Releases · apache/maven-gpg-plugin (original) (raw)

3.2.8

🐛 Bug Fixes

• Make empty classifier null (not empty string) (#287) @cstamas

📝 Documentation updates

• [MNGSITE-529] - Rename "Goals" to "Plugin Documentation" (#129) @Bukama
• Describe how to prime a specific GPG key (#128) @kwin

👻 Maintenance

• Enable GitHub issues (#134) @Bukama
• Prefer Guice constructor injection (#126) @elharo

📦 Dependency updates

• Update parent POM to 45 (#284) @cstamas
• Bump bouncycastleVersion from 1.78.1 to 1.80 (#127) @dependabot[bot]
• Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#133) @dependabot[bot]
• Bump org.apache.maven.plugins:maven-invoker-plugin from 3.8.0 to 3.9.0 (#125) @dependabot[bot]
• Bump org.simplify4u.plugins:pgpverify-maven-plugin from 1.18.2 to 1.19.1 (#131) @dependabot[bot]
• Bump commons-io:commons-io from 2.17.0 to 2.18.0 (#124) @dependabot[bot]

3.2.7

3.2.6

3.2.5

Release Notes - Maven GPG Plugin - Version 3.2.5

Sub-task

• [MGPG-130] - Update sigstore extension to ".sigstore.json"

Dependency upgrade

• [MGPG-127] - Bump bouncycastleVersion from 1.78 to 1.78.1
• [MGPG-128] - Update to parent POM 42, prerequisite 3.6.3
• [MGPG-131] - (build) Bump org.apache.maven.plugins:maven-plugins from 42 to 43
• [MGPG-132] - Bump com.kohlschutter.junixsocket:junixsocket-core from 2.9.1 to 2.10.0
• [MGPG-133] - (build) Bump org.simplify4u.plugins:pgpverify-maven-plugin from 1.17.0 to 1.18.2
• [MGPG-134] - (build) Bump org.apache.maven.shared:maven-invoker from 3.2.0 to 3.3.0

• [MGPG-134] - Update maven-invoker (#110) @cstamas
• [MGPG-130] - Update sigstore extension to ".sigstore.json" (#109) @loosebazooka
• [MGPG-128] - Parent POM 42, prerequisite 3.6.3 (#100) @cstamas

📦 Dependency updates

• Bump org.simplify4u.plugins:pgpverify-maven-plugin from 1.17.0 to 1.18.2 (#105) @dependabot
• Bump com.kohlschutter.junixsocket:junixsocket-core from 2.9.1 to 2.10.0 (#107) @dependabot
• Bump org.apache.maven.plugins:maven-plugins from 42 to 43 (#108) @dependabot
• Bump org.apache.maven.plugins:maven-invoker-plugin from 3.6.1 to 3.7.0 (#103) @dependabot
• Bump bouncycastleVersion from 1.78 to 1.78.1 (#98) @dependabot

3.2.4

3.2.3

3.2.2

3.2.1

3.2.0

Release Notes - Maven GPG Plugin - Version 3.2.0

Bug

• [MGPG-85] - Regression in maven-metadata for SNAPSHOTs between 1.6 and 3.0.1
• [MGPG-98] - non-reproducible pom.xml
• [MGPG-99] - Passcode byte array provided to gpg executable on stdin is not terminated
• [MGPG-100] - Fix Temporary File Information Disclosure Vulnerability

New Feature

• [MGPG-106] - Introduce second signer implementation based on Bouncy Castle

Improvement

• [MGPG-101] - Switch to Junit5
• [MGPG-102] - Drop maven-artifact-transfer used by sign-and-deploy-file
• [MGPG-105] - Stop propagating bad practices; but allow for "compat mode"
• [MGPG-110] - The sign-and-deploy-file mojo POM validation is off

Task

• [MGPG-103] - Fix Windows CI
• [MGPG-107] - Settle on JUnit 5 assertions
• [MGPG-108] - Update plugin site doco

Dependency upgrade

• [MGPG-104] - Update to 3.9.6, drop the cruft, minimum baseline remains 3.2.5

What's Changed

• javadoc nits by @elharo in #51
• [MNG-6829] Replace StringUtils#isEmpty(String) and #isNotEmpty(String) by @timtebeek in #50
• Bump plexus-utils from 3.4.2 to 3.5.1 by @dependabot in #39
• [MGPG-101] Switch to JUnit 5 by @slachiewicz in #52
• Bump org.junit:junit-bom from 5.10.0 to 5.10.1 by @dependabot in #53
• Bump org.apache.maven.plugins:maven-invoker-plugin from 3.5.1 to 3.6.0 by @dependabot in #57
• Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 4.0.0 by @dependabot in #55
• Bump org.apache.maven.plugins:maven-plugins from 39 to 41 by @dependabot in #56
• Bump org.assertj:assertj-core from 3.24.2 to 3.25.2 by @dependabot in #62
• Bump org.junit:junit-bom from 5.10.1 to 5.10.2 by @dependabot in #63
• [MGPG-103] Fix Windows CI by @cstamas in #67
• [MGPG-104] Update to 3.9.6, drop the cruft, minimum baseline remains 3.2.5 by @cstamas in #68
• [MGPG-102] Drop MAT used in sign-and-deploy-file by @cstamas in #69
• [MGPG-107] Settle on JUnit 5 by @cstamas in #70
• [MGPG-105] Stop propagating bad practices by @cstamas in #71
• [MGPG-106] Introduce new signer: BC by @cstamas in #72
• Bump apache/maven-gh-actions-shared from 3 to 4 by @dependabot in #75
• [MGPG-105] Make possible backward compatibility by @cstamas in #74
• [MGPG-99] Make sure newline is added to input stream by @cstamas in #76
• [MGPG-110] SignAndDeployFileMojo validation is off by @cstamas in #78
• [MGPG-105] [MGPG-108] Make plugin backward compat and update site and doco by @cstamas in #77

New Contributors

• @timtebeek made their first contribution in #50
• @cstamas made their first contribution in #67

Full Changelog: maven-gpg-plugin-3.1.0...maven-gpg-plugin-3.2.0