Update Maven dependencies by renovate[bot] · Pull Request #316 · SonarSource/parent-oss

renovate · 2026-08-31T12:45:45Z

This PR contains the following updates:

Package	Change	Age	Confidence
org.cyclonedx:cyclonedx-maven-plugin	`2.9.1` → `2.9.3`
org.codehaus.mojo:license-maven-plugin (source)	`2.5.0` → `2.7.1`
org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin (source)	`1.25.0.11` → `1.25.1.3002`
org.codehaus.mojo:buildnumber-maven-plugin (source)	`3.2.1` → `3.3.0`
org.jacoco:jacoco-maven-plugin (source)	`0.8.12` → `0.8.15`
org.jfrog.buildinfo:artifactory-maven-plugin (source)	`3.5.1` → `3.7.1`
org.apache.maven.plugins:maven-site-plugin (source)	`3.21.0` → `3.22.0`
org.apache.maven.plugins:maven-source-plugin (source)	`3.3.1` → `3.4.0`
org.apache.maven.plugins:maven-shade-plugin (source)	`3.6.0` → `3.6.2`
org.apache.maven.plugins:maven-resources-plugin (source)	`3.3.1` → `3.5.0`
org.apache.maven.plugins:maven-plugin-plugin (source)	`3.15.1` → `3.15.2`
org.apache.maven.plugins:maven-javadoc-plugin (source)	`3.11.2` → `3.12.0`
org.apache.maven.plugins:maven-jar-plugin (source)	`3.4.2` → `3.5.1`
org.apache.maven.plugins:maven-install-plugin (source)	`3.1.3` → `3.1.4`
org.apache.maven.plugins:maven-surefire-plugin (source)	`3.5.2` → `3.5.6`
org.apache.maven.plugins:maven-failsafe-plugin (source)	`3.5.2` → `3.5.6`
org.apache.maven.plugins:maven-enforcer-plugin (source)	`3.5.0` → `3.6.3`
org.apache.maven.plugins:maven-deploy-plugin (source)	`3.1.3` → `3.1.4`
org.apache.maven.plugins:maven-dependency-plugin (source)	`3.8.1` → `3.11.0`
org.apache.maven.plugins:maven-compiler-plugin (source)	`3.13.0` → `3.15.0`
org.apache.maven.plugins:maven-clean-plugin (source)	`3.4.0` → `3.5.0`
org.apache.maven.plugins:maven-assembly-plugin (source)	`3.7.1` → `3.8.0`

Release Notes

mojohaus/license-maven-plugin (org.codehaus.mojo:license-maven-plugin)

`v2.7.1`

Compare Source

💥 Breaking changes

Bump LibreOffice library odfdom-java to 0.12.0, require JDK 11+ for generating Calc file ODS (#684) @slawekjaranowski

🚀 New features and improvements

Bump LibreOffice library odfdom-java to 0.12.0, require JDK 11+ for generating Calc file ODS (#684) @slawekjaranowski
Fix for issues/533 (dual licensed dependency with one license on whitelist and the other on blacklist) (#670) @wuwu2000
Make Mojos thread-safe and improve concurrent cache handling (#674) @shaikhu

👻 Maintenance

Add PR automation workflow (#682) @slawekjaranowski

📦 Dependency updates

Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-345 (#691) @dependabot[bot]
Bump org.codehaus.mojo:mojo-parent from 94 to 95 (#690) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-508 (#677) @dependabot[bot]
Bump org.apache.maven:maven-archiver from 3.6.5 to 3.6.6 (#689) @dependabot[bot]
Bump org.apache.logging.log4j:log4j-to-slf4j from 2.25.2 to 2.25.3 (#688) @dependabot[bot]
Bump mavenVersion from 3.9.11 to 3.9.12 (#687) @dependabot[bot]
Bump org.apache.poi:poi-ooxml from 5.5.0 to 5.5.1 (#683) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.9 to 3.18.0 in /src/it/ISSUE-312/child2 (#681) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0 (#679) @dependabot[bot]
Bump org.apache.poi:poi-ooxml from 5.4.1 to 5.5.0 (#680) @dependabot[bot]
Bump org.wiremock:wiremock-standalone from 3.13.1 to 3.13.2 (#678) @dependabot[bot]
Bump commons-io:commons-io from 2.20.0 to 2.21.0 (#676) @dependabot[bot]
Bump org.apache.maven:maven-archiver from 3.6.4 to 3.6.5 (#671) @dependabot[bot]
Bump org.codehaus.mojo:mojo-parent from 93 to 94 (#669) @dependabot[bot]
Bump org.apache.logging.log4j:log4j-to-slf4j from 2.25.1 to 2.25.2 (#667) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0 (#668) @dependabot[bot]

