Skip to content

Update maven.version#165

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/maven.version
Open

Update maven.version#165
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/maven.version

Conversation

@renovate

@renovate renovate Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
org.apache.maven:maven-settings-builder (source) 3.0.5 → 3.9.16 age confidence
org.apache.maven:maven-settings (source) 3.0.5 → 3.9.16 age confidence
org.apache.maven:maven-artifact (source) 3.0.5 → 3.9.16 age confidence
org.apache.maven:maven-model (source) 3.0.5 → 3.9.16 age confidence
org.apache.maven:maven-core (source) 3.0.5 → 3.8.1 age confidence
org.apache.maven:maven-aether-provider (source) 3.0.5 → 3.3.9 age confidence
org.apache.maven:maven-plugin-api (source) 3.0.5 → 3.9.16 age confidence

Origin Validation Error in Apache Maven

CVE-2021-26291 / GHSA-2f88-5hg8-9x2x

More information

Details

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html

Severity

  • CVSS Score: 9.1 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

apache/maven (org.apache.maven:maven-settings-builder)

v3.9.16: 3.9.16

🐛 Bug Fixes

📦 Dependency updates

v3.9.15: 3.9.15

📝 Documentation updates

📦 Dependency updates

v3.9.14: 3.9.14

🐛 Bug Fixes

📦 Dependency updates

v3.9.13: 3.9.13

🐛 Bug Fixes

👻 Maintenance

📦 Dependency updates

v3.9.12: 3.9.12

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates

v3.9.11: 3.9.11

🚀 New features and improvements

🐛 Bug Fixes

👻 Maintenance

🔧 Build

📦 Dependency updates

v3.9.10: 3.9.10

Release Notes - Maven - Version 3.9.10

Bug

  • [MNG-8096] - Inconsistent dependency resolution behaviour for concurrent multi-module build can cause failures
  • [MNG-8169] - MINGW support requires --add-opens java.base/java.lang=ALL-UNNAMED
  • [MNG-8170] - Maven 3.9.8 contains weird native library for Jansi on Windows/arm64
  • [MNG-8211] - Maven should fail builds that use CI Friendly versions but have no values set
  • [MNG-8248] - WARNING: A restricted method in java.lang.System has been called
  • [MNG-8256] - ProjectDependencyGraph bug: in case of filtering, non-direct module links are lost
  • [MNG-8315] - Failure of mvn.cmd if a .mvn directory is located at drive root
  • [MNG-8396] - Maven takes forever to resume
  • [MNG-8711] - "Duplicate artifact" in LifecycleDependencyResolver

Improvement

  • [MNG-8370] - Introduce maven.repo.local.head
  • [MNG-8399] - JDK 24+ issues warning about usage of sun.misc.Unsafe
  • [MNG-8707] - Add methods to remove compile and test source roots
  • [MNG-8712] - improve dependency version explanation: it&#​39;s a requirement, not always effective version
  • [MNG-8717] - Remove maven-plugin-plugin:addPluginArtifactMetadata from default binding
  • [MNG-8722] - Use a single standalone version of asm
  • [MNG-8731] - Use https for xsi:schemaLocation in generated descriptors
  • [MNG-8734] - Simplify scripting like "get project version" cases

Task

  • [MNG-8728] - Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 and use Java 24 on CI

Dependency upgrade

  • [MNG-8289] - Update Plexus annotations to 2.2.0
  • [MNG-8443] - Bump com.google.guava:guava from 33.2.1-jre to 33.4.0-jre
  • [MNG-8531] - Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 3.6.0
  • [MNG-8532] - Bump commons-io:commons-io from 2.16.1 to 2.18.0
  • [MNG-8534] - Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.0 to 3.2.1
  • [MNG-8635] - Bump com.google.guava:failureaccess from 1.0.2 to 1.0.3
  • [MNG-8636] - Bump com.google.guava:guava from 33.4.0-jre to 33.4.5-jre
  • [MNG-8640] - Bump org.apache.maven:maven-parent from 43 to 44
  • [MNG-8661] - Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre
  • [MNG-8701] - Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28
  • [MNG-8702] - Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0
  • [MNG-8703] - Bump commons-io:commons-io from 2.18.0 to 2.19.0
  • [MNG-8704] - Bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre
  • [MNG-8705] - Bump commons-jxpath:commons-jxpath from 1.3 to 1.4.0
  • [MNG-8706] - Bump commons-cli:commons-cli from 1.8.0 to 1.9.0
  • [MNG-8715] - Bump org.fusesource.jansi:jansi from 2.4.1 to 2.4.2
  • [MNG-8716] - Bump resolver to 1.9.23
  • [MNG-8745] - Bump xmlunitVersion from 2.10.0 to 2.10.2

What's Changed

New Contributors

Full Changelog: apache/maven@maven-3.9.9...maven-3.9.10

v3.9.9: 3.9.9

Release Notes - Maven - Version 3.9.9

Bug

  • [MNG-8159] - Fix search for topDirectory when using -f / --file for Maven 3.9.x
  • [MNG-8165] - Maven does not find extensions for -f when current dir is root
  • [MNG-8177] - Warning "&#​39;dependencyManagement.dependencies.dependency.systemPath&#​39; for com.sun:tools:jar refers to a non-existing file C:\Temp\jdk-11.0.23\..\lib\tools.jar"
  • [MNG-8178] - Profile activation based on OS properties is broken for "mvn site"
  • [MNG-8180] - Resolver will blindly assume it is deploying a plugin by presence of META-INF/maven/plugins.xml in JAR
  • [MNG-8182] - Missing or mismatching Trusted Checksum for some artifacts is not properly reported
  • [MNG-8188] - [REGRESSION] Property not resolved in profile pluginManagement

Task

  • [MNG-8206] - Remove Maven 2.1 (v 2.0) compatibility bits

Dependency upgrade

What's Changed

New Contributors

Full Changelog: apache/maven@maven-3.9.8...maven-3.9.9

v3.9.8: 3.9.8

Release Notes - Maven - Version 3.9.8

Bug

  • [MNG-7758] - o.e.aether.resolution.ArtifactResolutionException incorrectly examined when multiple repositories are involved
  • [MNG-8066] - Maven hangs on self-referencing exceptions
  • [MNG-8116] - Plugin configuration can randomly fail in case of method overloading as it doesn&#​39;t take into account implementation attribute
  • [MNG-8131] - Property replacement in dependency pom no longer works
  • [MNG-8135] - Profile activation based on OS properties is no longer case insensitive
  • [MNG-8142] - If JDK profile activator gets "invalid" JDK version for whatever reason, it chokes but does not tell why
  • [MNG-8147] - Profile interpolation broke their evaluation in case of duplicate IDs

Improvement

  • [MNG-7902] - Sort plugins in validation report
  • [MNG-8140] - When a model is discarded (by model builder) for whatever reason, show why it happened
  • [MNG-8141] - Model Builder should report if not sure about "fully correct" outcome
  • [MNG-8150] - Make SimplexTransferListener handle absent source/target files

Task

Dependency upgrade

  • [MNG-8136] - Update to Eclipse Sisu 0.9.0.M3
  • [MNG-8143] - Update to commons-cli 1.8.0
  • [MNG-8144] - Update to Guava 32.2.1-jre
  • [MNG-8154] - Upgrade default plugin bindings

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants