[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.codehaus.mojo:build-helper-maven-plugin (source)	3.6.1 → 3.8.0
org.apache.maven.plugins:maven-surefire-plugin (source)	3.5.5 → 3.6.1
org.apache.maven.plugins:maven-compiler-plugin (source)	3.15.0 → 3.16.0
org.junit.jupiter:junit-jupiter (source)	5.14.3 → 5.14.4
org.apache.logging.log4j:log4j-slf4j-impl (source)	2.25.4 → 2.26.1
org.xmlunit:xmlunit-assertj3 (source)	2.11.0 → 2.14.0
org.slf4j:slf4j-api (source, changelog)	2.0.17 → 2.0.20
commons-io:commons-io (source)	2.21.0 → 2.22.0
org.eclipse.persistence:eclipselink	4.0.9 → 4.0.10
net.sf.saxon:Saxon-HE (source)	12.9 → 12.10

---

Release Notes

mojohaus/build-helper-maven-plugin (org.codehaus.mojo:build-helper-maven-plugin)

v3.8.0

Compare Source

Build Helper Maven Plugin 3.8.0 lets regex-property and regex-properties apply several regex replacements in order, and quiets the log when a non-match is allowed. The requirements are unchanged: Maven 3.9.0 or later, Java 8.

✨ Highlights

• Ordered regex replacements. The new replacements list of regex/replacement pairs works in regex-property and in each regexPropertySetting of regex-properties. Each pair applies to the result of the previous one, so a single property can go through several rewrites. It cannot be combined with regex/replacement, which work as before (#​277, #​77 by @​JonathanLennox; also covers #​236 by @​donatelloOo).
• Quieter non-matches. With failIfNoMatch set to false, a non-match is expected, so it is now logged at debug level instead of info (#​278, #​152 by @​garretwilson).
• Documentation moved from APT to Markdown (#​271).

🚀 New features and improvements

• Log a tolerated regex non-match at debug level (#​278) @​slachiewicz
• Add ordered regex replacements to regex-property (#​277) @​slachiewicz

📝 Documentation updates

• Convert the site documents from APT to Markdown (#​271) @​slachiewicz

👻 Maintenance

• Configure the mojo unit tests through the plugin testing harness (#​276) @​slachiewicz
• Test the regex goals' outcomes in unit tests (#​275) @​slachiewicz
• Test the uptodate goals' mappers in unit tests (#​274) @​slachiewicz
• Test the add goals' skip parameters in unit tests (#​273) @​slachiewicz

🔧 Build

• Reuse the cached prefix file in the integration tests (#​272) @​slachiewicz

Thanks to @​slachiewicz.

Full changelog

v3.7.0

Compare Source

Build Helper Maven Plugin 3.7.0 adds system time zone support to timestamp-property, literal replacement support to regex-property and regex-properties, and updates the remove-project-artifact deprecation guidance. It requires Maven 3.9.0 or later and Java 8 or later.

✨ Highlights

• System time zone in timestamp-property: Setting <timeZone>system</timeZone> (case-insensitive) formats the timestamp using the JVM's default time zone instead of GMT, working with both current and build time sources (#​250).
• Literal replacement mode in regex-property and regex-properties: Setting <replacementLiteral>true</replacementLiteral> treats backslashes (\) and dollar signs ($) in <replacement> as literal characters rather than regex group references or escapes — particularly useful when substituting Windows file paths such as ${project.build.directory} (#​249).
• Updated remove-project-artifact deprecation guidance: The documentation for the deprecated remove-project-artifact goal now points users to Maven Resolver's split local repository feature (-Daether.enhancedLocalRepository.split) as the modern alternative (#​268, #​270).

