build(deps): bump maven.resolver.version from 2.0.22 to 2.0.23 by dependabot[bot] · Pull Request #2916 · apache/karaf

dependabot · 2026-09-17T20:35:32Z

Bumps maven.resolver.version from 2.0.22 to 2.0.23.
Updates org.apache.maven.resolver:maven-resolver-api from 2.0.22 to 2.0.23

Release notes

Sourced from org.apache.maven.resolver:maven-resolver-api's releases.

2.0.23

🚀 New features and improvements

Finish the repo key story (#2135) @cstamas

Fix: log only once the warning in DefRemoteRepoMan (#2100) @cstamas

Fix #2058: Add links to configuration page (#2060) @Jamison929611

Eliminate per-node HashSet allocation in PathConflictResolver (#2075) @gnodet

🐛 Bug Fixes

fix: accept locally cached artifacts via same-id fallback when tracking URL changes (#2133) @gnodet

Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz

[MRESOLVER-379] - Preserve relocated candidates from version ranges (#2114) @jjj-n

Create the local repository directory before resolving its real path (#2111) @slachiewicz

Optimize TrackingFileManager unit tests and fix potential lock leaks (#2094) (#2102) @slachiewicz

Validate the repository key used in checksum summary file names (#2099) @slachiewicz

fix: bound response reads and sanitize remote-derived strings (#2081) @gnodet

fix: earn trust labels through verification and bind tracking to URL (#2080) @gnodet

fix: bind credentials to origin and reject TLS downgrade redirects (#2085) @gnodet

fix: prevent remote signals from weakening operator-configured policy (#2082) @gnodet

fix: atomic file publication and authenticated IPC lock daemon (#2083) @gnodet

fix: deploy-side integrity must fail closed (#2084) @gnodet

fix: harden opt-in transport and lock backends against unauthenticated infrastructure (#2086) @gnodet

Compose named lock keys one segment per coordinate field (#2091) @slachiewicz

Resolve file transport locations with path operations instead of substring matching (#2088) @slachiewicz

Validate coordinate components in the Maven 2 layout and local path composer (#2087) @slachiewicz

📝 Documentation updates

[docs] Clarify trusted checksum sources (#2127) @jiteshkhatri11

Fix #2058: Add links to configuration page (#2060) @Jamison929611

👻 Maintenance

test: move from minio docker image (#2140) @cstamas

Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz

Fix: tidy up f013 (#2104) @cstamas

Fix #2096: harden NamedLocksTrackingFileManagerTest against CI load (#2098) @gnodet

Carry repository provenance into aggregateRepositories (#2090) @slachiewicz

Validate the repository key used as a local repository path segment (#2089) @slachiewicz

📦 Dependency updates

Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from 3.15.2 to 3.16.0 (#2136) @dependabot[bot]

Bump version.slf4j from 2.0.18 to 2.0.19 (#2130) @dependabot[bot]

Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (#2131) @dependabot[bot]

Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2 (#2129) @dependabot[bot]

Deps: bump to BC provider 1.85.2 (#2097) @cstamas

Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (#2074) @dependabot[bot]

... (truncated)

Commits

3cc91ea [maven-release-plugin] prepare release maven-resolver-2.0.23
b703cdb Finish the repo key story (#2135)
a719e8d test: move from minio docker image (#2140)
d1d8d94 Bump org.apache.maven.plugin-tools:maven-plugin-tools-api (#2136)
18753da fix: accept legacy ID-only tracking entries via backward-compatible fallback ...
0a74153 Fix listener error swallowing (#1990), SyncContext double-close (#1992), and ...
bd7421f [docs] Clarify trusted checksum sources (#2127)
534e16e [MRESOLVER-379] Preserve relocated range candidates (#2114)
f786540 Bump version.slf4j from 2.0.18 to 2.0.19 (#2130)
dec4ec3 Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (#2131)
Additional commits viewable in compare view

Updates org.apache.maven.resolver:maven-resolver-util from 2.0.22 to 2.0.23

Release notes

Sourced from org.apache.maven.resolver:maven-resolver-util's releases.

