Bump dependency maven to v3.10.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
maven	uses-with	minor	3.9.16 → 3.10.0

---

Release Notes

apache/maven (maven)

v3.10.0: 3.10.0

Compare Source

🚀 New features and improvements

• Maven 3.10.x should use Maven 3.1 validation in strict mode (#​1542) @​gnodet
• Do not depend on maven-resolver-supplier-mvn3 (#​13266) @​cstamas
• [MNG-6797] - Remember if Maven model problems were encountered. (#​298) @​wilx
• feat: add relativePath validation (#​12742) @​cstamas
• Add validation for Plexus-based plugin dependency injection (#​12651) @​slawekjaranowski
• Introduce validation control (#​12549) @​cstamas
• Update to Resolver 2.0.21 (#​12504) @​cstamas
• [MNG-5913] - Allow defining aliases for existing server configurations in settings.xml (#​12475) @​slawekjaranowski

🐛 Bug Fixes

• Issue #​13265: let a settings server declare the repository origins its credentials may be used with (#​13275) @​slawekjaranowski
• Backport #​13040: treat reactor BOM imports as ProjectSorter edges so -am includes them (#​13263) @​gnodet
• [MNG-8174] - Fix NPE when a property references itself in a plugin configuration (backport #​12932) (#​12936) @​elharo
• Fix #​13200: publish a complete set from MavenProject.getArtifacts (#​13204) @​gnodet
• Fixes #​13135: ensure completeness of the reactor summary, privilege f… (#​13173) @​rmannibucau
• [3.10.x] Fix #​13084: sandbox profile activation context for external model builds (#​13114) @​gnodet
• Fix #​13100: honor repositories from legitimately-active external model profiles (#​13116) @​gnodet
• Add support for MAVEN_PROJECTBASEDIR substitution in jvm.config (backport of MNG-8598 to 3.10.x) (#​13115) @​gnodet
• Scope server credentials and validate legacy relocation coordinates (#​12954) @​slachiewicz
• Honour configured policy and validate inputs on the legacy compat paths (#​12978) @​gnodet
• Add unit test for #​12600 null-guard in forked executions (#​12923) @​gnodet
• Fix: make ProjectIndex thread-safe for parallel builds (backport #​12832) (#​12927) @​gnodet
• Fail on misconfigured plugin-requested toolchains (#​12616) @​wilx
• Resolve classified POM artifacts from the reactor in Maven 3.x (#​12659) @​wilx
• [3.10.x] Convert paths for MSYS2 and jvm.config placeholders in bin/mvn (#​12567) @​gnodet
• Preserve dependency scope in plugin artifacts - fix #​12497 (#​12503) @​slawekjaranowski

📝 Documentation updates

• docs: document plugin.xml V4 vs V3 (#​13261) @​gnodet
• [maven-3.10.x] Port the site documentation from APT to Markdown (#​12712) @​slachiewicz
• improve doc about deprecating plugin descriptor's requirement (#​12555) @​hboutemy
• Drop mention of Plexus XML (#​12482) @​cstamas

👻 Maintenance

• [3.10.x] maintenance: Align use of profiles (#​13274) @​cstamas
• Remove version from rat directory deployment (#​13046) @​slawekjaranowski
• Update NOTICE file in distribution packages (#​13044) @​slawekjaranowski
• Restrict what a repository-resolved model contributes to the build (#​12953) @​slachiewicz
• Validate coordinates and repository precedence during artifact resolution (#​12952) @​slachiewicz
• [MNG-8129] - Clarify relativePath validation comment (#​12966) @​gnodet
• [12811] Keep plexus-cipher at 2.0: POM note (#​12879) @​slachiewicz
• [3.10.x] Use try-with-resources (#​12845) @​slachiewicz
• Migrate the embedder-test-project fixture to JUnit 5 (#​12717) @​slachiewicz
• [maven-3.10.x] Port the site documentation from APT to Markdown (#​12712) @​slachiewicz
• Migrate legacy plugin Javadoc annotations in Maven Embedder tests (#​12708) @​wilx
• Replace custom GraphLogger with DependencyGraphDumper in dependency resolution (#​12639) @​slawekjaranowski
• Fix UT: do not use checkout directly (#​12483) @​cstamas

🔧 Build

• Replace nicoulaj checksum plugin with maveniverse checksum plugin (#​13053) @​slawekjaranowski
• 3.10.x Build by JDK 25, limit JDK to min and max LTS in build (#​12848) @​slawekjaranowski
• Update Maven version to 3.10.0-rc-1 in GH configuration (#​12847) @​slawekjaranowski

