Skip to content

build(deps): bump the maven-plugins group across 2 directories with 4 updates - #330

Merged
AndreasIgel merged 1 commit into
mainfrom
dependabot/maven/maven-plugins-6e52e69c58
Oct 4, 2026
Merged

build(deps): bump the maven-plugins group across 2 directories with 4 updates#330
AndreasIgel merged 1 commit into
mainfrom
dependabot/maven/maven-plugins-6e52e69c58

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven-plugins group with 4 updates in the / directory: org.apache.maven.plugins:maven-compiler-plugin, org.apache.maven.plugins:maven-site-plugin, com.spotify.fmt:fmt-maven-plugin and org.apache.maven.plugins:maven-deploy-plugin.
Bumps the maven-plugins group with 2 updates in the /performance-test directory: org.apache.maven.plugins:maven-compiler-plugin and org.apache.maven.plugins:maven-deploy-plugin.

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.13.0 to 3.16.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.16.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

3.15.0

... (truncated)

Commits
  • e7bba6e [maven-release-plugin] prepare release maven-compiler-plugin-3.16.0
  • c906809 Avoid using deprecated method CompilerConfiguration.setCompilerVersion
  • ad74fee Replace adopt-openj9 by semeru JDK distribution on GH
  • beb0eda Recompile when dependencies change (#1102)
  • a0b689e [MCOMPILER-578] Track outputs across compiler executions (#1091)
  • 2e81228 Fix incremental detection of empty sources, 3.x (#1075)
  • 2132f5b configure ATR project
  • 5992b77 Build fails when annotation processor list is empty (but present) (#1077)
  • acccef7 Bump plexusCompilerVersion from 2.16.2 to 2.17.0
  • 72bc445 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-site-plugin from 3.21.0 to 3.22.0

Release notes

Sourced from org.apache.maven.plugins:maven-site-plugin's releases.

3.22.0

🚀 New features and improvements

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

What's Changed

... (truncated)

Commits
  • f9f7cc6 [maven-release-plugin] prepare release maven-site-plugin-3.22.0
  • f7b57ea Bump org.codehaus.plexus:plexus-interactivity-api from 1.3 to 1.5.1
  • 282aa04 Several site improvements (#1272)
  • 55ebd9f Upgrade to Doxia 2.1.0
  • 93ecbb6 Improve goal description
  • 106d259 Improve error messages
  • a7511e9 Fix additional PR comments
  • c3c1c0f Rename from "hot-reload" to "auto-refresh"
  • 5fb1504 Add blocking "hot-reload" goal
  • 2d9a489 Bump org.apache.maven.plugins:maven-plugins from 47 to 48 (#1271)
  • Additional commits viewable in compare view

Updates com.spotify.fmt:fmt-maven-plugin from 2.25 to 2.29

Release notes

Sourced from com.spotify.fmt:fmt-maven-plugin's releases.

2.27.0

What's Changed

New Contributors

Full Changelog: spotify/fmt-maven-plugin@2.25...2.27.0

Commits
  • 8fb8646 [maven-release-plugin] prepare release 2.29.0
  • f52caf7 Add more options
  • 4f745a6 Updated documentation
  • a75ee04 Support more options from google formatter
  • e213b84 [maven-release-plugin] prepare for next development iteration
  • cda1940 [maven-release-plugin] prepare release 2.28.0
  • e98d9f5 Update root version
  • 3d799cc docs: Recommend fixing google-java-format version on README (#202)
  • b1db971 [maven-release-plugin] rollback the release of 2.28.0
  • f3ca8e0 [maven-release-plugin] prepare for next development iteration
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-deploy-plugin from 3.1.1 to 3.2.0

Release notes

Sourced from org.apache.maven.plugins:maven-deploy-plugin's releases.

3.2.0

🚀 New features and improvements

🐛 Bug Fixes

  • Backport security audit fixes to 3.x (f004-f008, f010, f012) (#701) @​gnodet

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates

... (truncated)

Commits
  • 7aab9fb [maven-release-plugin] prepare release maven-deploy-plugin-3.2.0
  • 1f3eef5 Backport security audit fixes to 3.x (f004-f008, f010, f012)
  • 307f328 Simplify remote repository creation
  • 7b1bbc4 Cache projectsWithDeployExecution to fix O(N²) reactor scan
  • a9177c6 Clarify deploy without editing this projects POM
  • 7c40513 Restore the plain form of the ASF licence header
  • 5969234 Update Release Drafter configuration to use custom tag template and remove un...
  • df7b3fa Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml
  • b4e8aed work around Maven 4 CLI lack of interpolation
  • d634bb4 enable build with Maven 4
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.16.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

3.15.0

... (truncated)

Commits
  • e7bba6e [maven-release-plugin] prepare release maven-compiler-plugin-3.16.0
  • c906809 Avoid using deprecated method CompilerConfiguration.setCompilerVersion
  • ad74fee Replace adopt-openj9 by semeru JDK distribution on GH
  • beb0eda Recompile when dependencies change (#1102)
  • a0b689e [MCOMPILER-578] Track outputs across compiler executions (#1091)
  • 2e81228 Fix incremental detection of empty sources, 3.x (#1075)
  • 2132f5b configure ATR project
  • 5992b77 Build fails when annotation processor list is empty (but present) (#1077)
  • acccef7 Bump plexusCompilerVersion from 2.16.2 to 2.17.0
  • 72bc445 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0

Release notes

Sourced from org.apache.maven.plugins:maven-deploy-plugin's releases.

3.2.0

🚀 New features and improvements

🐛 Bug Fixes

  • Backport security audit fixes to 3.x (f004-f008, f010, f012) (#701) @​gnodet

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates

... (truncated)

Commits
  • 7aab9fb [maven-release-plugin] prepare release maven-deploy-plugin-3.2.0
  • 1f3eef5 Backport security audit fixes to 3.x (f004-f008, f010, f012)
  • 307f328 Simplify remote repository creation
  • 7b1bbc4 Cache projectsWithDeployExecution to fix O(N²) reactor scan
  • a9177c6 Clarify deploy without editing this projects POM
  • 7c40513 Restore the plain form of the ASF licence header
  • 5969234 Update Release Drafter configuration to use custom tag template and remove un...
  • df7b3fa Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml
  • b4e8aed work around Maven 4 CLI lack of interpolation
  • d634bb4 enable build with Maven 4
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the maven-plugins group across 2 directories with 4…
d2773ef 
… updates

Bumps the maven-plugins group with 4 updates in the / directory: [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin), [org.apache.maven.plugins:maven-site-plugin](https://github.com/apache/maven-site-plugin), [com.spotify.fmt:fmt-maven-plugin](https://github.com/spotify/fmt-maven-plugin) and [org.apache.maven.plugins:maven-deploy-plugin](https://github.com/apache/maven-deploy-plugin).
Bumps the maven-plugins group with 2 updates in the /performance-test directory: [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) and [org.apache.maven.plugins:maven-deploy-plugin](https://github.com/apache/maven-deploy-plugin).


Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.13.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.13.0...maven-compiler-plugin-3.16.0)

Updates `org.apache.maven.plugins:maven-site-plugin` from 3.21.0 to 3.22.0
- [Release notes](https://github.com/apache/maven-site-plugin/releases)
- [Commits](apache/maven-site-plugin@maven-site-plugin-3.21.0...maven-site-plugin-3.22.0)

Updates `com.spotify.fmt:fmt-maven-plugin` from 2.25 to 2.29
- [Release notes](https://github.com/spotify/fmt-maven-plugin/releases)
- [Commits](spotify/fmt-maven-plugin@2.25...2.29.0)

Updates `org.apache.maven.plugins:maven-deploy-plugin` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/apache/maven-deploy-plugin/releases)
- [Commits](apache/maven-deploy-plugin@maven-deploy-plugin-3.1.1...maven-deploy-plugin-3.2.0)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.13.0...maven-compiler-plugin-3.16.0)

Updates `org.apache.maven.plugins:maven-deploy-plugin` from 3.1.4 to 3.2.0
- [Release notes](https://github.com/apache/maven-deploy-plugin/releases)
- [Commits](apache/maven-deploy-plugin@maven-deploy-plugin-3.1.1...maven-deploy-plugin-3.2.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-site-plugin
  dependency-version: 3.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: com.spotify.fmt:fmt-maven-plugin
  dependency-version: '2.29'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-deploy-plugin
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
- dependency-name: org.apache.maven.plugins:maven-deploy-plugin
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-plugins
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 4, 2026
@github-actions

github-actions Bot commented Oct 4, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 1 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d2773ef.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

pom.xml

PackageVersionLicenseIssue Type
org.apache.maven.plugins:maven-site-plugin3.22.0Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND EPL-1.0 AND EPL-2.0 AND LicenseRef-scancode-public-domain AND MITIncompatible License
Allowed Licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0
Excluded from license check: pkg:githubactions/SonarSource/sonarqube-scan-action

OpenSSF Scorecard

PackageVersionScoreDetails
maven/org.apache.maven.plugins:maven-compiler-plugin 3.16.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 5Found 13/23 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-deploy-plugin 3.2.0 🟢 4.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 4/15 approved changesets -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts⚠️ 0binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.spotify.fmt:fmt-maven-plugin 2.29 UnknownUnknown
maven/org.apache.maven.plugins:maven-compiler-plugin 3.16.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 5Found 13/23 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-deploy-plugin 3.2.0 🟢 4.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 4/15 approved changesets -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts⚠️ 0binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-site-plugin 3.22.0 🟢 4.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 1Found 2/19 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • performance-test/pom.xml
  • pom.xml

@AndreasIgel
AndreasIgel merged commit c30805a into main Oct 4, 2026
5 of 6 checks passed
@AndreasIgel
AndreasIgel deleted the dependabot/maven/maven-plugins-6e52e69c58 branch October 4, 2026 13:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AndreasIgel