SUSE-CU-2026:14000-1: Security update of bci/openjdk-devel
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Thu Nov 12 09:52:56 UTC 2026
SUSE Container Update Advisory: bci/openjdk-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14000-1
Container Tags : bci/openjdk-devel:25 , bci/openjdk-devel:25-sles15 , bci/openjdk-devel:25.0.4.1 , bci/openjdk-devel:25.0.4.1-9.97 , bci/openjdk-devel:latest
Container Release : 9.97
Severity : important
Type : security
References : 1180125 1183374 1183858 1185588 1186819 1187338 1187668 1188607
1189241 1189287 1189659 1190566 1192249 1193179 1198511 1202624
1203125 1203355 1203750 1204577 1205244 1208443 1208471 1210638
1211158 1214691 1214692 1219559 1219666 1220664 1221563 1221854
1222075 1222109 1226447 1226448 1227233 1227378 1227999 1228780
1229596 1230227 1230906 1231795 1232241 1233012 1233307 1233307
1236705 1243273 1244032 1244056 1244059 1244060 1244061 1244401
1244705 1246697 1247249 1250232 1250782 1250782 1251305 1252974
1254400 1254401 1254997 1256834 1256835 1256836 1256837 1256838
1256839 1256840 1257029 1257031 1257041 1257042 1257044 1257046
1257181 1257599 1259611 1259734 1259735 1259735 1259989 1259989
1260026 1260441 1260442 1260443 1260444 1261678 1261969 1261970
1261970 1262098 1262319 1262467 1262654 1263083 1263443 1264962
1265268 1266340 1266341 1266342 1266349 1266357 1266669 1266783
1267581 1267821 1267974 1268977 1269021 1269066 1269222 1269788
1269959 1270083 1271192 1271712 1273091 1273148 1274683 1274774
1274788 1274795 1276223 1276226 1276227 1276903 1277111 1277271
1280459 1280587 1280589 1280591 1280597 1280598 1284020 1284124
831629 CVE-2007-4559 CVE-2015-20107 CVE-2019-18348 CVE-2020-10735
CVE-2020-8492 CVE-2021-28861 CVE-2021-3426 CVE-2021-3572 CVE-2021-3733
CVE-2021-3737 CVE-2022-37454 CVE-2022-45061 CVE-2022-48566 CVE-2023-24329
CVE-2023-27043 CVE-2023-40217 CVE-2023-52425 CVE-2023-6597 CVE-2024-0397
CVE-2024-0450 CVE-2024-11168 CVE-2024-11168 CVE-2024-12718 CVE-2024-12798
CVE-2024-12801 CVE-2024-4032 CVE-2024-5642 CVE-2024-6232 CVE-2024-6923
CVE-2024-7592 CVE-2024-9287 CVE-2025-0938 CVE-2025-11226 CVE-2025-11468
CVE-2025-12084 CVE-2025-13462 CVE-2025-13836 CVE-2025-13837 CVE-2025-15282
CVE-2025-15366 CVE-2025-15367 CVE-2025-4138 CVE-2025-4330 CVE-2025-4435
CVE-2025-4516 CVE-2025-4517 CVE-2025-6069 CVE-2025-6075 CVE-2025-68160
CVE-2025-69418 CVE-2025-69419 CVE-2025-69420 CVE-2025-69421 CVE-2025-8194
CVE-2025-8291 CVE-2025-9230 CVE-2026-0672 CVE-2026-0864 CVE-2026-0865
CVE-2026-104721 CVE-2026-10532 CVE-2026-11940 CVE-2026-11972
CVE-2026-1225 CVE-2026-1299 CVE-2026-13006 CVE-2026-13346 CVE-2026-1502
CVE-2026-15308 CVE-2026-15310 CVE-2026-15806 CVE-2026-1703 CVE-2026-17084
CVE-2026-18503 CVE-2026-19672 CVE-2026-19880 CVE-2026-22795 CVE-2026-22796
CVE-2026-28387 CVE-2026-28388 CVE-2026-28389 CVE-2026-28390 CVE-2026-31789
CVE-2026-3219 CVE-2026-3276 CVE-2026-34180 CVE-2026-3446 CVE-2026-3446
CVE-2026-3479 CVE-2026-3479 CVE-2026-35189 CVE-2026-3644 CVE-2026-4224
CVE-2026-4224 CVE-2026-42766 CVE-2026-4360 CVE-2026-4519 CVE-2026-45447
CVE-2026-4786 CVE-2026-54872 CVE-2026-54874 CVE-2026-56740 CVE-2026-56741
CVE-2026-6019 CVE-2026-6019 CVE-2026-6100 CVE-2026-63072 CVE-2026-6357
CVE-2026-6879 CVE-2026-7210 CVE-2026-7383 CVE-2026-75806 CVE-2026-77696
CVE-2026-7774 CVE-2026-82049 CVE-2026-8328 CVE-2026-84782 CVE-2026-8643
CVE-2026-9076 CVE-2026-9669 CVE-2026-9828
-----------------------------------------------------------------
The container bci/openjdk-devel was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2021:2997-1
Released: Thu Sep 9 14:37:34 2021
Summary: Recommended update for python3
Type: recommended
Severity: moderate
References: 1187338,1189659
This update for python3 fixes the following issues:
- Fixed an issue when the missing 'stropts.h' causing build errors for different python modules. (bsc#1187338)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:4104-1
Released: Thu Dec 16 11:14:12 2021
Summary: Security update for python3
Type: security
Severity: moderate
References: 1180125,1183374,1183858,1185588,1187668,1189241,1189287,CVE-2021-3426,CVE-2021-3733,CVE-2021-3737
This update for python3 fixes the following issues:
- CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374).
- CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server (bsc#1189241).
- CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287).
- We do not require python-rpm-macros package (bsc#1180125).
- Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858).
- Stop providing 'python' symbol, which means python2 currently (bsc#1185588).
- Modify Lib/ensurepip/__init__.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:48-1
Released: Tue Jan 11 09:17:57 2022
Summary: Recommended update for python3
Type: recommended
Severity: moderate
References: 1190566,1192249,1193179
This update for python3 fixes the following issues:
- Don't use OpenSSL 1.1 on platforms which don't have it.
- Remove shebangs from python-base libraries in '_libdir'. (bsc#1193179, bsc#1192249).
- Build against 'openssl 1.1' as it is incompatible with 'openssl 3.0+' (bsc#1190566)
- Fix for permission error when changing the mtime of the source file in presence of 'SOURCE_DATE_EPOCH'.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:942-1
Released: Thu Mar 24 10:30:15 2022
Summary: Security update for python3
Type: security
Severity: moderate
References: 1186819,CVE-2021-3572
This update for python3 fixes the following issues:
- CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2357-1
Released: Mon Jul 11 20:34:20 2022
Summary: Security update for python3
Type: security
Severity: important
References: 1198511,CVE-2015-20107
This update for python3 fixes the following issues:
- CVE-2015-20107: avoid command injection in the mailcap module (bsc#1198511).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:3544-1
Released: Thu Oct 6 13:48:42 2022
Summary: Security update for python3
Type: security
Severity: important
References: 1202624,CVE-2021-28861
This update for python3 fixes the following issues:
- CVE-2021-28861: Fixed an open redirection vulnerability in the HTTP server when an URI path starts with // (bsc#1202624).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:4281-1
Released: Tue Nov 29 15:46:10 2022
Summary: Security update for python3
Type: security
Severity: important
References: 1188607,1203125,1204577,CVE-2019-18348,CVE-2020-10735,CVE-2020-8492,CVE-2022-37454
This update for python3 fixes the following issues:
- CVE-2022-37454: Fixed a buffer overflow in hashlib.sha3_* implementations. (bsc#1204577)
- CVE-2020-10735: Fixed a bug to limit amount of digits converting text to int and vice vera. (bsc#1203125)
The following non-security bug was fixed:
- Fixed a crash in the garbage collection (bsc#1188607).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:549-1
Released: Mon Feb 27 17:35:07 2023
Summary: Security update for python3
Type: security
Severity: moderate
References: 1205244,1208443,CVE-2022-45061
This update for python3 fixes the following issues:
- CVE-2022-45061: Fixed DoS when IDNA decodes extremely long domain names (bsc#1205244).
Bugfixes:
- Fixed issue where email.generator.py replaces a non-existent header (bsc#1208443).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:868-1
Released: Wed Mar 22 09:41:01 2023
Summary: Security update for python3
Type: security
Severity: important
References: 1203355,1208471,CVE-2023-24329
This update for python3 fixes the following issues:
- CVE-2023-24329: Fixed a blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471).
The following non-security bug was fixed:
- Eliminate unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2517-1
Released: Thu Jun 15 07:09:52 2023
Summary: Security update for python3
Type: security
Severity: moderate
References: 1203750,1211158,CVE-2007-4559
This update for python3 fixes the following issues:
- CVE-2007-4559: Fixed filter for tarfile.extractall (bsc#1203750).
- Fixed unittest.mock.patch.dict returns function when applied to coroutines (bsc#1211158).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3828-1
Released: Wed Sep 27 19:07:38 2023
Summary: Security update for python3
Type: security
Severity: important
References: 1214692,CVE-2023-40217
This update for python3 fixes the following issues:
- CVE-2023-40217: Fixed TLS handshake bypass on closed sockets (bsc#1214692).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:581-1
Released: Wed Feb 21 14:08:16 2024
Summary: Security update for python3
Type: security
Severity: moderate
References: 1210638,CVE-2023-27043
This update for python3 fixes the following issues:
- CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character (bsc#1210638).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:901-1
Released: Thu Mar 14 17:49:10 2024
Summary: Security update for python3
Type: security
Severity: important
References: 1214691,1219666,CVE-2022-48566,CVE-2023-6597
This update for python3 fixes the following issues:
- CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666).
- CVE-2022-48566: Make compare_digest more constant-time (bsc#1214691).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:1279-1
Released: Fri Apr 12 21:35:09 2024
Summary: Recommended update for python3
Type: recommended
Severity: moderate
References: 1222109
This update for python3 fixes the following issue:
- Fix syslog making default 'ident' from sys.argv (bsc#1222109)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:2479-1
Released: Mon Jul 15 10:33:22 2024
Summary: Security update for python3
Type: security
Severity: important
References: 1219559,1220664,1221563,1221854,1222075,1226447,1226448,CVE-2023-52425,CVE-2024-0397,CVE-2024-0450,CVE-2024-4032
This update for python3 fixes the following issues:
- CVE-2023-52425: Fixed backport so it uses features sniffing, not just comparing version number (bsc#1219559).
- CVE-2024-0450: Fixed detecting the vulnerability of 'quoted-overlap' zipbomb (bsc#1221854).
- CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448)
- CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:3470-1
Released: Fri Sep 27 14:34:46 2024
Summary: Security update for python3
Type: security
Severity: important
References: 1227233,1227378,1227999,1228780,1229596,1230227,CVE-2024-5642,CVE-2024-6232,CVE-2024-6923,CVE-2024-7592
This update for python3 fixes the following issues:
- CVE-2024-6923: Fixed uncontrolled CPU resource consumption when in http.cookies module (bsc#1228780).
- CVE-2024-5642: Fixed buffer overread when NPN is used and invalid values are sent to the OpenSSL API (bsc#1227233).
- CVE-2024-7592: Fixed Email header injection due to unquoted newlines (bsc#1229596).
- CVE-2024-6232: excessive backtracking when parsing tarfile headers leads to ReDoS. (bsc#1230227)
Bug fixes:
- %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999).
- Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378).
- Remove %suse_update_desktop_file macro as it is not useful any more.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:3879-1
Released: Fri Nov 1 17:04:25 2024
Summary: Security update for python3
Type: security
Severity: moderate
References: 1230906,1232241,CVE-2024-9287
This update for python3 fixes the following issues:
Security fixes:
- CVE-2024-9287: properly quote path names provided when creating a virtual environment (bsc#1232241)
Other fixes:
- Drop .pyc files from docdir for reproducible builds (bsc#1230906)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:4185-1
Released: Thu Dec 5 06:54:31 2024
Summary: Recommended update for picocli
Type: recommended
Severity: moderate
References:
This update for picocli fixes the following issues:
picocli was updated from version 4.7.5 to 4.7.6:
- Improved property loading and logging.
- Fixed bugs related to default values, null pointer exceptions, optional arguments, mixins, and custom type converters.
- Clarified documentation for negatable options and exception handling.
- The binaries are compatible with java 1.8
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:4193-1
Released: Thu Dec 5 12:01:40 2024
Summary: Security update for python3
Type: security
Severity: low
References: 1231795,1233307,CVE-2024-11168
This update for python3 fixes the following issues:
- CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307)
Other fixes:
- Remove -IVendor/ from python-config (bsc#1231795)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:554-1
Released: Fri Feb 14 16:10:40 2025
Summary: Security update for python3
Type: security
Severity: moderate
References: 1236705,CVE-2025-0938
This update for python3 fixes the following issues:
- CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse. (bsc#1236705)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:1056-1
Released: Fri Mar 28 18:06:22 2025
Summary: Security update for python3
Type: security
Severity: moderate
References: 1233307,CVE-2024-11168
This update for python3 fixes the following issues:
- CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:2778-1
Released: Wed Aug 13 08:45:57 2025
Summary: Security update for python3
Type: security
Severity: important
References: 1233012,1243273,1244032,1244056,1244059,1244060,1244061,1244401,1244705,1247249,831629,CVE-2024-12718,CVE-2025-4138,CVE-2025-4330,CVE-2025-4435,CVE-2025-4516,CVE-2025-4517,CVE-2025-6069,CVE-2025-8194
This update for python3 fixes the following issues:
- CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
- CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside extraction directory (bsc#1244056)
- CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory, and the modification of some file metadata (bsc#1244059)
- CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory (bsc#1244060)
- CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061)
- CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction with filter='data' (bsc#1244032)
- CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser (bsc#1244705)
- CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249)
Other fixes:
- Limit buffer size for IPv6 address parsing (bsc#1244401).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2025:2890-1
Released: Tue Aug 19 09:54:32 2025
Summary: Recommended update for openssl-1_1
Type: recommended
Severity: moderate
References: 1246697
This update for openssl-1_1 fixes the following issues:
- FIPS: Use the NID_X9_62_prime256v1 curve in ECDSA KAT test
instead of NID_secp256k1. [bsc#1246697]
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:3635-1
Released: Fri Oct 17 16:33:06 2025
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1250232,CVE-2025-9230
This update for openssl-1_1 fixes the following issues:
- CVE-2025-9230: fixed out of bounds read and write in RFC 3211 KEK unwrap (bsc#1250232)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:4368-1
Released: Thu Dec 11 16:12:16 2025
Summary: Security update for python3
Type: security
Severity: low
References: 1251305,1252974,CVE-2025-6075,CVE-2025-8291
This update for python3 fixes the following issues:
- CVE-2025-6075: quadratic complexity in `os.path.expandvars()` can lead to performance degradation when values passed
to it are user-controlled (bsc#1252974).
- CVE-2025-8291: lack of validity checks on the ZIP64 End of Central Directory (EOCD) record allows for the creation of
ZIP archives that are processed inconsistently by the `zipfile` module (bsc#1251305).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:27-1
Released: Mon Jan 5 13:45:08 2026
Summary: Security update for python3
Type: security
Severity: moderate
References: 1254400,1254401,1254997,CVE-2025-12084,CVE-2025-13836,CVE-2025-13837
This update for python3 fixes the following issues:
- CVE-2025-12084: cpython: Fixed quadratic algorithm in xml.dom.minidom leading to denial of service (bsc#1254997)
- CVE-2025-13836: Fixed default Content-Lenght read amount from HTTP response (bsc#1254400)
- CVE-2025-13837: Fixed plistlib module denial of service (bsc#1254401)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:331-1
Released: Wed Jan 28 18:12:49 2026
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1256834,1256835,1256836,1256837,1256838,1256839,1256840,CVE-2025-68160,CVE-2025-69418,CVE-2025-69419,CVE-2025-69420,CVE-2025-69421,CVE-2026-22795,CVE-2026-22796
This update for openssl-1_1 fixes the following issues:
- CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
- CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
- CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
- CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).
- CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
- CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
- CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:664-1
Released: Thu Feb 26 16:15:04 2026
Summary: Security update for python3
Type: security
Severity: important
References: 1257029,1257031,1257041,1257042,1257044,1257046,CVE-2025-11468,CVE-2025-15282,CVE-2025-15366,CVE-2025-15367,CVE-2026-0672,CVE-2026-0865
This update for python3 fixes the following issues:
- CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable
characters (bsc#1257029).
- CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel
(bsc#1257031).
- CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
- CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1090-1
Released: Thu Mar 26 18:44:54 2026
Summary: Security update for python3
Type: security
Severity: important
References: 1257181,CVE-2026-1299
This update for python3 fixes the following issues:
- CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1386-1
Released: Thu Apr 16 11:17:06 2026
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1260441,1260442,1260443,1260444,1261678,CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390,CVE-2026-31789
This update for openssl-1_1 fixes the following issues:
- CVE-2026-28387: Potential use-after-free in DANE client code (bsc#1260441).
- CVE-2026-28388: NULL Pointer Dereference When Processing a Delta CRL (bsc#1260442).
- CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).
- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with
KeyTransportRecipientInfo (bsc#1261678).
- CVE-2026-31789: Heap buffer overflow in hexadecimal conversion (bsc#1260444).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1715-1
Released: Wed May 6 14:09:30 2026
Summary: Security update for python3
Type: security
Severity: important
References: 1259611,1259734,1259735,1259989,1260026,1261969,1261970,1262098,1262319,1262654,CVE-2025-13462,CVE-2026-1502,CVE-2026-3446,CVE-2026-3479,CVE-2026-3644,CVE-2026-4224,CVE-2026-4519,CVE-2026-4786,CVE-2026-6019,CVE-2026-6100
This update for python3 fixes the following issues:
- CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to
misinterpretation of tar archives (bsc#1259611).
- CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF (bsc#1261969).
- CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be
processed (bsc#1261970).
- CVE-2026-3479: improper resource argument validation in `pkgutil.get_data()` can lead to path traversal (bsc#1259989).
- CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass
(bsc#1259734).
- CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
- CVE-2026-4519: failure to sanitize leading dashes in URLs in the `webbrowser.open()` API can lead to web browser
command line option injection (bsc#1260026).
- CVE-2026-4786: URLs prefixed with `%action` can pass the dash-prefix safety check and allow for command injection
(bsc#1262319).
- CVE-2026-6019: `BaseCookie.js_output()` does not neutralize characters in cookie values embedded in JS (bsc#1262654).
- CVE-2026-6100: use-after-free in `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when process is
under memory pressure(bsc#1262098).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:2041-1
Released: Thu May 21 16:29:18 2026
Summary: Recommended update for openssl-1_1
Type: recommended
Severity: moderate
References: 1250782
This update for openssl-1_1 fixes the following issues:
- Fix 30-test_fips_sli.t fails intermittently on s390x (bsc#1250782):
* Fix AES_GCM IV test sometimes failing on s390x.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2392-1
Released: Mon Jun 15 10:05:31 2026
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1250782,1266340,1266341,1266342,1266349,1266357,CVE-2026-34180,CVE-2026-42766,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076
This update for openssl-1_1 fixes the following issues
- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3183-1
Released: Wed Jul 22 09:26:04 2026
Summary: Security update for jline3
Type: security
Severity: important
References: 1269021,1270083,CVE-2026-56740,CVE-2026-56741
This update for jline3 fixes the following issues:
Update to upstream version 3.30.15.
- CVE-2026-56741: missing upper bound validation of terminal dimensions received via the Telnet NAWS option allows an
unauthenticated remote attacker to cause CPU exhaustion and a Telnet server DoS (bsc#1270083).
- CVE-2026-56740: no limit set for environment variables a client may inject via the Telnet NEW-ENVIRON option allows
an unauthenticated attacker to cause JVM heap memory exhaustion and a Telnet server DoS (bsc#1269021).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3578-1
Released: Tue Aug 11 15:58:41 2026
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1271712
This update for openssl-1_1 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4041-1
Released: Mon Sep 7 10:29:44 2026
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1274774,1274788,1274795,CVE-2026-54874,CVE-2026-63072
This update for openssl-1_1 fixes the following issues:
August 2026 release.
- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4684-1
Released: Thu Oct 15 14:36:53 2026
Summary: Security update for jline3
Type: security
Severity: low
References:
This update for jline3 fixes the following issue:
- Update to version 3.30.17:
+ Native Stack Buffer Overflow in Public INPUT_RECORD.memmove
JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6)
+ Authenticated SSH Shell Channel Resource Leak via Null or
Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj)
+ Authenticated SSH DoS via Unbounded Window-Change Terminal
Geometry (GHSA-m935-wqpj-pvp3)
+ TCP Socket File Descriptor Leak When Maximum Connections
Reached (GHSA-c87g-867h-cqr6)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4754-1
Released: Tue Oct 20 12:50:53 2026
Summary: Security update for python3
Type: security
Severity: important
References: 1257599,1259735,1259989,1261970,1262467,1263083,1263443,1264962,1265268,1266669,1267581,1267821,1267974,1268977,1269066,1269788,1269959,1271192,1273091,1273148,1274683,1276223,1276226,1276227,1276903,1277111,1277271,1280459,CVE-2026-0864,CVE-2026-11940,CVE-2026-11972,CVE-2026-13346,CVE-2026-15308,CVE-2026-15310,CVE-2026-15806,CVE-2026-1703,CVE-2026-17084,CVE-2026-18503,CVE-2026-19672,CVE-2026-3219,CVE-2026-3276,CVE-2026-3446,CVE-2026-3479,CVE-2026-4224,CVE-2026-4360,CVE-2026-6019,CVE-2026-6357,CVE-2026-6879,CVE-2026-7210,CVE-2026-7774,CVE-2026-82049,CVE-2026-8328,CVE-2026-8643,CVE-2026-9669
This update for python3 fixes the following issues:
Security issues fixed:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously
crafted wheel archives (bsc#1257599 bsc#1274743).
- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429 bsc#1262467).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
- CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970).
- CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989).
- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
hardlinks (bsc#1269959).
- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442
bsc#1263443).
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
CPU usage (bsc#1273148).
- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding
protection (bsc#1264962).
- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory
(bsc#1267821).
- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
(bsc#1266669).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS
(bsc#1269788).
- CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations
(bsc#1271192).
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect
sniffing and consume significant CPU (bsc#1274683).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file
modification and content disclosure (bsc#1280459).
Non security issue fixed:
- Fix an error that returned non-zero exit status 1 (bsc#1277271).
- Fix regression in `http.cookies` (bsc#1263083).
- Update bundled pip wheels to pip-20.0.2-py2.py3-none-any.whl.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5172-1
Released: Tue Nov 10 16:21:36 2026
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1280587,1280589,1280591,1280597,1280598,CVE-2026-35189,CVE-2026-54872,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782
This update for openssl-1_1 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5189-1
Released: Wed Nov 11 08:40:52 2026
Summary: Security update for apache-parent, aqute-bnd, google-gson, logback, maven, maven-artifact-transfer, maven-parent, maven-resolver, methanol, osgi-service-subsystem, slf4j, xmvn
Type: security
Severity: important
References: 1266783,1269222,1284020,1284124,CVE-2024-12798,CVE-2024-12801,CVE-2025-11226,CVE-2026-104721,CVE-2026-10532,CVE-2026-1225,CVE-2026-13006,CVE-2026-19880,CVE-2026-9828
This update for apache-parent, aqute-bnd, google-gson, logback, maven, maven-artifact-transfer, maven-parent, maven-resolver, methanol, osgi-service-subsystem, slf4j, xmvn fixes the following issues:
apache-parent was updated to 40:
* Breaking changes
+ Replace nicoulaj checksum plugin with maveniverse checksum
plugin
+ #586: Use RAT0.18 and remove commons-lang3 configuration for
JDK25
+ Property version.maven-surefire was removed in #588, should be
replaced by version.maven-surefire-plugin,
version.maven-failsafe-plugin or
version.maven-surefire-report-plugin
* New features and improvements
+ Fix several version property issues
* Documentation updates
+ Update documentation for push-to-atr profile
+ Restore the common wording on the download page
* Maintenance
+ Add local maven configuration for ATR project name override
+ Remove custom name-template for release-drafter
+ Port the site documentation from APT to Markdown
Update to 39:
* New features and improvements
+ add push-to-atr profile
Update to 38:
* Maintenance
+ Update banner links
Update to 37:
* New features and improvements
+ Disable parallel PUT on release
Update to 36:
* Breaking changes
+ Update minimum maven version to match current stable version
(3.6.3 -> 3.9)
+ Introduce javaVersion property for maven.compiler.*
configuration
+ Switch JDK >= 9 to only use maven.compiler.release
* New features and improvements
+ Add default specification and implementation for javadoc and
source manifest entries
* Documentation updates
+ Clarify how to use Apache Snapshot repository
+ activate Fluido skin's anchorJs
* Maintenance
+ Avoid - WARNING: Use of the three-letter time zone ID ... on
JDK 25 for RAT plugin
+ feat: enable prevent branch protection rules
- Port to slf4j 2.x
- Add dependency on osgi-service-subsystem to allow upgrade to
osgi-compendium 8.0.0
Update to aqute-bnd 6.4.1
* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.0
* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.1-classic
- Initial packaging of the bnd-maven-plugin distributed as a part
of aqute-bnd 3.5.0
- Port to slf4j 2.x
- Add dependency on osgi-service-subsystem to allow upgrade to
osgi-compendium 8.0.0
Update to aqute-bnd 6.4.1
* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.0
* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.1-classic
- Initial packaging of aqute-bnd 3.5.0
Upgrade to version 2.14.0
* Support for serializing and deserializing Java records
* Add JsonArray.asList and JsonObject.asMap view methods
* Add Gson.fromJson(..., TypeToken) overloads
* Make Object and JsonElement deserialization iterative rather
than recursive
* Add support for reflection access filter
* Put module-info.class into Multi-Release JAR folder
* Add GsonBuilder.disableJdkUnsafe()
- Add BuildRequires on google-errorprone-annotations for compiling
and Javadoc generation
- Refactor ant build to support Java 9+ modular compilation of
module-info.java
- Rewrite the build system for ant to avoid potential build cycles
with upcoming Maven 4
Upgrade to upstream version 1.6.5
* Changes of version 1.6.5
+ Fixed a vulnerability (bsc#1284124, CVE-2026-104721) closely
related to CVE-2026-19880 (bsc#1284020). The fix made in
version 1.6.3, which strips forward and backward slashes from
MDC values, was not sufficient. An MDC value could still
contain relative path components such as .., variable
references such as /, or characters that are special in file
name patterns and email addresses.
MDCBasedDiscriminator, used by SiftingAppender, now rejects
MDC values instead of stripping characters from them. An MDC
value is rejected if it is empty, if it is longer than 64
characters, if it contains the sequence .., or if it contains
any of the following characters: / \ $ { } [ ] ( ) | ? * + % ,
@. When an MDC value is rejected, the discriminator returns
the value of its DefaultValue property. A warning is emitted
for each rejected value. These warnings are rate-limited.
+ When compression is enabled, TimeBasedRollingPolicy and
SizeAndTimeBasedRollingPolicy now also remove old log files
that were never compressed, for example because the
application was not running at rollover time. Previously, such
files were ignored by maxHistory and accumulated indefinitely.
+ SimpleInvocationGate, deprecated in version 1.6.3, is now
marked for removal. Use FixedIntervalInvocationGate instead.
* Changes of version 1.6.4
+ Variable substitution is again applied to the scan attribute
of the <configuration> element. The scanning refactoring in
version 1.5.27 had dropped substitution, so values such as
${logback.scan.enabled:-true} were no longer resolved. As
before version 1.5.27, an unrecognized non-empty value turns
scanning on. The same substitution now applies to the scan
attribute of <propertiesConfigurator>.
+ OutputStreamAppender and FileAppender now handle stateful
encoders. The Encoder interface has a new default method
called isStateful(), which returns false. An encoder that
keeps state between calls to encode() can return true. For
such encoders, the appender holds its write lock while
encoding and while writing, so the output of concurrent
appends cannot interleave. Stateless encoders still encode
outside the lock, so their performance does not change.
Existing encoders need no changes.
+ Several race conditions in OutputStreamAppender and
FileAppender were fixed. The appender is now marked started
and the encoder header is written while the same lock is
held, so a concurrent append can no longer write an event
before the header. After acquiring the lock, the appender
checks again whether it has been stopped, so no event is
written after the footer. In prudent mode, FileAppender now
encodes and writes each event while holding the lock.
+ Fixed a data race on the logger count in LoggerContext.
Loggers are created under the lock of their parent logger, so
loggers with different parents could be created at the same
time and increments of the shared counter could be lost. As a
result, LoggerContext.size() could return a value lower than
the actual number of loggers. The counter is now an
AtomicInteger.