📦 Dependency updates

• [3.10.x] deps: Update to Maven Resolver 2.0.24 (#​13271) @​cstamas
• build: bump xmlunitVersion from 2.13.0 to 2.14.0 (#​13237) @​dependabot[bot]
• build: bump org.apache.maven:maven-parent from 49 to 50 (#​13242) @​dependabot[bot]
• Resolver 2.0.23 and validation cleanup (#​13078) @​cstamas
• Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#​13134) @​dependabot[bot]
• Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.3.0 to 3.3.1 (#​13132) @​dependabot[bot]
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 (#​13130) @​dependabot[bot]
• Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.27 to 1.28 (#​13129) @​dependabot[bot]
• Bump actions/setup-java from 6.0.0 to 6.0.1 (#​13110) @​dependabot[bot]
• Bump jlineVersion from 3.30.16 to 3.30.17 (#​13111) @​dependabot[bot]
• Bump slf4jVersion from 2.0.18 to 2.0.19 (#​13074) @​dependabot[bot]
• Bump org.codehaus.modello:modello-maven-plugin from 2.8.0 to 2.8.1 (#​13028) @​dependabot[bot]
• [12811] Keep plexus-cipher at 2.0: POM note (#​12879) @​slachiewicz
• Bump actions/setup-java from 5.7.0 to 6.0.0 (#​12860) @​dependabot[bot]
• Deps: Bump to Resolver 2.0.22 (#​12803) @​cstamas
• Bump resolverVersion from 2.0.21 to 2.0.22 (#​12823) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0 (#​12825) @​dependabot[bot]
• Bump com.google.guava:guava from 33.7.0-jre to 33.7.1-jre (#​12796) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (#​12795) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-testing from 2.1.0 to 2.2.0 (#​12794) @​dependabot[bot]
• Bump org.codehaus.modello:modello-maven-plugin from 2.7.0 to 2.8.0 (#​12793) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-classworlds from 2.12.0 to 2.12.1 (#​12792) @​dependabot[bot]
• Bump com.google.guava:guava from 33.6.0-jre to 33.7.0-jre (#​12776) @​dependabot[bot]
• Bump xmlunitVersion from 2.12.0 to 2.13.0 (#​12673) @​dependabot[bot]
• Bump actions/setup-java from 5.6.0 to 5.7.0 (#​12666) @​dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#​12496) @​dependabot[bot]
• Deps: Bump to Eclipse Sisu 1.1.0 (#​12547) @​cstamas
• Bump resolverVersion from 2.0.21-SNAPSHOT to 2.0.21 (#​12545) @​dependabot[bot]
• Bump jlineVersion from 3.30.15 to 3.30.16 (#​12518) @​dependabot[bot]
• Bump actions/checkout from 7.0.0 to 7.0.1 (#​12514) @​dependabot[bot]
• Update to Resolver 2.0.21 (#​12504) @​cstamas
• Bump actions/setup-java from 5.5.0 to 5.6.0 (#​12501) @​dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (#​12495) @​dependabot[bot]
• Bump actions/setup-java from 5.4.0 to 5.5.0 (#​12439) @​dependabot[bot]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 2 weeks on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

☀️   Quality Monitor

Tests

     Unit Tests: ✅ successful — 70 passed $\textsf{(±0)}$
   🚀   Integration Tests: ✅ successful — 11 passed $\textsf{(±0)}$
   ⛔   Architecture Tests: ✅ successful — 15 passed $\textsf{(±0)}$

Coverage for New Code

   〰️   Line Coverage: 100.00% — perfect 🎉
   ➰   Branch Coverage: 100.00% — perfect 🎉

Coverage for Whole Project

   〰️   Line Coverage: 39.85% $\textsf{(±0)}$ — 326 missed lines
   ➰   Branch Coverage: 46.54% $\textsf{(±0)}$ — 85 missed branches

Style

     CheckStyle: No warnings $\textsf{(±0)}$
     PMD: No warnings $\textsf{(±0)}$
   ☕   Java Compiler: No warnings $\textsf{(±0)}$

Bugs

     SpotBugs: No bugs $\textsf{(±0)}$
   🐛   Error Prone: No bugs $\textsf{(±0)}$

API Problems

   🚫   Revapi: 14 warnings $\textsf{(±0)}$ — low: 14

Vulnerabilities

   🛡️   OWASP Dependency Check: 264 vulnerabilities $\color{green}{\textsf{(+264)}}$ — error: 22, high: 79, normal: 154, low: 9

Software Metrics

   🌀   Cyclomatic Complexity: 275 (total)
   💭   Cognitive Complexity: 103 (total)
   ➿   N-Path Complexity: 265 (total)
   📏   Lines of Code: 2666 (total)
   📝   Non Commenting Source Statements: 825 (total)
   🔗   Class Cohesion: 100.00% (maximum)
   ⚖️   Weight of Class: 100.00% (maximum)

📌 Reference Results

Delta reports computed against the reference results of 1c148d4 in workflow run 37377334077.

🚦 Quality Gates

Overall Status: ✅ SUCCESS

✅ Passed Gates

• ✅ Overall Tests Success Rate: 100.00 >= 100.00
• ✅ Line Coverage in New Code: 100.00 >= 90.00
• ✅ Branch Coverage in New Code: 100.00 >= 90.00
• ✅ Potential Bugs in Whole Project: 0.00 <= 0.00
• ✅ Style Violation in Whole Project: 0.00 <= 0.00

---

Created by Quality Monitor v4.15.0 (#82d77af). More details are shown in the GitHub Checks Result.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (3.10.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.