🚨 Removed

• Require Maven 3.9.0 (#​257) @​slachiewicz

🚀 New features and improvements

• Support the system time zone in timestamp-property (#​250) @​wilx
• Add literal replacement support to regex property goals (#​249) @​wilx

📝 Documentation updates

• Point the remove-project-artifact deprecation at split local repositories (#​268, #​270) @​slachiewicz
• Add AGENTS.md (#​263) @​slachiewicz

👻 Maintenance

• Run the surefire IT fixture on JUnit 5 (#​269) @​slachiewicz
• Replace deprecated @​Component with JSR 330 injection (#​267) @​slachiewicz
• Check the reserved ports' guarantees, not exact numbers (#​265) @​slachiewicz
• Apply the JUnit 5 best practices to the tests (#​261) @​slachiewicz
• Keep Dependabot on Maven 3.9.x (#​259) @​slachiewicz
• Write the regex and timestamp verify scripts as assertions (#​258) @​slachiewicz
• Port the IT scripts from BeanShell to Groovy (#​251) @​slachiewicz

🔧 Build

• Preload the lifecycle plugins of the Central-backed ITs (#​264) @​slachiewicz
• Use the runners' cached Temurin JDKs in CI (#​262) @​slachiewicz
• Run CI on Maven 4 (#​260) @​slachiewicz
• Assign merged pull requests to the release milestone (#​255) @​slachiewicz
• Point the released-version ITs at the URL the build uses for central (#​256) @​slachiewicz
• Run one integration test per CPU core (#​254) @​slachiewicz
• Check dependencies monthly and group the updates (#​253) @​slachiewicz
• Run fewer JDKs on macOS and Windows and the ITs in parallel (#​252) @​slachiewicz

Thanks to @​slachiewicz and @​wilx.

Full changelog

v3.6.2

Compare Source

🐛 Bug Fixes

• Replace raw NPEx with customized exception message (#​239) @​pzygielo

👻 Maintenance

• Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#​248) @​slachiewicz

📦 Dependency updates

11 changes

• Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#​248) @​slachiewicz
• Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 (#​247) @​dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#​244) @​dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 96 to 97 (#​246) @​dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#​245) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 (#​241) @​dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 95 to 96 (#​240) @​dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 94 to 95 (#​235) @​dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 93 to 94 (#​233) @​dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 92 to 93 (#​232) @​dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 91 to 92 (#​231) @​dependabot[bot]

xmlunit/xmlunit (org.xmlunit:xmlunit-assertj3)

v2.14.0

Compare Source

• marked jakarta.xml.bind-api as optional in xmlunit-core.
  PR #​340 by @​arimu1

v2.13.0

Compare Source

• added explicit settings to the Validator classes that disable (external) DTD loading during validation. The default
  remains to allow loading of external content as this is often a requirement during validation.

  PRs #​331 and #​332 by
  @​jmestwa-coder

• added constructor overloads to JAXPXPathEngine to allow specifying the DocumentBuilderFactory used for the
  Source overloads of the selectNodes and evaluate methods.

  PRs #​333 by @​jmestwa-coder

• IsDateTimePlaceholderHandler now parses the explicit and ISO date formats using Locale.US rather than the JVM
  default locale so results no longer depend on the host locale. An optional second argument allows specifying a
  different locale as a BCP 47 language tag.

  PR #​335 by @​jmestwa-coder

v2.12.0

Compare Source

• bumped xmlunit-assertj3's dependency on assert to 3.27.7.

  This is to make people aware of
  GHSA-rqfh-9r24-8c9r

  XMLUnit itself does not use the affected code in AssertJ so the upgrade is not strictly necessary - and this is why
  the xmlunit-assertj module is not updated. In fact the assertions provided by xmlunit-assertj3 are the recommended
  upgrade path for users of AssertJ 3.x+.

  PRs #​320 and
  #​321

• actually made withDTDParsingDisabled do what it says.

  This is a bugfix and in a way it is backwards incompatible as it changes default behavior in a way that I intended to
  do with XMLUnit 2.6.0 eight years ago. DocumentBuilderFactoryConfigurer.DefaultWithDTDParsing provides the
  behavior of XMLUnit 2.6.0 to 2.11.0.

  PRs #​326 by @​jmestwa-coder
  and #​328

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud