< back to search

shield Recommended update for maven, maven-archiver, maven-dependency-plugin, maven-dependency-analyzer, maven-compiler-plugin, maven-assembly-plugin, byte-buddy, bouncycastle, apache-parent, maven-parent, maven-resolver, maven-resources-plugin, objectweb-asm, truth, xmlunit, xz-java
SUSE-SLES-16.0-331

This update for maven, maven-archiver, maven-dependency-plugin, maven-dependency-analyzer, maven-compiler-plugin, maven-assembly-plugin, byte-buddy, bouncycastle, apache-parent, maven-parent, maven-resolver, maven-resources-plugin, objectweb-asm, truth, xmlunit, xz-java fixes the following issues: Changes in maven: Specify required maven-resolver version since the maven-resolver-provider requires methods added in 1.9.25 Upgrade to upstream version 3.9.12 * New features and improvements + Apply resolver changes and improvements + Update formatting of prerequisites-requirements error to improve readability + Allow a Maven plugin to require a Java version + Use MavenRepositorySystem in ProjectBuildingHelper instead of deprecated RepositorySystem + Make maven.config use UTF8 + Simplify prefix resolution * Bug Fixes + Add default implementation for new method in MavenPluginManager + Repository layout should be used in MavenRepositorySystem + Fix plugin prefix resolution when metadata is not available from repository + Improve source root modification warning message + Bug: bad cache isolation between two sessions + Set Guice class loading to CHILD - avoid using terminally deprecated methods + Avoid parsing MAVEN_OPTS (3.9.x) * Documentation updates + clarify repository vs deployment repository + add maintained branches * Maintenance + Add IntelliJ icon + Build by JDK 25 + Deprecate org.apache.maven.repository.RepositorySystem in 3.9.x * Build + Bump actions/download-artifact from 5.0.0 to 6.0.0 + Bump actions/upload-artifact from 4.6.2 to 5.0.0 * Dependency updates + Bump actions/cache from 4.2.3 to 5.0.0 + Bump resolverVersion from 1.9.24 to 1.9.25 + Bump actions/checkout from 5.0.0 to 6.0.1 + Bump actions/setup-java from 5.0.0 to 5.1.0 + Bump commons-cli:commons-cli from 1.9.0 to 1.11.0 + Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29 + Bump commons-io:commons-io from 2.19.0 to 2.21.0 + Bump xmlunitVersion from 2.10.3 to 2.11.0 + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24 to 1.26 + Bump org.ow2.asm:asm from 9.8 to 9.9 + Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre Changes in maven-archiver: - Upgrade to maven-archiver 3.6.6 * New features and improvements + Backport sorting of properties to maven archiver 3.x * Maintenance + Convert to MARKDOWN with doxia-converter + Add more timestamp tests * Dependency updates + Bump Maven to 3.9.12 + Bump org.codehaus.plexus:plexus-archiver from 4.10.2 to 4.10.4 + Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29 Changes in maven-dependency-plugin: - Upgrade to version 3.9.0 * New features and improvements + Use Resolver API in go-offline for dependencies resolving + Use Resolver API in go-offline for plugins resolving + Fixes #1522, add render-dependencies mojo + Use Resolver API in resolve-plugin + MDEP-964: unconditionally ignore dependencies known to be loaded by reflection + Update maven-dependency-analyzer to support Java24 + MDEP-972: copy-dependencies: copy signatures alongside artifacts + MDEP-776: Warn when multiple dependencies have the same file name + MDEP-966: Migrate AnalyzeDepMgt to Sisu + MDEP-957: By default, don't report slf4j-simple as unused * Bug Fixes + ProjectBuildingRequest should not be modified + Fix: markersDirectory is not working when unpack goal is executed from command line + Fix broken link for analyze-exclusions-mojo on usage-page + MDEP-839: Avoid extra blank lines in file + Update collect URL + MDEP-689: Fixes ignored dependency filtering in go-offline goal + MDEP-960: Repair silent logging * Documentation updates + MDEP-933: Document dependency tree output formats + Add additional comment to clarify the minimal supported version of outputing dependency tree in JSON fromat. + MNGSITE-529: Rename "Goals" to "Plugin Documentation" + Unix file separators * Maintenance + Simplify usage of RepositoryManager and DependencyResolver + Use Resolver API in copy and unpack + Update site descriptor to 2.0.0 + Enable prevent branch protection rules + Fix [MDEP-931: Replace PrintWriter with Writer in AbstractSerializing Visitor and subclasses + Cleanups dependencies + Copy edit parameter descriptions + Small Javadoc clarifications + MDEP-967: Change info to debug logging in AbstractFromConfigurationMojo + fix: remove duplicate maven-resolver-api and maven-resolver-util dependencies in pom.xml + Enable GH issues + Remove redundant/unneeded code + Add PR Automation and Stale actions + Keep files in temporary directory to be deleted after test + Drop unnecessary call + Avoid deprecated ArtifactFactory + MDEP-966: Convert remaining Mojos to Guice injection + MDEP-966: Convert Analyze Mojos to Guice constructor injection + MDEP-966: Prefer Guice injection + MDEP-966: Migrate TreeMojo/CopyMojo/AnalyzeExclusionsMojo/ /UnpackMojo/CopyDependenciesMojo from Plexus to Sisu Guice + MDEP-966: @component --> @Inject for DisplayAncestorsMojo + Fixing flaky test in TestCopyDependenciesMojo + MNG-2961: Remove workaround for fixed bug * Build + Build by Maven 4 * Dependency updates + Bump Maven in dependencies to 3.9.11 + Bump commons-io:commons-io from 2.16.1 to 2.20.0 + Bump jettyVersion from 9.4.56.v20240826 to 9.4.58.v20250814 + Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0 + Bump org.apache.maven.plugins:maven-plugins from 43 to 45 + Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0 + Bump org.codehaus.plexus:plexus-archiver from 4.10.0 to 4.10.1 + Bump org.codehaus.plexus:plexus-i18n from 1.0-beta-10 to 1.0.0 + Bump org.jsoup:jsoup from 1.18.1 to 1.21.2 + MDEP-963: Bump org.apache.maven.shared:maven-dependency-analyzer from 1.15.0 to 1.15.1 Changes in maven-dependency-analyzer: - Upgrade to upstream version 1.17.0 * New features and improvements + Recognize classes used in web.xml as main classes + Introduced a DependencyClassesProvider service * Maintenance + Update site descriptor to 2.0 + Fix badges in README + Exclude slf4j 2.x and mockito 5.x from dependabot + feat: enable prevent branch protection rules + Catch exceptions on all paths + Add Apache 2.0 LICENSE file + Handle corrupt constant pools + Remove redundant code + move default to end * Build + Build on GH also by Maven 4 * Dependency updates + Bump org.assertj:assertj-bom from 3.27.3 to 3.27.7 + Bump org.apache.maven.shared:maven-shared-components from 44 to 47 + Bump mavenVersion from 3.9.9 to 3.9.12 + Bump org.ow2.asm:asm from 9.8 to 9.9.1 + Update Invoker Plugin and Plugin tools to support Java 25 + Bump org.assertj:assertj-bom from 3.26.3 to 3.27.3 Changes in maven-compiler-plugin: - Upgrade to upsteam release 3.15.0 * Bug Fixes + Fix Java 25 compatibility during integration tests + MCOMPILER-540: useIncrementalCompilation=false may add generated sources to the sources list * Maintenance + Bump org.apache.maven.plugins:maven-plugins from 45 to 46 + Remove declaration of "plexus-snapshots" repository + Works only with Maven 4.0.0 rc4 + Enable Java 25 and Maven 4 in CI * Dependency updates + Bump maven-plugin-testing-harness to 3.5.0 + Bump plexusCompilerVersion from 2.15.0 to 2.16.2 + Bump org.apache.maven.plugins:maven-plugins from 46 to 47 + Bump org.codehaus.plexus:plexus-java from 1.5.0 to 1.5.2 + Bump org.ow2.asm:asm from 9.8 to 9.9.1 + Bump mavenVersion from 3.9.11 to 3.9.12 Changes in maven-assembly-plugin: - Update to version 3.8.0 * Bug Fixes + MASSEMBLY-1030: Manifest entries from archive configuration are not added in final MANIFEST + MASSEMBLY-1029: Use minimal level for model validation * Documentation updates + MNGSITE-529: Rename "Goals" to "Plugin Documentation" * Maintenance + chore: migrate junit3/4 to junit5 + feat: enable prevent branch protection rules + Enable Github Issues * Dependency updates + MASSEMBLY-1028: Bump org.apache.maven:maven-archiver from 3.6.1 to 3.6.2 + Bump org.apache.maven:maven-archiver from 3.6.2 to 3.6.5 + MASSEMBLY-1027: Bump commons-io:commons-io from 2.15.1 to 2.16.0 + Bump commons-io:commons-io from 2.16.0 to 2.21.0 + Bump Maven to 3.9.11. Prerequisite still 3.6.3 + Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0 + Bump org.codehaus.plexus:plexus-io from 3.4.2 to 3.6.0 + Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.29 + Bump org.codehaus.plexus:plexus-archiver from 4.9.2 to 4.10.4 + Bump com.github.luben:zstd-jni from 1.5.5-11 to 1.5.7-6 + Bump m-invoker-p to 3.9.1 for Java 25 + Bump org.apache.maven.plugins:maven-plugins from 41 to 45 + Bump org.apache.commons:commons-compress from 1.26.1 to 1.28.0 + Bump commons-fileupload:commons-fileupload from 1.5 to 1.6.0 in /src/it/projects/bugs/massembly-580 + Bump org.codehaus.plexus:plexus-archiver from to 4.10.0 + Bump org.apache.maven.shared:maven-common-artifact-filters from 3.3.2 to 3.4.0 + Bump org.apache.maven.shared:maven-filtering from 3.3.2 to 3.4.0 + Bump org.hamcrest:hamcrest from 2.2 to 3.0 Changes in byte-buddy: - Update to v1.18.3 * Changes of v1.18.3 + Avoid using Class File API when Byte Buddy is loaded on the boot loader where multi-release jars are not available. + Add additional safety when processing class files with illegally formed parameters. + Update to latest ASM. * Changes of v1.18.2 + Support modifiers for value classes in Valhalla builds. + Improve use of build cache in Gradle. - Update to v1.18.1 * Changes of v1.18.1 + Fix generated module-info to include new package. * Changes of v1.18.0 + Add support for module-info class files and ModuleDescriptions. + Allow for manipulating module information using the ByteBuddy API. * Changes of v1.17.8 + Avoid use of types that are deprecated as of Java 26. + Include ASM 9.9 that offers ASM support for Java 26. + Make sure that generated code internal to Byte Buddy supports CDS if available. + Update version of ASM to JDK Class File API bridge to fix some minor bugs related to type annotations. * Changes of v1.17.7 + Specify correct JVM environment for Android builds when using the Gradle plugin. + Avoid recomputing the size of a parameter list for performance reasons after measuring the significant impact. + Correct validation of JVM names to avoid breaking when Java names are not allowed while JVM names are, with Kotlin and others. - Require for build objectweb-asm >= 9.8 for Opcodes.V25 Changes in bouncycastle: - Update to 1.83: * Defects Fixed: - Attempting to check a password on a stripped PGP would throw an exception. Checking the password on such a key will now always return false. - Fixed an issue in KangarooTwelve where premature absorption caused erroneous 168-byte padding; absorption is now delayed so correct final-byte padding is applied. - BCJSSE: Fix supported_versions creation for renegotiation handshake. - (D)TLS: Reneg info now oly offered with pre-1.3. * Additional Features and Functionality: - A generic "COMPOSITE" algorithm name has been added as a JCA Signature algorithm. The algorithm will identify the composite signature to use from the composite key passed in. - The composite signatures implementation has been updated to the final draft and now follows the submitted standard. - Support for the generation and use as trust anchors has been added for certificate signatures with id-alg-unsigned as the signature type. - Support for CMP direct POP for encryption keys using challenge/response has been added to the CMP/CRMF APIs. - Support for SupportedCurves attribute to the BC provider - BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per draft-reddy-tls-slhdsa-01. - Support has been added for the Java 25 KDF API (current algorithms, PBKDF2, SCRYPT, and HKDF). - Support for composite signatures is now included in CMS and timestamping. - It is now possible to disable the Lenstra check in RSA where the public key is not available via the system/security property "org.bouncycastle.rsa.no_lenstra_check". Changes in apache-parent: - Update to 37: * New features and improvements + Disable parallel PUT on release - Update to 36: * Breaking changes + Update minimum maven version to match current stable version (3.6.3 -> 3.9) + Introduce javaVersion property for maven.compiler.* configuration + Switch JDK >= 9 to only use maven.compiler.release * New features and improvements + Add default specification and implementation for javadoc and source manifest entries * Documentation updates + Clarify how to use Apache Snapshot repository + activate Fluido skin's anchorJs * Maintenance + Avoid - WARNING: Use of the three-letter time zone ID ... on JDK 25 for RAT plugin + feat: enable prevent branch protection rules Changes in maven-parent: - Upgrade to Apache Maven parent POM version 47 * Dependency updates + Bump parent to 37 + Bump org.junit:junit-bom from 5.14.1 to 5.14.2 - Upgrade to Apache Maven parent POM version 46 * Breaking changes + Require Maven 3.6.3+ from plugins + Update rat plugin configuration + Use spotless 3 when running on JDK >= 17 + Drop Doxia Tools parent pom * New features and improvements + MPOM-387: Exclude test scope from enforcedBytecodeVersion + feat: activate Fluido skin's anchorJs + Enhance target JDK definition for JDK >= 9 + Always render a GitHub ribbon on the right-hand side * Maintenance + MPOM-277: Move maven-invoker-plugin configuration to one place + Remove doxia-tools from documentations + feat: enable prevent branch protection rules + Add Apache 2.0 LICENSE file Changes in maven-resolver: - Update to upstream version 1.9.25 * New features and improvements + Add scope support for trusted checksums + Name mappers cleanup and new GAECV mapper + Proper metadata locking support + Ability to augment metadata nature for version range request * Bug Fixes + TrackingFileManager changes + Maven filters daemon friendly + Remove hack from Basic connector + Fix locking issues * Documentation updates + Updated the documentation to reflect the current list of name mappers * Maintenance + Mild backport: support same properties as Resolver 2.x + Maven resolver lockrepro + Bugfix: Java 25 broke test * Dependency updates + Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to 0.25.0 + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24 to 1.26 + Bump commons-codec:commons-codec from 1.18.0 to 1.20.0 + Bump org.redisson:redisson from 3.50.0 to 3.52.0 + Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre + Bump com.google.code.gson:gson from 2.13.1 to 2.13.2 + Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814 + Bump mavenVersion from 3.9.10 to 3.9.11 Changes in maven-resolver: - Update to upstream version 1.9.25 * New features and improvements + Add scope support for trusted checksums + Name mappers cleanup and new GAECV mapper + Proper metadata locking support + Ability to augment metadata nature for version range request * Bug Fixes + TrackingFileManager changes + Maven filters daemon friendly + Remove hack from Basic connector + Fix locking issues * Documentation updates + Updated the documentation to reflect the current list of name mappers * Maintenance + Mild backport: support same properties as Resolver 2.x + Maven resolver lockrepro + Bugfix: Java 25 broke test * Dependency updates + Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to 0.25.0 + Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24 to 1.26 + Bump commons-codec:commons-codec from 1.18.0 to 1.20.0 + Bump org.redisson:redisson from 3.50.0 to 3.52.0 + Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre + Bump com.google.code.gson:gson from 2.13.1 to 2.13.2 + Bump jettyVersion from 9.4.57.v20241219 to 9.4.58.v20250814 + Bump mavenVersion from 3.9.10 to 3.9.11 Changes in maven-resources-plugin: - Upgrade to version 3.4.0 * New features and improvements + Enable GitHub Issues * Documentation updates + MNGSITE-529: Rename "Goals" to "Plugin Documentation" + MRESOURCES-299: Be more accurate on using filtering element + Don't bother with very old versions * Maintenance + Migrate site to Doxia 2 + PlexusFileUtils Refaster recipes + Add PR Automation action + Improve release-drafter configuration + Add dependency to slf4j-simple for test scope + Use try with resources in integration test + reduce dependency scope of plexus-utils and commons-io * Dependency updates + Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.20.0 + Bump org.apache.maven.resolver:maven-resolver-api from 1.6.3 to 1.9.24 + Bump Maven to 3.9.11 while keep prerequisites on 3.6.3 + MRESOURCES-304: Bump org.codehaus.plexus:plexus-interpolation from 1.26 to 1.27 + Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.29 + Bump m-invoker-p to 3.9.1 + Bump org.apache.maven.plugins:maven-plugins from 39 to 45 + Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.3.0 to 3.4.0 + MRESOURCES-302: Bump commons-io:commons-io from 2.11.0 to 2.16.0 + Bump commons-io:commons-io from 2.16.0 to 2.20.0 + MRESOURCES-303: Bump org.apache.maven.shared:maven-filtering from 3.3.1 to 3.3.2 + Bump org.apache.maven.shared:maven-filtering from 3.3.2 to 3.4.0 + MRESOURCES-305: Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 4.0.0 + Bump apache/maven-gh-actions-shared from 3 to 4 + MRESOURCES-171: ISO8859-1 properties files get changed into + MRESOURCES-210: copy-resources erases file permissions + MRESOURCES-236: Copying of files with permissions broken + MRESOURCES-257: property from list element in pom model + MRESOURCES-251: Upgrade plexus-interpolation 1.26 + MRESOURCES-252: Add m2e lifecycle Metadata to plugin + MRESOURCES-256: make build Reproducible + MRESOURCES-258: Only overwrite filtered resources when + MRESOURCES-249: Upgrade maven-plugins parent to version 32 + MRESOURCES-255: Upgrade plexus-utils 3.3.0 + MRESOURCES-261: Make Maven 3.1.0 the minimum version + MRESOURCES-263: Update to maven-filtering 3.2.0 Changes in objectweb-asm: - Upgrade to version 9.9.1 * bug fixes + 318036: OutOfMemoryError when reading invalid class + 318037: Version ranges too wide on Import-Package Changes in truth: - Force annotation processing, since it is needed with Java 25 Changes in xmlunit: - Upgrade to 2.11.0 * XMLUnit 2.x is a complete rewrite of XMLUnit and actually doesn't share any code with XMLUnit for Java 1.x. * Some goals for XMLUnit 2.x: + create .NET and Java versions that are compatible in design while trying to be idiomatic for each platform + remove all static configuration (the old XMLUnit class setter methods) + focus on the parts that are useful for testing - XPath - (Schema) validation - comparisons + be independent of any test framework * XMLUnit 1.x is no longer maintained - Use directly the xalan-j2 jar instead of the jaxp_transform_impl Changes in xz-java: - Upgrade to version 1.11 * Fix a data corruption bug when encoding with the rarely-used option LZMA2Options.MODE_UNCOMPRESSED. To trigger the bug, a write call must cross an offset that is a multiple of 65536 bytes. For example, one write of 70000 bytes or two write calls of 50000 bytes each would trigger the bug. The bug isn't triggered if there are ten write calls of 8192 bytes each followed by one 123-byte write. * If encoding to a .xz file, a decoder would catch the issue because the integrity check wouldn't match. * The binaries of 1.10 in the Maven Central require Java 8 and contain optimized classes for Java >= 9 as multi-release JAR. They were built with OpenJDK 21.0.9 on GNU/Linux and can be reproduced using the following command: SOURCE_DATE_EPOCH=1763575020 TZ=UTC0 ant maven

  • Release Date
    Mar 2 2026
  • References
  • Type
    recommended
  • Severity
    moderate

cloud_download Downloads

SUSE Linux Enterprise Server for SAP applications 16.0 x86_64
SUSE Linux Enterprise Server for SAP applications 16.0 ppc64le
SUSE Linux Enterprise Server 16.0 x86_64
SUSE Linux Enterprise Server 16.0 s390x
SUSE Linux Enterprise Server 16.0 ppc64le
SUSE Linux Enterprise Server 16.0 aarch64