+ TimeBasedRollingPolicy now supports half-day periods. Date
patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a},
used to be detected as daily and rolled over only at
midnight. They now roll over at both 00:00 and 12:00. This
issue was reported in issues/976 by shakthifuture.
+ If org.jline.jansi.AnsiConsole cannot be found on the class
path, JansiConsoleAppender now emits warnings that explain
how to add org.jline:jansi-core and then writes to the plain
console stream. See codes.html#missingJlineJansi.
+ The unused
ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was
removed. LogbackMDCAdapter remains the default MDC adapter.
* Changes of version 1.6.3
+ In relation to CVE-2026-19880 (bsc#1284020),
MDCBasedDiscriminator (used by SiftingAppender) now strips
forward and backward slashes (/, \) from MDC values before
they are used as discriminating keys. This prevents path
segments from escaping into destinations controlled by an
attacker. When sanitisation actually changes a value, a
warning is emitted; the warning is rate-limited (a small
batch, then a lull of about ten minutes).
+ Colour console support is split out into a dedicated
JansiConsoleAppender
(ch.qos.logback.core.JansiConsoleAppender). It wraps stdout
or stderr with Jansi so ANSI escape sequences (for example
coloured patterns) render correctly on terminals that need
it, notably Windows. Prefer this class over the older path
described next.
+ The withJansi property on ConsoleAppender is deprecated.
Existing configurations that still set
<withJansi>true</withJansi> continue to work for
compatibility, but new setups should use JansiConsoleAppender
instead.
+ ConsoleAppender no longer treats the process console as an
exclusive resource: stopping it does not close System.out /
System.err. JansiConsoleAppender pairs each
AnsiConsole.systemInstall() with systemUninstall() on stop,
so repeated start/stop cycles do not leave Jansi installed or
tear down streams shared with the rest of the JVM.
+ Invocation throttling helpers were reworked:
SimpleInvocationGate is renamed FixedIntervalInvocationGate,
and BatchedFixedIntervalInvocationGate allows a short burst
of invocations before applying a fixed lull. The sanitisation
warning above uses the batched gate.
+ The JPMS module-info for logback-core now exports the
ch.qos.logback.core.property package, which had been missing
from the module descriptor.
* Changes of version 1.6.2
+ Configuration analysis now detects contradictory caller-data
inclusion instructions. For example, an AsyncAppender,
SocketAppender or SMTPAppender with includeCallerData left at
the default false is incompatible with a layout or encoder
pattern that uses a caller-data converter such as %C, %M, %L,
%F, %l or %caller. At runtime those converters would print
question marks and still incur extraction cost on a worker
thread. Logback now emits a configuration-time warning when
such instructions disagree. See
codes.html#callerContradiction for details. This issue was
reported in issues/1059 by leeychee. The initial analysis was
contributed by seonwoo_jung.
+ Caller-contradiction analysis can be turned off by setting
the logback.skipCallerContradictionAnalysis variable to true,
either as a system property
(-Dlogback.skipCallerContradictionAnalysis=true) or as a
property in the configuration file:
<property name='logback.skipCallerContradictionAnalysis'
value='true'/>
+ SimpleSocketServer and SimpleSSLSocketServer now require an
explicit client IP whitelist. On the command line, pass one
or more allowed addresses (single IPs or CIDR ranges) after
the configuration file. An empty whitelist means no clients
are accepted. When embedding the server programmatically,
register allowed addresses with
addAllowedClientAddress(String) or
setAllowedClientAddresses(Collection) before clients connect.
See the documentation on restricting client access.
+ Added ThrowableProxyVOBuilder for assembling a
ThrowableProxyVO field by field, with a corresponding
ThrowableProxyVO.builder() entry point.
+ Dependency analysis handlers now run their postHandle method
after child models have been processed, so checks that depend
on nested appenders (such as caller-contradiction analysis)
see a complete picture.
+ Updated several dependencies, including Angus Mail to 2.0.4
and Jetty (test) to 12.1.12.
* Changes of version 1.6.1
+ In TimeBasedRollingPolicy, when the file option is set, the
intermediate file renamed before asynchronous compression now
receives the target archive name without the compression
suffix (e.g. `.gz`, `.zip`, `.xz`). Previously it used a
nanotime-based `.tmp` suffix. This makes the file easier to
identify if compression fails during rollover.
+ On GZ, ZIP, or XZ compression failure, the original
(uncompressed) log file is no longer deleted. Compression
strategies now delete the source file only after successful
compression and emit a warning that the original was left
intact.
+ ConsoleAppender with <withJansi> now probes JLine's
org.jline.jansi.AnsiConsole first and falls back to the
legacy FuseSource org.fusesource.jansi.AnsiConsole class.
This keeps ANSI coloring working after Jansi moved under the
JLine project. The optional org.jline:jansi-core artifact is
declared as a dependency alongside the existing FuseSource
jansi dependency. A preferredJansiClassName property was
added for tests.
+ LayoutWrappingEncoder now reports an error at start() when no
layout is set and guards encode() against a null layout.
Previously, a missing layout (for example after an ignored
<if>/<then>/<else> branch) allowed the encoder to start and
then fail with a NullPointerException on every event,
resulting in silent log loss.
+ FileCollisionAnalyser now detects file collisions involving
nested appenders of SiftingAppender. When the nested file or
fileNamePattern does not textually reference the
discriminator key (e.g. ${userId}), a warning is issued at
configuration time naming the appender, the key, and the
shared target. This closes a gap where statically declared
file appenders were checked but sifted nested appenders were
not.
+ More defensive handling in SyslogOutputStream and
SyslogAppenderBase: the close() method now ensures that
resources are closed, writes and flushes check that the
underlying resources are in a valid state and fallback to
no-op otherwise.
Upgrade to upstream version 1.6.0
* Notable changes
In version 1.5.37 and subsequently in 1.6.x, support for
Janino-based conditional expressions was removed. Evaluating
arbitrary Java expressions with the Janino library had led to
numerous security vulnerabilities.
If you are upgrading from a version earlier than 1.5.37 and
your configuration files still use those older Janino-style
conditionals, you must migrate them to the new format using
the <condition> element (available since version version
1.5.20).
The <condition> element accepts implementations of the
PropertyCondition interface to decide whether a branch of the
configuration should apply. Logback-core ships with several
implementations of said interface. For details, see the
https://logback.qos.ch/manual/configuration.html#conditional
* Changes
+ Removed deprecated variables
- ch.qos.logback.classic.PatternLayout#DEFAULT_CONVERTER_MAP
- ch.qos.logback.classic.PatternLayout#defaultConverterMap
- ch.qos.logback.classic.util.ContextInitializer
#AUTOCONFIG_FILE
- ch.qos.logback.classic.util.ContextInitializer
#TEST_AUTOCONFIG_FILE
- ch.qos.logback.classic.util.ContextInitializer
#CONFIG_FILE_PROPERTY
+ Remove deprecated methods
- ch.qos.logback.classic.PatternLayout
#getDefaultConverterMap()
- ch.qos.logback.core.util.ExecutorServiceUtil
#newExecutorService()
- ch.qos.logback.core.util.VersionUtil
#getVersionOfArtifact(Class<?>)
- ch.qos.logback.core.pattern.PatternLayoutBase
#setContextForConverters
- ch.qos.logback.core.pattern.PatternLayoutEncoderBase
#setOutputPatternAsPresentationHeader
- ch.qos.logback.core.joran.spi.ConfigurationWatchList
#changeDetected
- ch.qos.logback.core.joran.GenericXMLConfigurator
#informContextOfURLUsedForConfiguration
- ch.qos.logback.core.model.ModelUtil#setProperty
- ch.qos.logback.core.model.ModelUtil#setProperties
- ch.qos.logback.core.joran.action.PreconditionValidator
#generic
- ch.qos.logback.core.util.EnvUtil#logbackVersion
- ch.qos.logback.classic.util.ClassicEnvUtil
#getVersionOfLogbackClassic
+ Remove deprecated class
- ch.qos.logback.classic.turbo.ReconfigureOnChangeFilter
+ In AsyncAppenderBase, the put(ILoggingEvent) method now has
the protected modifier to allow access from derived classes
+ Bump SLF4J dependency to version 2.0.18.
Upgrade to upstream version 1.5.38
* Change of 1.5.38
+ In HardenedObjectInputStream, fixed a typo preventing
Throwable objects from being white-filtered
* Change of 1.5.37
+ Given the numerous vulnerabilities related to conditional
configuration processing based on the evaluation of Java
expressions using the Janino library, support for such
expressions has been removed
- Do not use the slf4j2 compatibility package, as the base slf4j
package is now on version 2.0.18
Upgrade to upstream version 1.5.36
* Changes of 1.5.36
+ The 'condition' attribute in <if> elements now reject certain
references that are associated with ACE attacks
(bsc#1269222, CVE-2026-13006).
* Changes of 1.5.35
+ The 'condition' attribute in <if> elements now rejects unicode
escape sequences (\u and \U). This closes a bypass of the
existing prohibition on the new operator in Janino-evaluated
conditions (bsc#1269222, CVE-2026-13006). Please note that the
version 1.5.36 provides the full fix to this vulnerability.
+ Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest
configurator rank, for certified/authenticating configurators
discovered via the ServiceLoader mechanism. ContextInitializer
now requires that at most one such configurator exist on the
classpath; if more than one is found, initialization aborts
with an error.
+ ConsoleCharsetPropertyDefiner is no longer shipped. The Java
21 multi-release compilation of logback-core has been
disabled, which removes this class from the published
artifact. Configurations that referenced
ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner
will need an alternative approach for console charset
detection.
+ The logback-examples module is now included in the set of
artifacts published to Maven Central.
+ JoranConfigurator.makeAnotherInstance() and
DefaultJoranConfigurator.performMultiStepConfigurationFileSearch()
are now protected, allowing derived configurators to override
these methods.
Upgrade to upstream version 1.5.34
* General changes between series
+ The 1.2.x series has been deprecated for several years and is
no longer maintained
+ In Logback 1.2.x/1.3.x, few optional components depend on
Java EE, whereas in logback versions 1.4.x/1.5.x, these
optional components depend on Jakarta EE. The 1.5.x series
continues the 1.4.x series, but with logback-access relocated
to its own repository
* Fixes
+ In case certain StackTraceElement values returned by the
Throwable.getStackTrace method are null,
StackTraceElementProxy substitutes a dummy instance instead of
throwing an IllegalArgumentException (#1040)
+ HardenedObjectInputStream will now throw an
InvalidClassException during deserialization attempts of Proxy
classes (bsc#1266783, CVE-2026-10532)
+ PropertiesConfiguratorModelHandler now registers properties
file URLs to the ConfigurationWatchList when scan is enabled
(via local scan='true' attribute or top-level configuration
scan), ensuring changes are detected and reconfiguration
occurs (issues/1034)
+ When processing <conversionRule> elements and both class and
converterClass attributes are specified, silently use the
class attribute without issuing a warning. However, if the
attribute values differ, a warning will be issued (issues/1031)
+ HardenedModelInputStream will no longer accept to deserialize
all classes located under the 'java.lang' and 'java.util'
packages but only a limited number of explicitly authorized
classes in those packages (bsc#1266783, CVE-2026-9828)
+ SSL parameters for SSLSocketAppender now enable hostname
verification by default. Moreover, the default protocol is now
'TLSv1.2'
+ When printing the status message field,
ViewStatusMessagesServletBase now escapes special characters
such as '&' as character entities
- Require apache-parent 40+ because of changed version variables
for surefire plugins
Upgrade to Apache Maven parent POM version 50
* Breaking changes
+ Update configuration for apache-rat-plugin 0.18
+ Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0
+ Property version.maven-surefire was removed in
apache/maven-apache-parent#588, should be replaced by
version.maven-surefire-plugin, version.maven-failsafe-plugin
or version.maven-surefire-report-plugin
* New features and improvements
+ Exclude dev-tooling dotfiles from RAT check
* Documentation updates
+ Document optional repository profiles for Apache snapshots and
staging
Upgrade to Apache Maven parent POM version 49
* New features and improvements
+ Upgrade parent to 39 to benefit from push-to-atr profile
Upgrade to Apache Maven parent POM version 48
* New features and improvements
+ Add configuration for rerunning failing integration tests
* Bug Fixes
+ Fix enforce-bytecode-version configuration for ignored scopes
* Maintenance
+ Update banner links
+ Simplify docs configuration
+ Remove taglist/jxr/checkstyle/surefire/pmd-reports
+ Update Maven logos
Upgrade to Apache Maven parent POM version 47
Upgrade to Apache Maven parent POM version 46
* Breaking changes
+ Require Maven 3.6.3+ from plugins
+ Update rat plugin configuration
+ Use spotless 3 when running on JDK >= 17
+ Drop Doxia Tools parent pom
* New features and improvements
+ MPOM-387: Exclude test scope from enforcedBytecodeVersion
+ feat: activate Fluido skin's anchorJs
+ Enhance target JDK definition for JDK >= 9
+ Always render a GitHub ribbon on the right-hand side
* Maintenance
+ MPOM-277: Move maven-invoker-plugin configuration to one
place
+ Remove doxia-tools from documentations
+ feat: enable prevent branch protection rules
+ Add Apache 2.0 LICENSE file
Upgrade to Apache Maven parent POM version 45
* New features and improvements
+ Use a standard tag template for releases
* Bug Fixes
+ Use spotless / palantirJavaFormat - 2.56.0 for all JDKs
* Build
+ Allow manually executing release-drafter
Upgrade to Apache Maven parent POM version 44
* Breaking changes
+ Move snapshot repositories in a profile
+ Check test code by checkstyle
* New features and improvements
+ Move snapshot repositories in a profile
+ Introduce property maven.site.path.suffix to allow override
site path
+ Use v@{project.version} as tag template for releases
+ import KEYS history from svn
+ Add licenseText to modello
+ Update site descriptor to 2.0
+ Check test code by checkstyle
+ Add issues templates
+ Accept all line endings with spotless
+ Enable automatic formatter when not on CI
+ Bump com.diffplug.spotless:spotless-maven-plugin to enable the
sortpom/quiet option
* Bug Fixes
+ Fix asf.yaml syntax
+ Skip render empty taglist report
Update to upstream version 2.0.24
* New features and improvements
+ Fix PathConflictResolver OOM on dense dependency graphs
* Bug Fixes
+ Fix flaky IpcClientForkedTest on Windows
+ fix: synchronize IPC stream access
+ fix: propagate fatal errors from Jetty request content
+ Use structured logging in the IPC server
+ MRESOLVER-2142: Increase HTTP3 port allocation retries
+ Honor system proxy credentials in Apache transport
* Documentation updates
+ docs: rewrite how-resolver-works.md to STE rules
+ docs: refresh resolver misconception references
+ docs: clarify checksum trust boundaries
+ fix: correct config filename to .mvn/maven.config
+ Use configuration key as link label
Update to upstream version 2.0.23
* New features and improvements
+ Finish the repo key story
+ Fix: log only once the warning in DefRemoteRepoMan
+ Fix #2058: Add links to configuration page
+ Eliminate per-node HashSet allocation in PathConflictResolver
* Bug Fixes
+ fix: accept locally cached artifacts via same-id fallback when
tracking URL changes
+ Fix listener error swallowing
+ MRESOLVER-379: Preserve relocated candidates from version
ranges
+ Create the local repository directory before resolving its
real path
+ Optimize TrackingFileManager unit tests and fix potential lock
leaks
+ Validate the repository key used in checksum summary file
names
+ fix: bound response reads and sanitize remote-derived strings
+ fix: earn trust labels through verification and bind tracking
to URL
+ fix: bind credentials to origin and reject TLS downgrade
redirects
+ fix: prevent remote signals from weakening operator-configured
policy
+ fix: atomic file publication and authenticated IPC lock daemon
+ fix: deploy-side integrity must fail closed
+ fix: harden opt-in transport and lock backends against
unauthenticated infrastructure
+ Compose named lock keys one segment per coordinate field
+ Resolve file transport locations with path operations instead
of substring matching
+ Validate coordinate components in the Maven 2 layout and local
path composer
* Documentation updates
+ docs: Clarify trusted checksum sources
+ Fix #2058: Add links to configuration page
* Maintenance
+ test: move from minio docker image
+ Fix listener error swallowing
+ Fix: tidy up f013
+ Fix #2096: harden NamedLocksTrackingFileManagerTest against CI
load
+ Carry repository provenance into aggregateRepositories
+ Validate the repository key used as a local repository path
segment
Update to upstream version 2.0.22
* New features and improvements
+ Fix #1994: log exceptions from IpcNamedLock.tryUnlock()
+ Consider 'Retry-After' header in Java HTTP Client
+ Fix compilation error in DefaultRepositorySystemReentrancyTest
+ Extend re-entrancy detection for broken trace chains
+ Fix #2013: optimize TransitiveDependencyManager performance
+ Extract included checksums from x-amz-meta-* headers
+ Enh: Allow validator factory to abstain
* Bug Fixes
+ Fix InterruptedException silently dropping task in
SmartExecutor.Limited.submit(Runnable)
+ Documentation updates
+ docs: rewrite expected-checksums.md to STE rules
+ Support deprecated tag.
+ Reconcile the two download pages and modernise them
+ Convert the index page from xdoc to Markdown
+ docs: rewrite creating-a-repository-system-session.md to STE
rules
+ docs: rewrite common-misconceptions.md to ASD-STE100 rules
+ docs: rewrite deployment.md in ASD-STE100 Simplified Technical
English
+ docs: rewrite dependency-graph.md in ASD-STE100 Simplified
Technical English
+ docs: rewrite about-checksums.md to STE rules
+ docs: rewrite api-compatibility.md to STE rules
+ Docs: rewrite what-is-resolver page in Simplified Technical
English (ASD-STE100)
+ Fix documentation issues across site docs
+ Improve rendering of javadoc content
+ Edit version comparison
* Maintenance
+ Drop the versions.junit5 property the parent already provides
+ Fix #1998: use try-with-resources in test file utilities
+ Convert the index page from xdoc to Markdown
+ Use https in license URLs as recommended by ASF
+ Exclude ODG graphics from RAT checks
+ Build against Maven 4.0.0-rc-6
+ Fix resource leak pattern in
DependencyGraphParser.parseLiteral()
+ Replace printStackTrace with proper error handling
Update to upstream version 2.0.21
* New features and improvements
+ Reduce PathConflictResolver memory and auto-select resolver
+ Fix dependency selector cache regression in DF collector
+ Fix thread contention in GenericVersionScheme and
WeakInternPool
+ Improve thread safety across modules
+ WarnChecksumPolicy: proceed on no checksums
+ Extend AuthenticationBuilder to support SSLContext for mTLS
authentication
+ DependencyCollectionChecker: new session member
+ Add any media type to RFC9457 content type header
+ fix: Configuration to be able to control sending RFC 9457
related Accept HTTP header
+ Improvement: BF dependency selector hot methods
* Bug Fixes
+ Fix ApacheTransport auth cache CCEx
+ Checksums: lack of information
+ Fix inverted SIGTSTP condition in IPC server
+ Bug: fix IPC named lock client-side robustness for Windows
+ Bugfix: Fix NPE in PathConflictResolver
+ Bug: fix IPC named lock server-side waiter leak on client
timeout
+ Bug: fix new PCR as it in certain cases left duplicates
* Documentation updates
+ Javadoc update
+ Doc: Trusted Checksums Summary File Procedure
* Maintenance
+ Put PCR aside for now
+ Get rid of BND warnings
+ Align generators
+ Fix for ChainedWorkspaceReader
+ Create simple JMH benchmark to compare CCR and PCR
+ Tidy up suppliers
+ Disable IPC lock tests on Windows
- Allow building the modules that can be built using Java 8 on
distribution that don't provide Java 17. This allows to build
maven 3.10.x everywhere where it could be built before.
Update to upstream version 2.0.20
* Breaking Changes & Compatibility
+ Major Version API/SPI Shift: Version 2.0.x is a major
architectural overhaul designed to support the upcoming Maven
4.x and Maven 3.10.x branches. The 1.x lineage is now
officially in 'bugfix only' maintenance mode.
+ Removal of ServiceLocator: The long-deprecated Plexus
ServiceLocator integration has been entirely removed. It
conflicted with modern constructor-based Dependency Injection
(Eclipse Sisu).
+ Scope Unawareness: Maven Resolver 2.x is now completely
scope-unaware. Dependency scopes are treated merely as
transparent labels by the core resolver. Scope handling is now
fully delegated to the consumer project (e.g., Maven itself).
+ Delegation of Classpaths: Classpath generation
(NodeListGenerator) and classpath filtering
(DependencyFilterUtils), as well as default ArtifactType
implementations, have been deprecated/removed from the core
and delegated to consumer applications via the
maven-resolver-provider module.
* Architectural & Lifecycle Enhancements
+ Session Lifecycle Redesign (Resource Leaks): Introduced
SessionBuilder and CloseableSession nested interfaces to
replace the legacy DefaultRepositorySystemSession constructor
mechanism. Sessions now utilize onSessionEnd hooks and must be
explicitly closed when finished. This change is critical to
prevent resource leaks when using modern networking features
like HTTP/2 transports.
Update to upstream version 1.9.27
* Bug Fixes
+ Sync TrackingFileManager with 2.x
Update to upstream version 1.9.26
* New features and improvements
+ GH-1773: Treat 410 Gone as 404 Not Found
+ GH-1737: Revert partially parallel upload change
* Bug Fixes
+ GH-1768; Drastically simplify auth caching
+ [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF
* Documentation updates
+ Clarify that HTTP Transport uses Apache HTTP Client
Update to upstream version 1.9.25
* New features and improvements
+ Add scope support for trusted checksums
+ Name mappers cleanup and new GAECV mapper
+ Proper metadata locking support
+ Ability to augment metadata nature for version range request
* Bug Fixes
+ TrackingFileManager changes
+ Maven filters daemon friendly
+ Remove hack from Basic connector
+ Fix locking issues
* Documentation updates
+ Updated the documentation to reflect the current list of name
mappers
* Maintenance
+ Mild backport: support same properties as Resolver 2.x
+ Maven resolver lockrepro
+ Bugfix: Java 25 broke test
Update to upstream version 1.9.24
* New features and improvements
+ Metadata type out of coordinates
+ RFC9457 implementation
+ Intern context strings
* Maintenance
+ Align plexus-util version with Maven
+ Align guice version with Maven
+ Enable Github Issues (1.9.x branch)
- Build also maven-resolver-supplier package in separate spec file
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
Update to upstream version 1.9.23
* Bug
+ MRESOLVER-659: NPE in trusted checksum post processor if
* Improvement
+ MRESOLVER-680: Disable checksum by default for .sigstore.json
as well
+ MRESOLVER-703: HTTP transport should expose config for max
redirects
Upgrade to upstream version 1.9.22
* Bug
+ MRESOLVER-572: Resolver-Supplier unusable in OSGi runtimes
+ MRESOLVER-574: Invalid Cookie set under proxy conditions
+ MRESOLVER-586: In typical setups, DefaultArtifact copies the
same maps over and over again
+ MRESOLVER-587: Memory consumption improvements
* New Feature
+ MRESOLVER-571: Import o.e.aether packages with the exact same
version in OSGi metadata
* Improvement
+ MRESOLVER-570: Remove excessive strictness of OSGi dependency
metadata
* Task
+ MRESOLVER-576: Allow co-release of Resolver 1.x and 2.x
Upgrade to upstream version 1.9.20
* Bug
+ MRESOLVER-483: PreorderNodeListGenerator bug: may print
trailing ':'
+ MRESOLVER-522: File locking threads not entering critical
region were 'oversleeping'
+ MRESOLVER-547: BF collector always copies artifacts, even
when it should not
* Improvement
+ MRESOLVER-536: Skip setting last modified time when FS does
not support it
- Add dependency on plexus-xml where relevant
* this will be needed for smooth upgrade to plexus-utils 4.0.0
Upgrade to upstream version 1.9.18
* Bug
+ MRESOLVER-372: Sporadic AccessDeniedEx on Windows
+ MRESOLVER-441: Undo FileUtils changes that altered non-Windows
execution path
* Improvement
+ MRESOLVER-396: Native transport should retry on HTTP 429
(Retry-After)
* Task
+ MRESOLVER-397: Deprecate Guice modules
+ MRESOLVER-405: Get rid of component name string literals, make
them constants and reusable
+ MRESOLVER-433: Expose configuration for inhibiting
Expect-Continue handshake in 1.x
+ MRESOLVER-435: Refresh download page
+ MRESOLVER-437: Resolver should not override given HTTP
transport default use of expect-continue handshake
Upgrade to upstream version 1.9.15
* Bug
+ MRESOLVER-373: Remove lock upgrading code
+ MRESOLVER-375: Several key aspects are broken in provided and
trusted checksum feature
+ MRESOLVER-376: StackOverflowError at
BfDependencyCollector.processDependency
+ MRESOLVER-380: Lock diagnostic: attempted lock step is
recorded, but on failed attempt is not removed
+ MRESOLVER-393: Transport HTTP does not retain last modified as
sent by remote end
* Improvement
+ MRESOLVER-220: Modify signaling for unsupported operations
+ MRESOLVER-382: Define local outgoing (bind) address
+ MRESOLVER-385: Reduce default value for
aether.connector.http.connectionMaxTtl
* Task
+ MRESOLVER-378: Update parent POM to 40
+ MRESOLVER-381: Undo MRESOLVER-373 as it was fixed by other
means
+ MRESOLVER-386: Make all injected ctors public, deprecate all
def ctors
+ MRESOLVER-388: Transport HTTP old codec proper override
Upgrade to upstream version 1.9.12
* Bug
+ [MRESOLVER-371] Unjustified WARNING log added by
MRESOLVER-364
+ [MRESOLVER-361] Unreliable TCP and retries on upload
+ [MRESOLVER-357] ConflictResolver STANDARD verbosity
misbehaves
+ [MRESOLVER-352] Duplicate METADATA_DOWNLOADING event is
being sent
* Improvement
+ [MRESOLVER-360] disable checksum by default for .sigstore
in addition to .asc
* New Feature
+ [MRESOLVER-370] Lock factory should dump lock states on
failure
+ [MRESOLVER-353] Make aether.checksums.algorithms settable
per remote repository
* Task
+ [MRESOLVER-366] Upgrade build plugins
+ [MRESOLVER-364] Revert MRESOLVER-132
+ [MRESOLVER-359] Make build be explicit about build time
requirements
+ [MRESOLVER-356] Remove Guava (is unused)
+ [MRESOLVER-354] Document expected checksums
Upgrade to upstream version 1.9.8
* Bug
+ [MRESOLVER-345] Conflict resolution in verbose mode is
sensitive to version ordering
+ [MRESOLVER-348] SslConfig httpSecurityMode change is not
detected
+ [MRESOLVER-339] Preemptive Auth broken when default ports used
+ [MRESOLVER-325] [REGRESSION] Suddenly seeing I/O errors under
windows aborting the build
+ [MRESOLVER-330] Static name mapper is unusable with file-lock
factory
+ [MRESOLVER-314] Getting 'IllegalArgumentException: Comparison
method violates its general contract!'
+ [MRESOLVER-316] DF collector enters endless loop when
collecting org.webjars.npm:musquette:1.1.1
+ [MRESOLVER-298] javax.inject should be provided or optional
+ [MRESOLVER-305] Evaluate blocked repositories also when
retrieving metadata
+ [MRESOLVER-309] PrefixesRemoteRepositoryFilterSource aborts
the build while it should not
+ [MRESOLVER-313] Artifact file permissions are 0600 and not
implicitly set by umask
+ [MRESOLVER-296] FileProcessor.write( File, InputStream ) is
defunct
+ [MRESOLVER-292] Documented and used param names mismatch
+ [MRESOLVER-294] Fix JapiCmp configuration and document it
+ [MRESOLVER-285] File locking on Windows knows to misbehave
+ [MRESOLVER-246] m-deploy-p will create hashes for hashes
+ [MRESOLVER-265] Discrepancy between produced and recognized
checksums
+ [MRESOLVER-241] Resolver checksum calculation should be driven
by layout
+ [MRESOLVER-242] When no remote checksums provided by layout,
transfer inevitably fails/warns
+ [MRESOLVER-250] Usage of descriptors map in DataPool prevents
gargabe collection
* New Feature
+ [MRESOLVER-32] Support parallel artifact/metadata uploads
+ [MRESOLVER-319] Support parallel deploy
+ [MRESOLVER-297] Chained LRM
+ [MRESOLVER-167] Support forcing specific repositories for
artifacts
+ [MRESOLVER-268] Apply artifact checksum verification for any
resolved artifact
+ [MRESOLVER-274] Introduce Remote Repository Filter feature
+ [MRESOLVER-275] Introduce trusted checksums source
+ [MRESOLVER-276] Resolver post-processor
+ [MRESOLVER-278] BREAKING: Introduce RepositorySystem shutdown
hooks
+ [MRESOLVER-236] Make it possible to resolve .asc on a 'fail'
respository.
