump com.google.guava:guava from 33.6.0-jre to 33.7.0-jre (#​12776) @​dependabot[bot]
• Bump xmlunitVersion from 2.12.0 to 2.13.0 (#​12673) @​dependabot[bot]
• Bump actions/setup-java from 5.6.0 to 5.7.0 (#​12666) @​dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#​12496) @​dependabot[bot]
• Deps: Bump to Eclipse Sisu 1.1.0 (#​12547) @​cstamas
• Bump resolverVersion from 2.0.21-SNAPSHOT to 2.0.21 (#​12545) @​dependabot[bot]
• Bump jlineVersion from 3.30.15 to 3.30.16 (#​12518) @​dependabot[bot]
• Bump actions/checkout from 7.0.0 to 7.0.1 (#​12514) @​dependabot[bot]
• Update to Resolver 2.0.21 (#​12504) @​cstamas
• Bump actions/setup-java from 5.5.0 to 5.6.0 (#​12501) @​dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (#​12495) @​dependabot[bot]
• Bump actions/setup-java from 5.4.0 to 5.5.0 (#​12439) @​dependabot[bot]

v3.9.16: 3.9.16

Compare Source

🐛 Bug Fixes

• Trim threadConfiguration to accept input surrounded with spaces (#​12042) @​slawekjaranowski
• Backport: Maven 3.10.x fixed plugin resolution (#​12022) @​cstamas

📦 Dependency updates

• Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to 2.11.0 (#​12039) @​dependabot[bot]
• [3.9.x] Bump to parent POM 48 (#​12024) @​cstamas
• Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#​11980) @​dependabot[bot]
• Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#​11951) @​dependabot[bot]
• Bump actions/cache from 5.0.4 to 5.0.5 (#​11943) @​dependabot[bot]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[WtfJoke]

Wait for fix of sonatype-nexus-community/central-publishing-maven-plugin#10

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (3.10.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.