build(deps-dev): bump org.apache.maven.plugins:maven-gpg-plugin from 3.2.4 to 3.2.8 - #1
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [org.apache.maven.plugins:maven-gpg-plugin](https://github.com/apache/maven-gpg-plugin) from 3.2.4 to 3.2.8. - [Release notes](https://github.com/apache/maven-gpg-plugin/releases) - [Commits](apache/maven-gpg-plugin@maven-gpg-plugin-3.2.4...maven-gpg-plugin-3.2.8) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-gpg-plugin dependency-version: 3.2.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Dependabot had five single-line plugin bumps open (#1 gpg 3.2.4 -> 3.2.8, #2 jar 3.4.1 -> 3.5.1, #3 source 3.3.1 -> 3.4.0, #4 exec 3.2.0 -> 3.6.3, #6 compiler 3.12.1 -> 3.16.0) and its PR limit of 5 was blocking anything newer. Merging them one by one would have meant five commits and five CI runs, and CI cannot run at all right now - the account is out of Actions minutes for private repositories, so every check fails in seconds without starting. Instead all five are applied here and verified locally, which is a stricter gate than CI anyway: this machine builds on JDK 8, while every CI job uses Temurin 11. All five declare requiredJavaVersion 1.8 and requiredMavenVersion 3.6.3 in their plugin descriptors, so they sit inside both floors. Checked with Maven 3.9.10 / JDK 1.8.0_431: `clean package` and `checkstyle:check` are green with 139 tests, and compiler-plugin 3.16.0 still honours source/target 1.8 - the emitted classes are major version 52, not 55. `-Prelease package -Dgpg.skip=true` produces the main, sources and javadoc JARs, which is the bundle Central validates. For the release-natives profile, `-Prelease-natives prepare-package` shows exec:3.6.3:exec spawning package-platform-jars.sh and the script's own --require-all guard failing the build on the three platforms whose natives are not staged locally, i.e. the wiring is intact end to end. One observable change: jar-plugin 3.5.1 pulls maven-archiver 3.6.6, which adds a `Java-Version: 8` manifest entry next to the existing Build-Jdk-Spec. It is derived from the bytecode target, so it states our advertised floor rather than the build machine - harmless metadata, and Automatic-Module-Name plus the Implementation-* entries are unchanged.
|
Superseded by 149f54c, which applies this bump on The plugin descriptor for 3.2.8 declares Verified locally on JDK 1.8.0_431 / Maven 3.9.10 rather than in CI: the account is out of Actions minutes for private repositories, so every check on this PR failed in seconds without starting. Closing instead of merging keeps one reviewed commit instead of five unvalidated ones. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps org.apache.maven.plugins:maven-gpg-plugin from 3.2.4 to 3.2.8.
Release notes
Sourced from org.apache.maven.plugins:maven-gpg-plugin's releases.
... (truncated)
Commits
8a46455[maven-release-plugin] prepare release maven-gpg-plugin-3.2.87012821Fix issueManagement, ciManagement system and urla9a8c84Make empty classifier null (not empty string) (#287)a8368b0Add .mvnf0e45e0Update parent POM to 45 (#284)cb1236cBump bouncycastleVersion from 1.78.1 to 1.80 (#127)5377a10Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#133)8b63932Bump org.apache.maven.plugins:maven-invoker-plugin from 3.8.0 to 3.9.0 (#125)54ea518Bump org.simplify4u.plugins:pgpverify-maven-plugin from 1.18.2 to 1.19.1a6a412dRemove old JIRA issue linkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)