* Improvement
+ [MRESOLVER-346] Too eager locking
+ [MRESOLVER-347] Better connection pool configuration (reuse,
max TTL, maxPerRoute)
+ [MRESOLVER-349] Adapter when locking should 'give up and
retry'
+ [MRESOLVER-350] Get rid of commons-lang dependency
+ [MRESOLVER-327] Make tranport-http obey system properties
regarding proxy settings
+ [MRESOLVER-340] Make WebDAV 'dance' disabled by default
+ [MRESOLVER-341] Add option for preemptive PUT Auth
+ [MRESOLVER-315] Implement preemptive authentication feature
for transport-http
+ [MRESOLVER-328] The transport-http should be able to ignore
cert errors
+ [MRESOLVER-337] Real cause when artifact not found with
repository filtering
+ [MRESOLVER-287] Get rid of deprecated finalize methods
+ [MRESOLVER-317] Improvements for BF collector
+ [MRESOLVER-318] Cleanup redundant code and centralize executor
handling
+ [MRESOLVER-303] Make checksum detection reusable
+ [MRESOLVER-290] Improve file handling resolver wide
+ [MRESOLVER-7] Download dependency POMs in parallel in BF
collector
+ [MRESOLVER-266] Simplify adapter creation and align
configuration for it
+ [MRESOLVER-269] Allow more compact storage of provided
checksums
+ [MRESOLVER-273] Create more compact File locking layout/mapper
+ [MRESOLVER-284] BREAKING: Some Sisu parameters needs to be
bound
+ [MRESOLVER-286] Improve basic connector closed state handling
+ [MRESOLVER-240] Using breadth-first approach to resolve Maven
dependencies
+ [MRESOLVER-247] Avoid unnecessary dependency resolution by a
Skip solution based on BFS
+ [MRESOLVER-248] Make DF and BF collector implementations
coexist
* Task
+ [MRESOLVER-326] Resolver transport-http should retry on
failures
+ [MRESOLVER-331] Make DefaultTrackingFileManager write directly
to tracking files
+ [MRESOLVER-333] Distinguish better resolver errors for
artifact availability
+ [MRESOLVER-320] Investigate slower resolving speeds as
reported by users
+ [MRESOLVER-291] Undo MRESOLVER-284
+ [MRESOLVER-279] Simplify and improve trusted checksum sources
+ [MRESOLVER-281] Update configurations page with new elements
+ [MRESOLVER-282] Drop PartialFile
+ [MRESOLVER-230] Make supported checksum algorithms extensible
+ [MRESOLVER-231] Extend 'smart checksum' feature
+ [MRESOLVER-234] Introduce 'provided' checksums feature
+ [MRESOLVER-237] Make all checksum mismatches handled same
+ [MRESOLVER-239] Update and sanitize dependencies
+ [MRESOLVER-244] Deprecate FileTransformer API
+ [MRESOLVER-245] Isolate Hazelcast tests
* Dependency upgrade
+ [MRESOLVER-311] Upgrade Parent to 39
+ [MRESOLVER-293] Update dependencies, align with Maven
+ [MRESOLVER-272] Update parent POM to 37, remove plugin version
overrides, update bnd
+ [MRESOLVER-280] Upgrade invoker, install, deploy, require
maven 3.8.4+
+ [MRESOLVER-251] Upgrade Redisson to 3.17.5
+ [MRESOLVER-249] Update Hazelcast to 5.1.1 in
named-locks-hazelcast module
- Add an alias for the wagon connector
- Build against the standalone JavaEE modules unconditionally
- Remove the javax.annotation:javax.annotation-api dependency on
distribution versions that do not incorporate the JavaEE modules
- Add the glassfish-annotation-api jar to the build classpath
Upgrade to upstream version 1.7.3
* Bug
+ [MRESOLVER-96] - Dependency Injection fails after upgrading
to Maven 3.6.2
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ an
run on Java 8 due to JDK API breakage
+ [MRESOLVER-189] - Using semaphore-redisson followed by
rwlock-redisson on many parallel build of the same project
triggers redisson error
* New Feature
+ [MRESOLVER-90] - HTML content in POM: Maven should validate
content before storing in local repo
+ [MRESOLVER-145] - Introduce more SyncContext implementations
* Improvement
+ [MRESOLVER-103] - Replace deprecated HttpClient classes
+ [MRESOLVER-104] - maven-resolver-demo-maven-plugin uses
reserved artifactId
+ [MRESOLVER-147] Upgrade to Java 8
+ [MRESOLVER-148] - Use vanilla Guice 4 instead of forked
Guice 3
+ [MRESOLVER-156] - Active dependency management for Google
Guice/Guava
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
+ [MRESOLVER-193] - Properly type lock key names in Redis
+ [MRESOLVER-197] - Minors improvements (umbrella)
+ [MRESOLVER-204] - Add a SessionData#computeIfAbsent method
+ [MRESOLVER-214] - Remove clirr configuration
* Task
+ [MRESOLVER-141] - Review index-based access to collections
+ [MRESOLVER-151] - Enforce a checksum policy to be provided
explicitly
+ [MRESOLVER-152] - Perform null checks when interface
contracts require it
+ [MRESOLVER-154] - Move SyncContextFactory interface to SPI
module
+ [MRESOLVER-155] - Make TrackingFileManager member of
DefaultUpdateCheckManager
+ [MRESOLVER-158] - Simplify SimpleDigest class
+ [MRESOLVER-159] - Mark singleton components as Sisu Singletons
+ [MRESOLVER-160] - Deprecate ServiceLocator
+ [MRESOLVER-162] - Restore binary compatibility broken by
MRESOLVER-154
+ [MRESOLVER-170] - Deprecate org.eclipse.aether.spi.log
+ [MRESOLVER-172] - Make TrackingFileManager shared singleton
component
+ [MRESOLVER-173] - Drop deprecated AetherModule
+ [MRESOLVER-174] - Use all bindings in UTs and tests
+ [MRESOLVER-175] - Drop SyncContextFactory delegates in favor
of a selector approach
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
+ [MRESOLVER-183] - Don't require optional dependencies for
Redisson
+ [MRESOLVER-184] - Destroy Redisson semaphores if not used
anymore
+ [MRESOLVER-186] Update Maven version in Resolver Demo
Snippets
+ [MRESOLVER-188] - Improve documentation on using the named
locks with redis/hazelcast (umbrella)
+ [MRESOLVER-190] - [Regression] Revert MRESOLVER-184
+ [MRESOLVER-191] - Document how to analyze lock issues
+ [MRESOLVER-196] - Document named locks configuration options
+ [MRESOLVER-219] - Implement NamedLock with advisory file
locking
+ [MRESOLVER-227] - Refactor NamedLockFactorySelector to a
managed component
+ [MRESOLVER-232] - Make SimpleNamedLockFactorySelector logic
reusable
* Sub-task
+ [MRESOLVER-198] - Replace assert by simpler but equivalent
calls
+ [MRESOLVER-199] - Java 8 improvements
+ [MRESOLVER-200] - Simplify conditions with the same result
and avoid extra validations
+ [MRESOLVER-201] - Make variables final whenever possible
+ [MRESOLVER-202] - Use isEmpty() instead length() <= 0
* Dependency upgrade
+ [MRESOLVER-185] Upgrade Redisson to 3.15.6
* Change of API and incompatible with maven-resolver < 1.7
Upgrade to upstream version 1.6.3
* Bug
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ and
run on Java 8 due to JDK API breakage
* Improvement
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
* Task
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
* Needed for maven 3.8.4
- Do not build/run the tests against the legacy guava20 package
Upgrade to upstream version 1.6.2
* Sub-task
+ [MRESOLVER-139] - Make SimpleDigest use SHA-1 or MD5 only
+ [MRESOLVER-140] - Default to SHA-1 and MD5 hashing algorithms
* Bug
+ [MRESOLVER-25] - Resume support is broken under high
concurrency
+ [MRESOLVER-114] - ArtifactNotFoundExceptions when building in
parallel
+ [MRESOLVER-129] - Exclusion has no setters
+ [MRESOLVER-137] - Make OSGi bundles reproducible
+ [MRESOLVER-138] - MRESOLVER-56 introduces severe performance
regression
* New Feature
+ [MRESOLVER-109] - AndDependencySelector should override
toString
+ [MRESOLVER-115] - Make checksum algorithms configurable
+ [MRESOLVER-123] - Provide a global locking sync context by
default
+ [MRESOLVER-131] - Introduce a Redisson-based
SyncContextFactory
+ [MRESOLVER-165] - Add support for mirror selector on
external:http:*
+ [MRESOLVER-166] - Add support for blocked
repositories/mirrors
* Improvement
+ [MRESOLVER-56] - Support SHA-256 and SHA-512 as checksums
+ [MRESOLVER-116] - Add page with all supported configuration
options
+ [MRESOLVER-125] - Use type conversions returning primitives
+ [MRESOLVER-127] - Don't use boolean for property
'aether.updateCheckManager.sessionState'
+ [MRESOLVER-136] - Migrate from maven-bundle-plugin to
bnd-maven-plugin
* Task
+ [MRESOLVER-119] - Turn log messages to SLF4J placeholders
+ [MRESOLVER-130] - Move GlobalSyncContextFactory to a separate
module
+ [MRESOLVER-132] - Remove synchronization in
TrackingFileManager
* Dependency upgrade
+ [MRESOLVER-105] Update Plexus Components
+ [MRESOLVER-106] Update HttpComponents
+ [MRESOLVER-107] Update Wagon Provider API to 3.4.0
+ [MRESOLVER-108] Update mockito-core to 2.28.2
+ [MRESOLVER-117] Upgrade SLF4J to 1.7.30
+ [MRESOLVER-118] Upgrade Sisu Components to 0.3.4
* Needed for maven 3.8.x
- Set buildshell to bash for '<<<'.
Upgrade to upstream version 1.4.2
* Bug:
+ MRESOLVER-38 - SOE/OOME in DefaultDependencyNode.accept
* Improvements:
+ MRESOLVER-93 - PathRecordingDependencyVisitor to handle 3 cycles
+ MRESOLVER-102 - make build Reproducible
Upgrade to upstream version 1.4.1
* Task
+ [MRESOLVER-92] - Revert MRESOLVER-7
* Bug
+ [MRESOLVER-86] - ResolveArtifactMojo from resolver example
uses plugin repositories to resolve dependencies
* New Feature
+ [MRESOLVER-10] - New 'TransitiveDependencyManager'
supporting transitive dependency management
+ [MRESOLVER-33] - New 'DefaultDependencyManager' managing
dependencies on all levels supporting transitive dependency
management
* Improvement
+ [MRESOLVER-7] - Download dependency POMs in parallel
+ [MRESOLVER-84] - Add support for 'release' qualifier
+ [MRESOLVER-87] - Refresh examples to use maven-resolver
artifacts for demo
+ [MRESOLVER-88] - Code style cleanup to use Java 7 features
- Initial packaging of maven-resolver 1.3.1
Update to upstream version 2.0.24
* New features and improvements
+ Fix PathConflictResolver OOM on dense dependency graphs
* Bug Fixes
+ Fix flaky IpcClientForkedTest on Windows
+ fix: synchronize IPC stream access
+ fix: propagate fatal errors from Jetty request content
+ Use structured logging in the IPC server
+ MRESOLVER-2142: Increase HTTP3 port allocation retries
+ Honor system proxy credentials in Apache transport
* Documentation updates
+ docs: rewrite how-resolver-works.md to STE rules
+ docs: refresh resolver misconception references
+ docs: clarify checksum trust boundaries
+ fix: correct config filename to .mvn/maven.config
+ Use configuration key as link label
* Dependency updates
+ Bump org.apache.maven:maven-parent from 49 to 50
+ Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1
to 3.6.2
+ Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4
+ Bump dev.sigstore:sigstore-java from 2.2.0 to 2.3.0
Update to upstream version 2.0.23
* New features and improvements
+ Finish the repo key story
+ Fix: log only once the warning in DefRemoteRepoMan
+ Fix #2058: Add links to configuration page
+ Eliminate per-node HashSet allocation in PathConflictResolver
* Bug Fixes
+ fix: accept locally cached artifacts via same-id fallback when
tracking URL changes
+ Fix listener error swallowing
+ MRESOLVER-379: Preserve relocated candidates from version
ranges
+ Create the local repository directory before resolving its
real path
+ Optimize TrackingFileManager unit tests and fix potential lock
leaks
+ Validate the repository key used in checksum summary file
names
+ fix: bound response reads and sanitize remote-derived strings
+ fix: earn trust labels through verification and bind tracking
to URL
+ fix: bind credentials to origin and reject TLS downgrade
redirects
+ fix: prevent remote signals from weakening operator-configured
policy
+ fix: atomic file publication and authenticated IPC lock daemon
+ fix: deploy-side integrity must fail closed
+ fix: harden opt-in transport and lock backends against
unauthenticated infrastructure
+ Compose named lock keys one segment per coordinate field
+ Resolve file transport locations with path operations instead
of substring matching
+ Validate coordinate components in the Maven 2 layout and local
path composer
* Documentation updates
+ docs: Clarify trusted checksum sources
+ Fix #2058: Add links to configuration page
* Maintenance
+ test: move from minio docker image
+ Fix listener error swallowing
+ Fix: tidy up f013
+ Fix #2096: harden NamedLocksTrackingFileManagerTest against CI
load
+ Carry repository provenance into aggregateRepositories
+ Validate the repository key used as a local repository path
segment
* Dependency updates
+ Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from
3.15.2 to 3.16.0
+ Bump version.slf4j from 2.0.18 to 2.0.19
+ Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.26.1 to 0.26.2
+ Deps: bump to BC provider 1.85.2
+ Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2
+ Bump org.codehaus.plexus:plexus-xml from 4.1.1 to 4.2.0
+ Stop dependabot from offering guice 7 on the 1.9.x line
Update to upstream version 2.0.22
* New features and improvements
+ Fix #1994: log exceptions from IpcNamedLock.tryUnlock()
+ Consider 'Retry-After' header in Java HTTP Client
+ Fix compilation error in DefaultRepositorySystemReentrancyTest
+ Extend re-entrancy detection for broken trace chains
+ Fix #2013: optimize TransitiveDependencyManager performance
+ Extract included checksums from x-amz-meta-* headers
+ Enh: Allow validator factory to abstain
* Bug Fixes
+ Fix InterruptedException silently dropping task in
SmartExecutor.Limited.submit(Runnable)
+ Documentation updates
+ docs: rewrite expected-checksums.md to STE rules
+ Support deprecated tag.
+ Reconcile the two download pages and modernise them
+ Convert the index page from xdoc to Markdown
+ docs: rewrite creating-a-repository-system-session.md to STE
rules
+ docs: rewrite common-misconceptions.md to ASD-STE100 rules
+ docs: rewrite deployment.md in ASD-STE100 Simplified Technical
English
+ docs: rewrite dependency-graph.md in ASD-STE100 Simplified
Technical English
+ docs: rewrite about-checksums.md to STE rules
+ docs: rewrite api-compatibility.md to STE rules
+ Docs: rewrite what-is-resolver page in Simplified Technical
English (ASD-STE100)
+ Fix documentation issues across site docs
+ Improve rendering of javadoc content
+ Edit version comparison
* Maintenance
+ Drop the versions.junit5 property the parent already provides
+ Fix #1998: use try-with-resources in test file utilities
+ Convert the index page from xdoc to Markdown
+ Use https in license URLs as recommended by ASF
+ Exclude ODG graphics from RAT checks
+ Build against Maven 4.0.0-rc-6
+ Fix resource leak pattern in
DependencyGraphParser.parseLiteral()
+ Replace printStackTrace with proper error handling
* Build
+ Improve error reporting
+ .gitignore .vscode/
+ Improve rendering of javadoc content
Update to upstream version 2.0.21
* New features and improvements
+ Reduce PathConflictResolver memory and auto-select resolver
+ Fix dependency selector cache regression in DF collector
+ Fix thread contention in GenericVersionScheme and
WeakInternPool
+ Improve thread safety across modules
+ WarnChecksumPolicy: proceed on no checksums
+ Extend AuthenticationBuilder to support SSLContext for mTLS
authentication
+ DependencyCollectionChecker: new session member
+ Add any media type to RFC9457 content type header
+ fix: Configuration to be able to control sending RFC 9457
related Accept HTTP header
+ Improvement: BF dependency selector hot methods
* Bug Fixes
+ Fix ApacheTransport auth cache CCEx
+ Checksums: lack of information
+ Fix inverted SIGTSTP condition in IPC server
+ Bug: fix IPC named lock client-side robustness for Windows
+ Bugfix: Fix NPE in PathConflictResolver
+ Bug: fix IPC named lock server-side waiter leak on client
timeout
+ Bug: fix new PCR as it in certain cases left duplicates
* Documentation updates
+ Javadoc update
+ Doc: Trusted Checksums Summary File Procedure
* Maintenance
+ Put PCR aside for now
+ Get rid of BND warnings
+ Align generators
+ Fix for ChainedWorkspaceReader
+ Create simple JMH benchmark to compare CCR and PCR
+ Tidy up suppliers
+ Disable IPC lock tests on Windows
* Dependency updates
+ Bump org.apache.maven:maven-parent from 48 to 49
+ Bump roasterVersion from 2.31.0.Final to 2.31.1.Final
+ Bump sisuVersion from 1.0.0 to 1.0.1
+ Bump org.redisson:redisson from 4.4.0 to 4.6.1
+ Deps: Jetty 12.1.10
+ Bump io.minio:minio from 9.0.0 to 9.0.3
+ Bump dev.sigstore:sigstore-java from 2.0.0 to 2.2.0
+ Bump okhttpVersion from 5.3.2 to 5.4.0
+ Bump biz.aQute.bnd:bnd-maven-plugin from 7.2.3 to 7.3.0
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.25.7 to 0.26.1
+ Bump org.ow2.asm:asm from 9.9.1 to 9.10.1
+ Bump org.codehaus.plexus:plexus-classworlds from 2.11.0 to
2.12.0
+ Bump maven3Version from 3.9.15 to 3.9.16
- Allow building the modules that can be built using Java 8 on
distribution that don't provide Java 17. This allows to build
maven 3.10.x everywhere where it could be built before.
Update to upstream version 2.0.20
* Breaking Changes & Compatibility
+ Major Version API/SPI Shift: Version 2.0.x is a major
architectural overhaul designed to support the upcoming Maven
4.x and Maven 3.10.x branches. The 1.x lineage is now
officially in 'bugfix only' maintenance mode.
+ Removal of ServiceLocator: The long-deprecated Plexus
ServiceLocator integration has been entirely removed. It
conflicted with modern constructor-based Dependency Injection
(Eclipse Sisu).
+ Scope Unawareness: Maven Resolver 2.x is now completely
scope-unaware. Dependency scopes are treated merely as
transparent labels by the core resolver. Scope handling is now
fully delegated to the consumer project (e.g., Maven itself).
+ Delegation of Classpaths: Classpath generation
(NodeListGenerator) and classpath filtering
(DependencyFilterUtils), as well as default ArtifactType
implementations, have been deprecated/removed from the core
and delegated to consumer applications via the
maven-resolver-provider module.
* Architectural & Lifecycle Enhancements
+ Session Lifecycle Redesign (Resource Leaks): Introduced
SessionBuilder and CloseableSession nested interfaces to
replace the legacy DefaultRepositorySystemSession constructor
mechanism. Sessions now utilize onSessionEnd hooks and must be
explicitly closed when finished. This change is critical to
prevent resource leaks when using modern networking features
like HTTP/2 transports.
Update to upstream version 1.9.27
* Bug Fixes
+ Sync TrackingFileManager with 2.x
Update to upstream version 1.9.26
* New features and improvements
+ GH-1773: Treat 410 Gone as 404 Not Found
+ GH-1737: Revert partially parallel upload change
* Bug Fixes
+ GH-1768; Drastically simplify auth caching
+ [1.9.x] Bug: GH-1703 Locally cached artifacts defy RRF
* Documentation updates
+ Clarify that HTTP Transport uses Apache HTTP Client
* Dependency updates
+ Bump org.redisson:redisson from 3.52.0 to 4.2.0
+ Bump commons-codec:commons-codec from 1.20.0 to 1.21.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26
to 1.27
+ Bump org.apache.maven:maven-parent from 46 to 47
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.25.0 to 0.25.4
+ Bump mavenVersion from 3.9.11 to 3.9.12
Update to upstream version 1.9.25
* New features and improvements
+ Add scope support for trusted checksums
+ Name mappers cleanup and new GAECV mapper
+ Proper metadata locking support
+ Ability to augment metadata nature for version range request
* Bug Fixes
+ TrackingFileManager changes
+ Maven filters daemon friendly
+ Remove hack from Basic connector
+ Fix locking issues
* Documentation updates
+ Updated the documentation to reflect the current list of name
mappers
* Maintenance
+ Mild backport: support same properties as Resolver 2.x
+ Maven resolver lockrepro
+ Bugfix: Java 25 broke test
* Dependency updates
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.23.1 to 0.25.0
+ Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24
to 1.26
+ Bump commons-codec:commons-codec from 1.18.0 to 1.20.0
+ Bump org.redisson:redisson from 3.50.0 to 3.52.0
+ Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre
+ Bump com.google.code.gson:gson from 2.13.1 to 2.13.2
+ Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814
+ Bump mavenVersion from 3.9.10 to 3.9.11
Update to upstream version 1.9.24
* New features and improvements
+ Metadata type out of coordinates
+ RFC9457 implementation
+ Intern context strings
* Maintenance
+ Align plexus-util version with Maven
+ Align guice version with Maven
+ Enable Github Issues (1.9.x branch)
- Build also maven-resolver-supplier package in separate spec file
- Add dependency on objectweb-asm to build with sisu 0.9.0.M4
Update to upstream version 1.9.23
* Bug
+ MRESOLVER-659: NPE in trusted checksum post processor if
* Improvement
+ MRESOLVER-680: Disable checksum by default for .sigstore.json
as well
+ MRESOLVER-703: HTTP transport should expose config for max
redirects
Upgrade to upstream version 1.9.22
* Bug
+ MRESOLVER-572: Resolver-Supplier unusable in OSGi runtimes
+ MRESOLVER-574: Invalid Cookie set under proxy conditions
+ MRESOLVER-586: In typical setups, DefaultArtifact copies the
same maps over and over again
+ MRESOLVER-587: Memory consumption improvements
* New Feature
+ MRESOLVER-571: Import o.e.aether packages with the exact same
version in OSGi metadata
* Improvement
+ MRESOLVER-570: Remove excessive strictness of OSGi dependency
metadata
* Task
+ MRESOLVER-576: Allow co-release of Resolver 1.x and 2.x
Upgrade to upstream version 1.9.20
* Bug
+ MRESOLVER-483: PreorderNodeListGenerator bug: may print
trailing ':'
+ MRESOLVER-522: File locking threads not entering critical
region were 'oversleeping'
+ MRESOLVER-547: BF collector always copies artifacts, even
when it should not
* Improvement
+ MRESOLVER-536: Skip setting last modified time when FS does
not support it
- Add dependency on plexus-xml where relevant
* this will be needed for smooth upgrade to plexus-utils 4.0.0
Upgrade to upstream version 1.9.18
* Bug
+ MRESOLVER-372: Sporadic AccessDeniedEx on Windows
+ MRESOLVER-441: Undo FileUtils changes that altered non-Windows
execution path
* Improvement
+ MRESOLVER-396: Native transport should retry on HTTP 429
(Retry-After)
* Task
+ MRESOLVER-397: Deprecate Guice modules
+ MRESOLVER-405: Get rid of component name string literals, make
them constants and reusable
+ MRESOLVER-433: Expose configuration for inhibiting
Expect-Continue handshake in 1.x
+ MRESOLVER-435: Refresh download page
+ MRESOLVER-437: Resolver should not override given HTTP
transport default use of expect-continue handshake
Upgrade to upstream version 1.9.15
* Bug
+ MRESOLVER-373: Remove lock upgrading code
+ MRESOLVER-375: Several key aspects are broken in provided and
trusted checksum feature
+ MRESOLVER-376: StackOverflowError at
BfDependencyCollector.processDependency
+ MRESOLVER-380: Lock diagnostic: attempted lock step is
recorded, but on failed attempt is not removed
+ MRESOLVER-393: Transport HTTP does not retain last modified as
sent by remote end
* Improvement
+ MRESOLVER-220: Modify signaling for unsupported operations
+ MRESOLVER-382: Define local outgoing (bind) address
+ MRESOLVER-385: Reduce default value for
aether.connector.http.connectionMaxTtl
* Task
+ MRESOLVER-378: Update parent POM to 40
+ MRESOLVER-381: Undo MRESOLVER-373 as it was fixed by other
means
+ MRESOLVER-386: Make all injected ctors public, deprecate all
def ctors
+ MRESOLVER-388: Transport HTTP old codec proper override
Upgrade to upstream version 1.9.12
* Bug
+ [MRESOLVER-371] Unjustified WARNING log added by
MRESOLVER-364
+ [MRESOLVER-361] Unreliable TCP and retries on upload
+ [MRESOLVER-357] ConflictResolver STANDARD verbosity
misbehaves
+ [MRESOLVER-352] Duplicate METADATA_DOWNLOADING event is
being sent
* Improvement
+ [MRESOLVER-360] disable checksum by default for .sigstore
in addition to .asc
* New Feature
+ [MRESOLVER-370] Lock factory should dump lock states on
failure
+ [MRESOLVER-353] Make aether.checksums.algorithms settable
per remote repository
* Task
+ [MRESOLVER-366] Upgrade build plugins
+ [MRESOLVER-364] Revert MRESOLVER-132
+ [MRESOLVER-359] Make build be explicit about build time
requirements
+ [MRESOLVER-356] Remove Guava (is unused)
+ [MRESOLVER-354] Document expected checksums
Upgrade to upstream version 1.9.8
* Bug
+ [MRESOLVER-345] Conflict resolution in verbose mode is
sensitive to version ordering
+ [MRESOLVER-348] SslConfig httpSecurityMode change is not
detected
+ [MRESOLVER-339] Preemptive Auth broken when default ports used
+ [MRESOLVER-325] [REGRESSION] Suddenly seeing I/O errors under
windows aborting the build
+ [MRESOLVER-330] Static name mapper is unusable with file-lock
factory
+ [MRESOLVER-314] Getting 'IllegalArgumentException: Comparison
method violates its general contract!'
+ [MRESOLVER-316] DF collector enters endless loop when
collecting org.webjars.npm:musquette:1.1.1
+ [MRESOLVER-298] javax.inject should be provided or optional
+ [MRESOLVER-305] Evaluate blocked repositories also when
retrieving metadata
+ [MRESOLVER-309] PrefixesRemoteRepositoryFilterSource aborts
the build while it should not
+ [MRESOLVER-313] Artifact file permissions are 0600 and not
implicitly set by umask
+ [MRESOLVER-296] FileProcessor.write( File, InputStream ) is
defunct
+ [MRESOLVER-292] Documented and used param names mismatch
+ [MRESOLVER-294] Fix JapiCmp configuration and document it
+ [MRESOLVER-285] File locking on Windows knows to misbehave
+ [MRESOLVER-246] m-deploy-p will create hashes for hashes
+ [MRESOLVER-265] Discrepancy between produced and recognized
checksums
+ [MRESOLVER-241] Resolver checksum calculation should be driven
by layout
+ [MRESOLVER-242] When no remote checksums provided by layout,
transfer inevitably fails/warns
+ [MRESOLVER-250] Usage of descriptors map in DataPool prevents
gargabe collection
* New Feature
+ [MRESOLVER-32] Support parallel artifact/metadata uploads
+ [MRESOLVER-319] Support parallel deploy
+ [MRESOLVER-297] Chained LRM
+ [MRESOLVER-167] Support forcing specific repositories for
artifacts
+ [MRESOLVER-268] Apply artifact checksum verification for any
resolved artifact
+ [MRESOLVER-274] Introduce Remote Repository Filter feature
+ [MRESOLVER-275] Introduce trusted checksums source
+ [MRESOLVER-276] Resolver post-processor
+ [MRESOLVER-278] BREAKING: Introduce RepositorySystem shutdown
hooks
+ [MRESOLVER-236] Make it possible to resolve .asc on a 'fail'
respository.
