build(deps-dev): bump org.apache.maven.plugins:maven-jar-plugin from 3.4.1 to 3.5.1 - #2
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin) from 3.4.1 to 3.5.1. - [Release notes](https://github.com/apache/maven-jar-plugin/releases) - [Commits](apache/maven-jar-plugin@maven-jar-plugin-3.4.1...maven-jar-plugin-3.5.1) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-jar-plugin dependency-version: 3.5.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Dependabot had five single-line plugin bumps open (#1 gpg 3.2.4 -> 3.2.8, #2 jar 3.4.1 -> 3.5.1, #3 source 3.3.1 -> 3.4.0, #4 exec 3.2.0 -> 3.6.3, #6 compiler 3.12.1 -> 3.16.0) and its PR limit of 5 was blocking anything newer. Merging them one by one would have meant five commits and five CI runs, and CI cannot run at all right now - the account is out of Actions minutes for private repositories, so every check fails in seconds without starting. Instead all five are applied here and verified locally, which is a stricter gate than CI anyway: this machine builds on JDK 8, while every CI job uses Temurin 11. All five declare requiredJavaVersion 1.8 and requiredMavenVersion 3.6.3 in their plugin descriptors, so they sit inside both floors. Checked with Maven 3.9.10 / JDK 1.8.0_431: `clean package` and `checkstyle:check` are green with 139 tests, and compiler-plugin 3.16.0 still honours source/target 1.8 - the emitted classes are major version 52, not 55. `-Prelease package -Dgpg.skip=true` produces the main, sources and javadoc JARs, which is the bundle Central validates. For the release-natives profile, `-Prelease-natives prepare-package` shows exec:3.6.3:exec spawning package-platform-jars.sh and the script's own --require-all guard failing the build on the three platforms whose natives are not staged locally, i.e. the wiring is intact end to end. One observable change: jar-plugin 3.5.1 pulls maven-archiver 3.6.6, which adds a `Java-Version: 8` manifest entry next to the existing Build-Jdk-Spec. It is derived from the bytecode target, so it states our advertised floor rather than the build machine - harmless metadata, and Automatic-Module-Name plus the Implementation-* entries are unchanged.
|
Superseded by 149f54c, which applies this bump on
Verified locally on JDK 1.8.0_431 / Maven 3.9.10 rather than in CI: the account is out of Actions minutes for private repositories, so every check on this PR failed in seconds without starting. Closing instead of merging keeps one reviewed commit instead of five unvalidated ones. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps org.apache.maven.plugins:maven-jar-plugin from 3.4.1 to 3.5.1.
Release notes
Sourced from org.apache.maven.plugins:maven-jar-plugin's releases.
... (truncated)
Commits
b0cd63d[maven-release-plugin] prepare release maven-jar-plugin-3.5.15318a4fAdd AGENTS.md + SECURITY.md security-model pointer for scanner discoverability8e0b9bbBump org.apache.maven.plugins:maven-plugins from 48 to 49 (#547)d5a438bFix javadoc774fac9Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0b71f403Bump mavenVersion from 3.9.15 to 3.9.16 (#536)9f2a001Use plugin version properties (3.x) (#535)68a978fBump org.apache.maven.plugins:maven-plugins from 47 to 48 (#534)e105821Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#529)953dc1aBump mavenVersion from 3.9.14 to 3.9.15 (#528)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)