dependabot[bot] opened a new pull request, #1715: URL: https://github.com/apache/maven-mvnd/pull/1715
Bumps `maven.version` from 4.0.0-rc-5 to 4.0.0-rc-6. Updates `org.apache.maven:maven-plugin-api` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-model` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-core` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-resolver-provider` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-embedder` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-cli` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-api-di` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-jline` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:maven-logging` from 4.0.0-rc-5 to 4.0.0-rc-6 Updates `org.apache.maven:apache-maven` from 4.0.0-rc-5 to 4.0.0-rc-6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/maven/releases";>org.apache.maven:apache-maven's releases</a>.</em></p> <blockquote> <h2>Maven 4.0.0-rc-6</h2> <h2>Notes</h2> <p>This new release candidate of Maven 4 is released to get feedback from users. Maven 4 has restricted a few things compared to Maven 3, so make sure to run the <a href="https://maven.apache.org/tools/mvnup.html#Plugin_Compatibility_.26_Upgrades";><code>mvnup</code></a> tool before trying your project with Maven 4.</p> <h3>Issues fixed since RC-5</h3> <p>All known issues reported in the RC-5 release notes have been fixed:</p> <ul> <li><strong>Bean configuration bug</strong> — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in <a href="https://redirect.github.com/apache/maven/pull/11433";>#11433</a>.</li> <li><strong>Concurrency issue in the v4 API</strong> — a <code>ConcurrentModificationException</code> was fixed in <a href="https://redirect.github.com/apache/maven/pull/11429";>#11429</a>.</li> <li><strong>BOM packaging</strong> — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in <a href="https://redirect.github.com/apache/maven/pull/11464";>#11464</a>.</li> <li><strong>macOS Gatekeeper</strong> — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution (<a href="https://redirect.github.com/apache/maven/pull/11997";>#11997</a>). The <code>xattr</code> workaround from RC-5 is no longer needed.</li> </ul> <h3>Known compatibility issues</h3> <p>The following are known compatibility issues when using Maven 4. Running <a href="https://maven.apache.org/tools/mvnup.html";><code>mvnup</code></a> before building with Maven 4 will fix many common plugin version issues automatically. The issues below are those that require manual intervention or upstream fixes.</p> <h4>Stricter POM validation</h4> <p>Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:</p> <ul> <li><strong>Duplicate XML elements</strong> — duplicate <code><artifactId></code>, <code><properties></code>, etc. are now rejected (<code>Duplicated tag</code> error). Fix the source POM.</li> <li><strong>Duplicate dependency declarations</strong> — same <code>groupId:artifactId</code> declared twice is now rejected (<code>must be unique</code>).</li> <li><strong>Uninterpolated expressions</strong> — <code>${...}</code> expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected.</li> <li><strong>Invalid XML in transitive POMs</strong> — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause <code>Non-parseable POM</code> errors.</li> <li><strong>Properties in <code><module></code> paths</strong> — Maven 4 no longer interpolates properties like <code>${spark.version}</code> in <code><module></code> elements at POM reading time.</li> <li><strong>CI-friendly versions</strong> — projects using <code>${revision}</code> without <code>flatten-maven-plugin</code> may hit missing dependency version errors.</li> <li><strong>Invalid Collect Request</strong> — transitive dependencies with uninterpolated <code>${...}</code> version expressions are rejected.</li> </ul> <h4>Transitive dependency resolution changes</h4> <p>Maven 4's <code>TransitiveDependencyManager</code> applies <code>dependencyManagement</code> at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:</p> <ul> <li>Dependencies previously on the classpath may disappear — add explicit declarations. See <a href="https://redirect.github.com/apache/maven/issues/12302";>#12302</a>.</li> <li><code>maven-enforcer-plugin</code> version rules may trigger due to downgraded transitive versions.</li> <li><code>license-maven-plugin</code> may report new transitive dependencies not in the allow-list.</li> <li>Karaf feature verification may fail due to OSGi bundle version mismatches.</li> </ul> <h4>Plugin and extension compatibility</h4> <p>Some plugins and extensions require specific versions for Maven 4:</p> <ul> <li><strong>Quarkus</strong> — versions before 3.20 use <code>ServiceLocator</code>/<code>RepositorySystem</code> patterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+.</li> <li><strong>Tycho</strong> — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.</li> <li><strong>Develocity Maven extension</strong> — fails to initialize due to SLF4J classloading changes (<code>ClassNotFoundException: SimpleLogger</code>).</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/maven/commit/6a8189b24518daa120539fa41ce12f2b48ec09a8";><code>6a8189b</code></a> [maven-release-plugin] prepare release maven-4.0.0-rc-6</li> <li><a href="https://github.com/apache/maven/commit/9e0d9de7c1dfecaccc100acb7a027f2982095e33";><code>9e0d9de</code></a> [backport maven-4.0.x] Fix BOM consumer POM leaving property references unres...</li> <li><a href="https://github.com/apache/maven/commit/146007eee45972e7abd8906b3c56f2ee241d157e";><code>146007e</code></a> [maven-release-plugin] prepare for next development iteration</li> <li><a href="https://github.com/apache/maven/commit/3f73af2de828dbb61bf6a700c174f3051e32af01";><code>3f73af2</code></a> [maven-release-plugin] prepare release maven-4.0.0-rc-6</li> <li><a href="https://github.com/apache/maven/commit/aecabedc1129710ed8748c84f179de8606962e66";><code>aecabed</code></a> Remove PathSelector include-based directory pre-filtering optimization</li> <li><a href="https://github.com/apache/maven/commit/c4e54ed6518776e9c711547855fdd3f8dd4bcc02";><code>c4e54ed</code></a> Remove erroneous PathSelector optimization that skipped path relativization</li> <li><a href="https://github.com/apache/maven/commit/37897695c824051e866be7601355e593fed7a675";><code>3789769</code></a> Fix <a href="https://redirect.github.com/apache/maven/issues/12583";>#12583</a>: Inverted file existence check in DefaultTransport.put()</li> <li><a href="https://github.com/apache/maven/commit/732927ed5b6e365924f1f455ca8b9729b519b03c";><code>732927e</code></a> Add Apache license headers to address ATR concerns (<a href="https://redirect.github.com/apache/maven/issues/12613";>#12613</a>)</li> <li><a href="https://github.com/apache/maven/commit/a7d35a2ab833f3de658c128df69473251a71fe1d";><code>a7d35a2</code></a> [MNG-8507] mvnup: skip dedup inside plugin <configuration> elements</li> <li><a href="https://github.com/apache/maven/commit/58cb473e74912bfe0f6dbf076d9bbb2b24b25166";><code>58cb473</code></a> Use resource filtering for mng-12534 IT plugin mavenVersion</li> <li>Additional commits viewable in <a href="https://github.com/apache/maven/compare/maven-4.0.0-rc-5...maven-4.0.0-rc-6";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