* Improvement
+ [MRESOLVER-346] Too eager locking
+ [MRESOLVER-347] Better connection pool configuration (reuse,
max TTL, maxPerRoute)
+ [MRESOLVER-349] Adapter when locking should 'give up and
retry'
+ [MRESOLVER-350] Get rid of commons-lang dependency
+ [MRESOLVER-327] Make tranport-http obey system properties
regarding proxy settings
+ [MRESOLVER-340] Make WebDAV 'dance' disabled by default
+ [MRESOLVER-341] Add option for preemptive PUT Auth
+ [MRESOLVER-315] Implement preemptive authentication feature
for transport-http
+ [MRESOLVER-328] The transport-http should be able to ignore
cert errors
+ [MRESOLVER-337] Real cause when artifact not found with
repository filtering
+ [MRESOLVER-287] Get rid of deprecated finalize methods
+ [MRESOLVER-317] Improvements for BF collector
+ [MRESOLVER-318] Cleanup redundant code and centralize executor
handling
+ [MRESOLVER-303] Make checksum detection reusable
+ [MRESOLVER-290] Improve file handling resolver wide
+ [MRESOLVER-7] Download dependency POMs in parallel in BF
collector
+ [MRESOLVER-266] Simplify adapter creation and align
configuration for it
+ [MRESOLVER-269] Allow more compact storage of provided
checksums
+ [MRESOLVER-273] Create more compact File locking layout/mapper
+ [MRESOLVER-284] BREAKING: Some Sisu parameters needs to be
bound
+ [MRESOLVER-286] Improve basic connector closed state handling
+ [MRESOLVER-240] Using breadth-first approach to resolve Maven
dependencies
+ [MRESOLVER-247] Avoid unnecessary dependency resolution by a
Skip solution based on BFS
+ [MRESOLVER-248] Make DF and BF collector implementations
coexist
* Task
+ [MRESOLVER-326] Resolver transport-http should retry on
failures
+ [MRESOLVER-331] Make DefaultTrackingFileManager write directly
to tracking files
+ [MRESOLVER-333] Distinguish better resolver errors for
artifact availability
+ [MRESOLVER-320] Investigate slower resolving speeds as
reported by users
+ [MRESOLVER-291] Undo MRESOLVER-284
+ [MRESOLVER-279] Simplify and improve trusted checksum sources
+ [MRESOLVER-281] Update configurations page with new elements
+ [MRESOLVER-282] Drop PartialFile
+ [MRESOLVER-230] Make supported checksum algorithms extensible
+ [MRESOLVER-231] Extend 'smart checksum' feature
+ [MRESOLVER-234] Introduce 'provided' checksums feature
+ [MRESOLVER-237] Make all checksum mismatches handled same
+ [MRESOLVER-239] Update and sanitize dependencies
+ [MRESOLVER-244] Deprecate FileTransformer API
+ [MRESOLVER-245] Isolate Hazelcast tests
* Dependency upgrade
+ [MRESOLVER-311] Upgrade Parent to 39
+ [MRESOLVER-293] Update dependencies, align with Maven
+ [MRESOLVER-272] Update parent POM to 37, remove plugin version
overrides, update bnd
+ [MRESOLVER-280] Upgrade invoker, install, deploy, require
maven 3.8.4+
+ [MRESOLVER-251] Upgrade Redisson to 3.17.5
+ [MRESOLVER-249] Update Hazelcast to 5.1.1 in
named-locks-hazelcast module
- Add an alias for the wagon connector
- Build against the standalone JavaEE modules unconditionally
- Remove the javax.annotation:javax.annotation-api dependency on
distribution versions that do not incorporate the JavaEE modules
- Add the glassfish-annotation-api jar to the build classpath
Upgrade to upstream version 1.7.3
* Bug
+ [MRESOLVER-96] - Dependency Injection fails after upgrading
to Maven 3.6.2
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ an
run on Java 8 due to JDK API breakage
+ [MRESOLVER-189] - Using semaphore-redisson followed by
rwlock-redisson on many parallel build of the same project
triggers redisson error
* New Feature
+ [MRESOLVER-90] - HTML content in POM: Maven should validate
content before storing in local repo
+ [MRESOLVER-145] - Introduce more SyncContext implementations
* Improvement
+ [MRESOLVER-103] - Replace deprecated HttpClient classes
+ [MRESOLVER-104] - maven-resolver-demo-maven-plugin uses
reserved artifactId
+ [MRESOLVER-147] Upgrade to Java 8
+ [MRESOLVER-148] - Use vanilla Guice 4 instead of forked
Guice 3
+ [MRESOLVER-156] - Active dependency management for Google
Guice/Guava
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
+ [MRESOLVER-193] - Properly type lock key names in Redis
+ [MRESOLVER-197] - Minors improvements (umbrella)
+ [MRESOLVER-204] - Add a SessionData#computeIfAbsent method
+ [MRESOLVER-214] - Remove clirr configuration
* Task
+ [MRESOLVER-141] - Review index-based access to collections
+ [MRESOLVER-151] - Enforce a checksum policy to be provided
explicitly
+ [MRESOLVER-152] - Perform null checks when interface
contracts require it
+ [MRESOLVER-154] - Move SyncContextFactory interface to SPI
module
+ [MRESOLVER-155] - Make TrackingFileManager member of
DefaultUpdateCheckManager
+ [MRESOLVER-158] - Simplify SimpleDigest class
+ [MRESOLVER-159] - Mark singleton components as Sisu Singletons
+ [MRESOLVER-160] - Deprecate ServiceLocator
+ [MRESOLVER-162] - Restore binary compatibility broken by
MRESOLVER-154
+ [MRESOLVER-170] - Deprecate org.eclipse.aether.spi.log
+ [MRESOLVER-172] - Make TrackingFileManager shared singleton
component
+ [MRESOLVER-173] - Drop deprecated AetherModule
+ [MRESOLVER-174] - Use all bindings in UTs and tests
+ [MRESOLVER-175] - Drop SyncContextFactory delegates in favor
of a selector approach
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
+ [MRESOLVER-183] - Don't require optional dependencies for
Redisson
+ [MRESOLVER-184] - Destroy Redisson semaphores if not used
anymore
+ [MRESOLVER-186] Update Maven version in Resolver Demo
Snippets
+ [MRESOLVER-188] - Improve documentation on using the named
locks with redis/hazelcast (umbrella)
+ [MRESOLVER-190] - [Regression] Revert MRESOLVER-184
+ [MRESOLVER-191] - Document how to analyze lock issues
+ [MRESOLVER-196] - Document named locks configuration options
+ [MRESOLVER-219] - Implement NamedLock with advisory file
locking
+ [MRESOLVER-227] - Refactor NamedLockFactorySelector to a
managed component
+ [MRESOLVER-232] - Make SimpleNamedLockFactorySelector logic
reusable
* Sub-task
+ [MRESOLVER-198] - Replace assert by simpler but equivalent
calls
+ [MRESOLVER-199] - Java 8 improvements
+ [MRESOLVER-200] - Simplify conditions with the same result
and avoid extra validations
+ [MRESOLVER-201] - Make variables final whenever possible
+ [MRESOLVER-202] - Use isEmpty() instead length() <= 0
* Dependency upgrade
+ [MRESOLVER-185] Upgrade Redisson to 3.15.6
* Change of API and incompatible with maven-resolver < 1.7
Upgrade to upstream version 1.6.3
* Bug
+ [MRESOLVER-153] - resolver-status.properties file is corrupted
due to concurrent writes
+ [MRESOLVER-171] - Resolver fails when compiled on Java 9+ and
run on Java 8 due to JDK API breakage
* Improvement
+ [MRESOLVER-168] - add DEBUG message when downloading an
artifact from repositories
* Task
+ [MRESOLVER-177] - Move pre-/post-processing of metadata from
ResolveTask to DefaultMetadataResolver
* Needed for maven 3.8.4
- Do not build/run the tests against the legacy guava20 package
Upgrade to upstream version 1.6.2
* Sub-task
+ [MRESOLVER-139] - Make SimpleDigest use SHA-1 or MD5 only
+ [MRESOLVER-140] - Default to SHA-1 and MD5 hashing algorithms
* Bug
+ [MRESOLVER-25] - Resume support is broken under high
concurrency
+ [MRESOLVER-114] - ArtifactNotFoundExceptions when building in
parallel
+ [MRESOLVER-129] - Exclusion has no setters
+ [MRESOLVER-137] - Make OSGi bundles reproducible
+ [MRESOLVER-138] - MRESOLVER-56 introduces severe performance
regression
* New Feature
+ [MRESOLVER-109] - AndDependencySelector should override
toString
+ [MRESOLVER-115] - Make checksum algorithms configurable
+ [MRESOLVER-123] - Provide a global locking sync context by
default
+ [MRESOLVER-131] - Introduce a Redisson-based
SyncContextFactory
+ [MRESOLVER-165] - Add support for mirror selector on
external:http:*
+ [MRESOLVER-166] - Add support for blocked
repositories/mirrors
* Improvement
+ [MRESOLVER-56] - Support SHA-256 and SHA-512 as checksums
+ [MRESOLVER-116] - Add page with all supported configuration
options
+ [MRESOLVER-125] - Use type conversions returning primitives
+ [MRESOLVER-127] - Don't use boolean for property
'aether.updateCheckManager.sessionState'
+ [MRESOLVER-136] - Migrate from maven-bundle-plugin to
bnd-maven-plugin
* Task
+ [MRESOLVER-119] - Turn log messages to SLF4J placeholders
+ [MRESOLVER-130] - Move GlobalSyncContextFactory to a separate
module
+ [MRESOLVER-132] - Remove synchronization in
TrackingFileManager
* Dependency upgrade
+ [MRESOLVER-105] Update Plexus Components
+ [MRESOLVER-106] Update HttpComponents
+ [MRESOLVER-107] Update Wagon Provider API to 3.4.0
+ [MRESOLVER-108] Update mockito-core to 2.28.2
+ [MRESOLVER-117] Upgrade SLF4J to 1.7.30
+ [MRESOLVER-118] Upgrade Sisu Components to 0.3.4
* Needed for maven 3.8.x
Upgrade to upstream version 1.4.2:
* Bug:
+ MRESOLVER-38 SOE/OOME in DefaultDependencyNode.accept
* Improvements:
+ MRESOLVER-93 PathRecordingDependencyVisitor to handle 3 cycles
+ MRESOLVER-102 make build Reproducible
Upgrade to upstream version 1.4.1:
* Task
+ [MRESOLVER-92] - Revert MRESOLVER-7
* Bug
+ [MRESOLVER-86] - ResolveArtifactMojo from resolver example
uses plugin repositories to resolve dependencies
* New Feature
+ [MRESOLVER-10] - New 'TransitiveDependencyManager'
supporting transitive dependency management
+ [MRESOLVER-33] - New 'DefaultDependencyManager' managing
dependencies on all levels supporting transitive dependency
management
* Improvement
+ [MRESOLVER-7] - Download dependency POMs in parallel
+ [MRESOLVER-84] - Add support for 'release' qualifier
+ [MRESOLVER-87] - Refresh examples to use maven-resolver
artifacts for demo
+ [MRESOLVER-88] - Code style cleanup to use Java 7 features
- Initial packaging of maven-resolver 1.3.1
Update to upstream version 2.0.24
* New features and improvements
+ Fix PathConflictResolver OOM on dense dependency graphs
* Bug Fixes
+ Fix flaky IpcClientForkedTest on Windows
+ fix: synchronize IPC stream access
+ fix: propagate fatal errors from Jetty request content
+ Use structured logging in the IPC server
+ MRESOLVER-2142: Increase HTTP3 port allocation retries
+ Honor system proxy credentials in Apache transport
* Documentation updates
+ docs: rewrite how-resolver-works.md to STE rules
+ docs: refresh resolver misconception references
+ docs: clarify checksum trust boundaries
+ fix: correct config filename to .mvn/maven.config
+ Use configuration key as link label
* Dependency updates
+ Bump org.apache.maven:maven-parent from 49 to 50
+ Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1
to 3.6.2
+ Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4
+ Bump dev.sigstore:sigstore-java from 2.2.0 to 2.3.0
Update to upstream version 2.0.23
* New features and improvements
+ Finish the repo key story
+ Fix: log only once the warning in DefRemoteRepoMan
+ Fix #2058: Add links to configuration page
+ Eliminate per-node HashSet allocation in PathConflictResolver
* Bug Fixes
+ fix: accept locally cached artifacts via same-id fallback when
tracking URL changes
+ Fix listener error swallowing
+ MRESOLVER-379: Preserve relocated candidates from version
ranges
+ Create the local repository directory before resolving its
real path
+ Optimize TrackingFileManager unit tests and fix potential lock
leaks
+ Validate the repository key used in checksum summary file
names
+ fix: bound response reads and sanitize remote-derived strings
+ fix: earn trust labels through verification and bind tracking
to URL
+ fix: bind credentials to origin and reject TLS downgrade
redirects
+ fix: prevent remote signals from weakening operator-configured
policy
+ fix: atomic file publication and authenticated IPC lock daemon
+ fix: deploy-side integrity must fail closed
+ fix: harden opt-in transport and lock backends against
unauthenticated infrastructure
+ Compose named lock keys one segment per coordinate field
+ Resolve file transport locations with path operations instead
of substring matching
+ Validate coordinate components in the Maven 2 layout and local
path composer
* Documentation updates
+ docs: Clarify trusted checksum sources
+ Fix #2058: Add links to configuration page
* Maintenance
+ test: move from minio docker image
+ Fix listener error swallowing
+ Fix: tidy up f013
+ Fix #2096: harden NamedLocksTrackingFileManagerTest against CI
load
+ Carry repository provenance into aggregateRepositories
+ Validate the repository key used as a local repository path
segment
* Dependency updates
+ Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from
3.15.2 to 3.16.0
+ Bump version.slf4j from 2.0.18 to 2.0.19
+ Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.26.1 to 0.26.2
+ Deps: bump to BC provider 1.85.2
+ Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2
+ Bump org.codehaus.plexus:plexus-xml from 4.1.1 to 4.2.0
+ Stop dependabot from offering guice 7 on the 1.9.x line
Update to upstream version 2.0.22
* New features and improvements
+ Fix #1994: log exceptions from IpcNamedLock.tryUnlock()
+ Consider 'Retry-After' header in Java HTTP Client
+ Fix compilation error in DefaultRepositorySystemReentrancyTest
+ Extend re-entrancy detection for broken trace chains
+ Fix #2013: optimize TransitiveDependencyManager performance
+ Extract included checksums from x-amz-meta-* headers
+ Enh: Allow validator factory to abstain
* Bug Fixes
+ Fix InterruptedException silently dropping task in
SmartExecutor.Limited.submit(Runnable)
+ Documentation updates
+ docs: rewrite expected-checksums.md to STE rules
+ Support deprecated tag.
+ Reconcile the two download pages and modernise them
+ Convert the index page from xdoc to Markdown
+ docs: rewrite creating-a-repository-system-session.md to STE
rules
+ docs: rewrite common-misconceptions.md to ASD-STE100 rules
+ docs: rewrite deployment.md in ASD-STE100 Simplified Technical
English
+ docs: rewrite dependency-graph.md in ASD-STE100 Simplified
Technical English
+ docs: rewrite about-checksums.md to STE rules
+ docs: rewrite api-compatibility.md to STE rules
+ Docs: rewrite what-is-resolver page in Simplified Technical
English (ASD-STE100)
+ Fix documentation issues across site docs
+ Improve rendering of javadoc content
+ Edit version comparison
* Maintenance
+ Drop the versions.junit5 property the parent already provides
+ Fix #1998: use try-with-resources in test file utilities
+ Convert the index page from xdoc to Markdown
+ Use https in license URLs as recommended by ASF
+ Exclude ODG graphics from RAT checks
+ Build against Maven 4.0.0-rc-6
+ Fix resource leak pattern in
DependencyGraphParser.parseLiteral()
+ Replace printStackTrace with proper error handling
* Build
+ Improve error reporting
+ .gitignore .vscode/
+ Improve rendering of javadoc content
Update to upstream version 2.0.21
* New features and improvements
+ Reduce PathConflictResolver memory and auto-select resolver
+ Fix dependency selector cache regression in DF collector
+ Fix thread contention in GenericVersionScheme and
WeakInternPool
+ Improve thread safety across modules
+ WarnChecksumPolicy: proceed on no checksums
+ Extend AuthenticationBuilder to support SSLContext for mTLS
authentication
+ DependencyCollectionChecker: new session member
+ Add any media type to RFC9457 content type header
+ fix: Configuration to be able to control sending RFC 9457
related Accept HTTP header
+ Improvement: BF dependency selector hot methods
* Bug Fixes
+ Fix ApacheTransport auth cache CCEx
+ Checksums: lack of information
+ Fix inverted SIGTSTP condition in IPC server
+ Bug: fix IPC named lock client-side robustness for Windows
+ Bugfix: Fix NPE in PathConflictResolver
+ Bug: fix IPC named lock server-side waiter leak on client
timeout
+ Bug: fix new PCR as it in certain cases left duplicates
* Documentation updates
+ Javadoc update
+ Doc: Trusted Checksums Summary File Procedure
* Maintenance
+ Put PCR aside for now
+ Get rid of BND warnings
+ Align generators
+ Fix for ChainedWorkspaceReader
+ Create simple JMH benchmark to compare CCR and PCR
+ Tidy up suppliers
+ Disable IPC lock tests on Windows
* Dependency updates
+ Bump org.apache.maven:maven-parent from 48 to 49
+ Bump roasterVersion from 2.31.0.Final to 2.31.1.Final
+ Bump sisuVersion from 1.0.0 to 1.0.1
+ Bump org.redisson:redisson from 4.4.0 to 4.6.1
+ Deps: Jetty 12.1.10
+ Bump io.minio:minio from 9.0.0 to 9.0.3
+ Bump dev.sigstore:sigstore-java from 2.0.0 to 2.2.0
+ Bump okhttpVersion from 5.3.2 to 5.4.0
+ Bump biz.aQute.bnd:bnd-maven-plugin from 7.2.3 to 7.3.0
+ Bump com.github.siom79.japicmp:japicmp-maven-plugin from
0.25.7 to 0.26.1
+ Bump org.ow2.asm:asm from 9.9.1 to 9.10.1
+ Bump org.codehaus.plexus:plexus-classworlds from 2.11.0 to
2.12.0
+ Bump maven3Version from 3.9.15 to 3.9.16
- Allow building the modules that can be built using Java 8 on
distribution that don't provide Java 17. This allows to build
maven 3.10.x everywhere where it could be built before.
Update to upstream version 2.0.20:
* Breaking Changes & Compatibility
+ Major Version API/SPI Shift: Version 2.0.x is a major
architectural overhaul designed to support the upcoming Maven
4.x and Maven 3.10.x branches. The 1.x lineage is now
officially in 'bugfix only' maintenance mode.
+ Removal of ServiceLocator: The long-deprecated Plexus
ServiceLocator integration has been entirely removed. It
conflicted with modern constructor-based Dependency Injection
(Eclipse Sisu).
+ Scope Unawareness: Maven Resolver 2.x is now completely
scope-unaware. Dependency scopes are treated merely as
transparent labels by the core resolver. Scope handling is now
fully delegated to the consumer project (e.g., Maven itself).
+ Delegation of Classpaths: Classpath generation
(NodeListGenerator) and classpath filtering
(DependencyFilterUtils), as well as default ArtifactType
implementations, have been deprecated/removed from the core
and delegated to consumer applications via the
maven-resolver-provider module.
* Architectural & Lifecycle Enhancements
+ Session Lifecycle Redesign (Resource Leaks): Introduced
SessionBuilder and CloseableSession nested interfaces to
replace the legacy DefaultRepositorySystemSession constructor
mechanism. Sessions now utilize onSessionEnd hooks and must be
explicitly closed when finished. This change is critical to
prevent resource leaks when using modern networking features
like HTTP/2 transports.
- Require maven-parent >= 50 in order to interpolate correctly the
versions of default plugins for different lifecycles
Upgrade to upstream release 3.10.0
* New features and improvements
+ Maven 3.10.x should use Maven 3.1 validation in strict mode
+ Do not depend on maven-resolver-supplier-mvn3
+ MNG-6797: Remember if Maven model problems were encountered.
+ feat: add relativePath validation
+ Add validation for Plexus-based plugin dependency injection
+ Introduce validation control
+ Update to Resolver 2.0.21
+ MNG-5913: Allow defining aliases for existing server
configurations in settings.xml
* Bug Fixes
+ Issue #13265: let a settings server declare the repository
origins its credentials may be used with
+ Backport #13040: treat reactor BOM imports as ProjectSorter
edges so -am includes them
+ MNG-8174: Fix NPE when a property references itself in a
plugin configuration (backport #12932)
+ Fix #13200: publish a complete set from
MavenProject.getArtifacts
+ Fixes #13135: ensure completeness of the reactor summary,
privilege failures last
+ Fix #13084: sandbox profile activation context for external
model builds
+ Fix #13100: honor repositories from legitimately-active
external model profiles
+ Add support for MAVEN_PROJECTBASEDIR substitution in
jvm.config (backport of MNG-8598 to 3.10.x)
+ Scope server credentials and validate legacy relocation
coordinates
+ Honour configured policy and validate inputs on the legacy
compat paths
+ Add unit test for #12600 null-guard in forked executions
+ Fix: make ProjectIndex thread-safe for parallel builds
+ Fail on misconfigured plugin-requested toolchains
+ Resolve classified POM artifacts from the reactor in Maven 3.x
+ Convert paths for MSYS2 and jvm.config placeholders in bin/mvn
+ Preserve dependency scope in plugin artifacts
* Documentation updates
+ docs: document plugin.xml V4 vs V3
+ Port the site documentation from APT to Markdown
+ improve doc about deprecating plugin descriptor's requirement
+ Drop mention of Plexus XML
* Maintenance
+ maintenance: Align use of profiles
+ Remove version from rat directory deployment
+ Update NOTICE file in distribution packages
+ Restrict what a repository-resolved model contributes to the
build
+ Validate coordinates and repository precedence during artifact
resolution
+ MNG-8129: Clarify relativePath validation comment
+ Keep plexus-cipher at 2.0: POM note
+ Use try-with-resources
+ Migrate the embedder-test-project fixture to JUnit 5
+ Port the site documentation from APT to Markdown
+ Migrate legacy plugin Javadoc annotations in Maven Embedder
tests
+ Replace custom GraphLogger with DependencyGraphDumper in
dependency resolution
+ Fix UT: do not use checkout directly
Upgrade to upstream preview version 3.10.0-rc-1
- Notable Changes:
* New Features and Improvements
+ use Resolver 2.x
+ allow defining user-wide and installation-wide Maven
extensions
+ Reproducible Builds is active by default
+ promote session.topDirectory, session.rootDirectory and
project.rootDirectory properties
+ version range filtering
+ allow defining user relocations
+ allow using transitive dependency manager
+ in a failed build limit reactor summary to only failed modules
+ new CLI options for fine-grained update policy control:
-UA (force artifact updates only),
-UM (force metadata updates only),
--artifacts-update-policy=<policy>,
--metadata-update-policy=<policy>
* New API and Updates for Maven Plugins
+ upgrade SLF4J to 2.x
+ promote MessageBuilderFactory service for colored message
support
+ promote java version in JavaToolchain
- Potentially Breaking Core Changes (if migrating from 3.9.x)
* Classpath ordering change
+ Dependency classpath ordering changed from 'pre-order'
(depth-first) to 'level-order' (breadth-first), aligning with
Maven 4 behavior and Resolver 2.x defaults.
+ To restore the previous behavior, add
-Daether.system.dependencyVisitor=preOrder to your Maven
invocation.
* Changes in the Super POM:
+ removed deprecated release-profile; each project should have
its own release profile
+ removed plugin management; each project should have its own
plugin management
+ set default values for project.build.sourceEncoding and
project.reporting.outputEncoding to UTF-8
+ avoid cycle between maven-resolver-supplier-mvn3 from
maven-resolver and maven-resolver-provider from this build
that are the dependencies of each other
+ The Maven Resolver transport has changed from Wagon to 'native
HTTP', see Resolver Transport guide.
- Initial packaging with version 1.9.0
Upgrade to 2.0.20:
* Changes
+ Marker instances are slated to become immutable in future
releases. As such, methods in the Marker interface
adding/removing children are now marked as deprecated.
Changes of version 2.0.19:
* Changes
+ When the fluent API was used with XLogger/LoggerWrapper in the
slf4j-ext module, caller location was incorrectly reported. To
correct this, LoggerWrapper now delegates
makeLoggingEventBuilder() to the wrapped logger so that the
application caller can be correctly extracted.
+ In slf4j-api/DefaultLoggingEventBuilder, a failing toString()
invocation on a key-value value, including StackOverflowError,
no longer aborts logging. The builder now substitutes [FAILED
toString()], matching the existing behaviour of
MessageFormatter for message arguments.
+ The isLoggable() method in SLF4JPlatformLogger now maps
System.Logger.Level.ALL and Level.OFF the same way as log(),
that is ALL as TRACE and OFF as ERROR, instead of treating
both as always loggable.
+ Published JAR files now package each module's own LICENSE.txt
under META-INF/. Previously the parent POM copied the
repository-root MIT license into every module, so Apache-2.0
modules such as jcl-over-slf4j and log4j-over-slf4j shipped
the wrong license text.
Upgrade to 2.0.18:
* Breaking Changes & Compatibility
+ Minimum Java Requirement Bump: The baseline Java requirement
has been upgraded from Java 5 (in the 1.7.x series) to Java 8.
+ New Backend Discovery Mechanism: SLF4J no longer relies on the
legacy StaticLoggerBinder class-path search mechanism. It has
fully migrated to using the Java ServiceLoader mechanism (SPI)
to discover logging backends. Downstream logging providers
(like Logback or SLF4J bridges) must be updated to versions
that support ServiceLoader to function with SLF4J 2.x.
+ Explicit Provider Override: Introduced the slf4j.provider
system property, allowing administrators or developers to
explicitly specify the logging provider class, bypassing the
ServiceLoader mechanism entirely for faster initialization.
* New Features & Enhancements
+ Fluent Logging API: Introduced a backward-compatible fluent
logging API (e.g., logger.atInfo().setMessage('...').log()).
Existing clients using the traditional logging methods do not
need to rewrite their code.
+ JPMS Modularity: SLF4J has been fully modularized in
accordance with the Java Platform Module System (JPMS)
specifications.
+ BOM Artifact: Introduced a Bill of Materials (BOM) file
(added in 2.0.8) to help downstream projects easily
synchronize and align versions across all org.slf4j bridge and
API packages.
* Notable Internal Fixes
+ MDC Initialization Race Condition: Fixed an edge-case bug
where the Mapped Diagnostic Context (MDC) could be initialized
before the LoggerFactory, which occasionally resulted in the
MDC getting stuck using an incorrect MDCAdapter instance.
The following package changes have been done:
- apache-commons-cli-1.9.0-150200.3.11.1 updated
- glassfish-annotation-api-1.3.2-150200.3.6.1 updated
- httpcomponents-core-4.4.14-150200.3.11.1 updated
- jline3-native-3.30.17-150200.5.11.1 added
- libopenssl1_1-1.1.1w-150700.11.35.1 added
- maven-resolver-api-2.0.24-150200.3.32.3 updated
- slf4j-2.0.20-150200.3.7.1 updated
- google-gson-2.14.0-150200.3.13.2 updated
- jline3-terminal-3.30.17-150200.5.11.1 added
- libpython3_6m1_0-3.6.15-150300.10.129.1 added
- python3-base-3.6.15-150300.10.129.1 added
- python3-3.6.15-150300.10.129.1 added
- maven-resolver-util-2.0.24-150200.3.32.3 updated
- maven-wagon-provider-api-3.5.3-150200.3.10.1 updated
- httpcomponents-client-4.5.14-150200.3.14.2 updated
- maven-resolver-named-locks-2.0.24-150200.3.32.3 updated
- jcl-over-slf4j-2.0.20-150200.3.7.1 updated
- maven-resolver-spi-2.0.24-150200.3.32.3 updated
- jline3-terminal-jni-3.30.17-150200.5.11.1 added
- jline3-jansi-core-3.30.17-150200.5.11.1 added
- maven-wagon-file-3.5.3-150200.3.10.1 updated
- maven-wagon-http-shared-3.5.3-150200.3.10.1 updated
- maven-resolver-transport-wagon-2.0.24-150200.3.32.3 updated
- maven-resolver-transport-file-2.0.24-150200.3.32.3 updated
- maven-resolver-transport-apache-2.0.24-150200.3.32.3 added
- maven-resolver-impl-2.0.24-150200.3.32.3 updated
- maven-resolver-connector-basic-2.0.24-150200.3.32.3 updated
- maven-wagon-http-3.5.3-150200.3.10.1 updated
- maven-lib-3.10.0-150200.4.36.1 updated
- maven-3.10.0-150200.4.36.1 updated
- cal10n-0.8.1.10-150200.11.6.3 removed
- hamcrest-3.0-150200.12.22.1 removed
- jansi-2.4.0-150200.3.9.1 removed
- junit-4.13.2-150200.3.17.1 removed
- maven-resolver-transport-http-1.9.27-150200.3.29.1 removed
- maven-shared-utils-3.4.2-150200.3.10.1 removed
More information about the sle-container-updates
mailing list