`v2.7.0`

Compare Source

🚀 New features and improvements

Check project license goal (#650) @sewerwal

🐛 Bug Fixes

Adding missing @Inject to LicenseListMojo class (#656) @jhonnymertz

🔧 Build

Disable fail-fast build in matrix, skip download-licenses-configured IT (#657) @slawekjaranowski

📦 Dependency updates

Bump org.apache.maven:maven-archiver from 3.6.3 to 3.6.4 (#659) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/add-third-party-with-deps-name-order (#661) @dependabot[bot]
Bump org.codehaus.mojo:mojo-parent from 92 to 93 (#660) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-423 (#653) @dependabot[bot]
Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#655) @dependabot[bot]
Bump mavenVersion from 3.9.10 to 3.9.11 (#654) @dependabot[bot]
Bump org.apache.logging.log4j:log4j-to-slf4j from 2.25.0 to 2.25.1 (#652) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 (#649) @dependabot[bot]
Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-345-2 (#651) @dependabot[bot]

`v2.6.0`

Compare Source

🚀 New features and improvements

Implement Optional Parameters to include and exclude submodules (#620) @MrBanana05

📝 Documentation updates

Rename 'Goals' to 'Plugin Documentation' in site manu (#647) @slawekjaranowski

👻 Maintenance

Use constant 3.6.3 in prerequisites/maven as minimal Maven version (#646) @slawekjaranowski
Use MavenProjectHelper for adding resources (#643) @slawekjaranowski

📦 Dependency updates

Bump mavenVersion from 3.6.3 to 3.9.10 (#645) @dependabot[bot]
Bump org.apache.logging.log4j:log4j-to-slf4j from 2.24.3 to 2.25.0 (#648) @dependabot[bot]
Bump org.codehaus.mojo:mojo-parent from 87 to 92 (#644) @dependabot[bot]
Bump org.wiremock:wiremock-standalone from 3.13.0 to 3.13.1 (#642) @dependabot[bot]
Bump org.wiremock:wiremock-standalone from 3.12.1 to 3.13.0 (#635) @dependabot[bot]
Bump org.igniterealtime.smack:smack-core from 4.1.6 to 4.1.9 in /src/it/ISSUE-361 (#634) @dependabot[bot]
Bump org.apache.poi:poi-ooxml from 5.4.0 to 5.4.1 (#631) @dependabot[bot]
Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#632) @dependabot[bot]
Bump org.wiremock:wiremock-standalone from 3.12.0 to 3.12.1 (#627) @dependabot[bot]
Bump org.wiremock:wiremock-standalone from 3.10.0 to 3.12.0 (#625) @dependabot[bot]
Bump org.codehaus.mojo:mojo-parent from 86 to 87 (#623) @dependabot[bot]
Bump org.apache.poi:poi-ooxml from 5.3.0 to 5.4.0 (#618) @dependabot[bot]
Bump org.freemarker:freemarker from 2.3.33 to 2.3.34 (#617) @dependabot[bot]
Bump org.apache.logging.log4j:log4j-to-slf4j from 2.24.2 to 2.24.3 (#616) @dependabot[bot]
Bump org.wiremock:wiremock-standalone from 3.9.2 to 3.10.0 (#614) @dependabot[bot]

SonarSource/sonar-packaging-maven-plugin (org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin)

`v1.25.1.3002`

Compare Source

What's Changed

PACKMP-38 Prepare for next development iteration by @claire-villard-sonarsource in #78
PACKMP-39 Upgrade parent POM and change version to patch by @claire-villard-sonarsource in #79

Full Changelog: SonarSource/sonar-packaging-maven-plugin@1.25.0.11...1.25.1.3002

jacoco/jacoco (org.jacoco:jacoco-maven-plugin)

`v0.8.15`

Compare Source

`v0.8.14`: 0.8.14

Compare Source

New Features

JaCoCo now officially supports Java 25 (GitHub #1950).
Experimental support for Java 26 class files (GitHub #1870).
Branches added by the Kotlin compiler for default argument number 33 or higher are filtered out during generation of report (GitHub #1655).
Part of bytecode generated by the Kotlin compiler for elvis operator that follows safe call operator is filtered out during generation of report (GitHub #1814, #1954).
Part of bytecode generated by the Kotlin compiler for more cases of chained safe call operators is filtered out during generation of report (GitHub #1956).
Part of bytecode generated by the Kotlin compiler for invocations of suspendCoroutineUninterceptedOrReturn intrinsic is filtered out during generation of report (GitHub #1929).
Part of bytecode generated by the Kotlin compiler for suspending lambdas with parameters is filtered out during generation of report (GitHub #1945).
Part of bytecode generated by the Kotlin compiler for suspending functions and lambdas with suspension points that return inline value class is filtered out during generation of report (GitHub #1871).
Part of bytecode generated by the Kotlin Compose compiler plugin for pausable composition is filtered out during generation of report (GitHub #1911).
Methods generated by the Kotlin serialization compiler plugin are filtered out (GitHub #1885, #1970, #1971).

Fixed bugs

Fixed handling of implicit else clause of when with String subject in Kotlin (GitHub #1813, #1940).
Fixed handling of implicit default clause of switch by String in Java when compiled by ECJ (GitHub #1813, #1940).
Fixed handling of exceptions in chains of safe call operators in Kotlin (GitHub #1819).

Non-functional Changes

JaCoCo now depends on ASM 9.9 (GitHub #1965).

`v0.8.13`: 0.8.13

Compare Source

New Features

JaCoCo now officially supports Java 23 and Java 24 (GitHub #1757, #1631, #1867).
Experimental support for Java 25 class files (GitHub #1807).
Calculation of line coverage for Kotlin inline functions (GitHub #1670).
Calculation of line coverage for Kotlin inline functions with reified type parameter (GitHub #1670, #1700).
Calculation of coverage for Kotlin JvmSynthetic functions (GitHub #1700).
Part of bytecode generated by the Kotlin Compose compiler plugin is filtered out during generation of report (GitHub #1616).
Part of bytecode generated by the Kotlin compiler for inline value classes is filtered out during generation of report (GitHub #1475).
Part of bytecode generated by the Kotlin compiler for suspending lambdas without suspension points is filtered out during generation of report (GitHub #1283).
Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable enum subject is filtered out during generation of report (GitHub #1774).
Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable String subject is filtered out during generation of report (GitHub #1769).
Part of bytecode generated by the Kotlin compiler for chains of safe call operators is filtered out during generation of report (GitHub #1810, #1818).
Method getEntries generated by the Kotlin compiler for enum classes is filtered out during generation of report (GitHub #1625).
Methods generated by the Kotlin compiler for constructors and functions with JvmOverloads annotation are filtered out (GitHub #1768).

Fixed bugs

Fixed interpretation of Kotlin SMAP (GitHub #1525).
File extensions are preserved in HTML report in case of clashes of normalized file names (GitHub #1660).

Non-functional Changes

JaCoCo build now uses Maven Wrapper and requires at least Maven 3.9.9 (GitHub #1708, #1707, #1681).
JaCoCo now depends on ASM 9.8 (GitHub #1862).
More context information when IllegalArgumentException occurs during reading of zip file (GitHub #1833).

jfrog/artifactory-maven-plugin (org.jfrog.buildinfo:artifactory-maven-plugin)