2.0.23

🚀 New features and improvements

Finish the repo key story (#2135) @cstamas

Fix: log only once the warning in DefRemoteRepoMan (#2100) @cstamas

Fix #2058: Add links to configuration page (#2060) @Jamison929611

Eliminate per-node HashSet allocation in PathConflictResolver (#2075) @gnodet

🐛 Bug Fixes

fix: accept locally cached artifacts via same-id fallback when tracking URL changes (#2133) @gnodet

Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz

[MRESOLVER-379] - Preserve relocated candidates from version ranges (#2114) @jjj-n

Create the local repository directory before resolving its real path (#2111) @slachiewicz

Optimize TrackingFileManager unit tests and fix potential lock leaks (#2094) (#2102) @slachiewicz

Validate the repository key used in checksum summary file names (#2099) @slachiewicz

fix: bound response reads and sanitize remote-derived strings (#2081) @gnodet

fix: earn trust labels through verification and bind tracking to URL (#2080) @gnodet

fix: bind credentials to origin and reject TLS downgrade redirects (#2085) @gnodet

fix: prevent remote signals from weakening operator-configured policy (#2082) @gnodet

fix: atomic file publication and authenticated IPC lock daemon (#2083) @gnodet

fix: deploy-side integrity must fail closed (#2084) @gnodet

fix: harden opt-in transport and lock backends against unauthenticated infrastructure (#2086) @gnodet

Compose named lock keys one segment per coordinate field (#2091) @slachiewicz

Resolve file transport locations with path operations instead of substring matching (#2088) @slachiewicz

Validate coordinate components in the Maven 2 layout and local path composer (#2087) @slachiewicz

📝 Documentation updates

[docs] Clarify trusted checksum sources (#2127) @jiteshkhatri11

Fix #2058: Add links to configuration page (#2060) @Jamison929611

👻 Maintenance

test: move from minio docker image (#2140) @cstamas

Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz

Fix: tidy up f013 (#2104) @cstamas

Fix #2096: harden NamedLocksTrackingFileManagerTest against CI load (#2098) @gnodet

Carry repository provenance into aggregateRepositories (#2090) @slachiewicz

Validate the repository key used as a local repository path segment (#2089) @slachiewicz

📦 Dependency updates

Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from 3.15.2 to 3.16.0 (#2136) @dependabot[bot]

Bump version.slf4j from 2.0.18 to 2.0.19 (#2130) @dependabot[bot]

Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (#2131) @dependabot[bot]

Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2 (#2129) @dependabot[bot]

Deps: bump to BC provider 1.85.2 (#2097) @cstamas

Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (#2074) @dependabot[bot]

... (truncated)

Commits

3cc91ea [maven-release-plugin] prepare release maven-resolver-2.0.23
b703cdb Finish the repo key story (#2135)
a719e8d test: move from minio docker image (#2140)
d1d8d94 Bump org.apache.maven.plugin-tools:maven-plugin-tools-api (#2136)
18753da fix: accept legacy ID-only tracking entries via backward-compatible fallback ...
0a74153 Fix listener error swallowing (#1990), SyncContext double-close (#1992), and ...
bd7421f [docs] Clarify trusted checksum sources (#2127)
534e16e [MRESOLVER-379] Preserve relocated range candidates (#2114)
f786540 Bump version.slf4j from 2.0.18 to 2.0.19 (#2130)
dec4ec3 Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (#2131)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps `maven.resolver.version` from 2.0.22 to 2.0.23. Updates `org.apache.maven.resolver:maven-resolver-api` from 2.0.22 to 2.0.23 - [Release notes](https://github.com/apache/maven-resolver/releases) - [Commits](apache/maven-resolver@maven-resolver-2.0.22...maven-resolver-2.0.23) Updates `org.apache.maven.resolver:maven-resolver-util` from 2.0.22 to 2.0.23 - [Release notes](https://github.com/apache/maven-resolver/releases) - [Commits](apache/maven-resolver@maven-resolver-2.0.22...maven-resolver-2.0.23) --- updated-dependencies: - dependency-name: org.apache.maven.resolver:maven-resolver-api dependency-version: 2.0.23 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.apache.maven.resolver:maven-resolver-util dependency-version: 2.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-17T21:29:27Z

Test Results

726 files ±0 726 suites ±0 1h 21m 32s ⏱️ + 1m 14s
985 tests ±0 937 ✅ +1 48 💤 ±0 0 ❌ ±0
2 955 runs ±0 2 811 ✅ +1 144 💤 ±0 0 ❌ ±0

Results for commit eb9821f. ± Comparison against base commit 61d8201.

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 17, 2026

jbonofre approved these changes Sep 18, 2026

View reviewed changes

jbonofre merged commit c94ffea into main Sep 18, 2026
7 checks passed

jbonofre deleted the dependabot/maven/main/maven.resolver.version-2.0.23 branch September 18, 2026 04:02

Navigation Menu

build(deps): bump maven.resolver.version from 2.0.22 to 2.0.23 - #2916

build(deps): bump maven.resolver.version from 2.0.22 to 2.0.23#2916
jbonofre merged 1 commit into
mainfrom
dependabot/maven/main/maven.resolver.version-2.0.23

dependabot Bot commented on behalf of github Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 17, 2026

2.0.23

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

2.0.23

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

Uh oh!

github-actions Bot commented Sep 17, 2026

Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant