Bring the plugin repositories in line with mojohaus/versions #15

Applies what mojohaus/versions went through (its #1414, #1438 and #1445) to the other plugin repositories. Each change is a pull request in the repository, linked here; servicedocgen-maven-plugin and siteskinner-maven-plugin are left out.

Audit of the default branches, 2026-10-11

Wave 1: security and CI

• wagon-maven-plugin: Build against Maven 3.9.16 and require Maven 3.9.0 wagon-maven-plugin#183 (Maven 3.9.16, clears the critical maven-core alert), Update the Jetty test dependencies to 9.4.58 wagon-maven-plugin#184 (Jetty 9.4.58, clears 3 of 7 test-scope alerts; the rest need Jetty 12 and Java 17)
• rpm-maven-plugin revival: Update mojo-parent to 97 rpm-maven-plugin#146 (mojo-parent 97), Build against Maven 3.9.16 and require Maven 3.9.0 rpm-maven-plugin#147 (Maven 3.9.16 and a 3.9.0 prerequisite, carrying #148 for the disabled-packaging install and maven-verify.yml@v5, #149 for Dependabot and #145 for PR automation)
• invoker.parallelThreads from 0.75C to 1C: Run one integration test per CPU core animal-sniffer#357, Run one integration test per CPU core build-helper-maven-plugin#254, Run one integration test per CPU core extra-enforcer-rules#374, Run one integration test per CPU core flatten-maven-plugin#542, Run one integration test per CPU core javacc-maven-plugin#121, Run one integration test per CPU core jaxb2-maven-plugin#440, Run one integration test per CPU core license-maven-plugin#756
• Parallel ITs and the C1/SerialGC JVM settings where ITs run serially: Run the ITs in parallel with C1 only and the serial GC aspectj-maven-plugin#277 (re-lands #274, which merged into the branch of #275 after #275 had merged), Run the ITs in parallel with C1 only and the serial GC xml-maven-plugin#189, Run the ITs in parallel with C1 only and the serial GC mrm#325, Run the ITs in parallel with C1 only and the serial GC jdepend-maven-plugin#101, Run the ITs in parallel with C1 only and the serial GC tidy-maven-plugin#141, Run the ITs in parallel with C1 only and the serial GC keytool#155, Run the ITs in parallel with C1 only and the serial GC native2ascii-maven-plugin#99. Not applied: wagon-maven-plugin does not run its ITs through invoker; templating, maven-native, properties and l10n have 2 to 4 ITs each; rpm-maven-plugin comes with its revival
• matrix-exclude: not needed. jdepend-maven-plugin already trims in maven-verify.yml; aspectj-maven-plugin and buildplan-maven-plugin run one Ubuntu job; native2ascii-maven-plugin runs Linux containers; rpm-maven-plugin runs Ubuntu only; maven-native's nine jobs take under a minute each
• Keep the comment out of the matrix-exclude JSON templating-maven-plugin#128: master CI failed because a comment sat inside the matrix-exclude JSON
• Shared CI setup where a repository diverged: Build with the shared Maven verify workflow aspectj-maven-plugin#278, Build with the shared Maven verify workflow buildplan-maven-plugin#310, Build with the shared Maven verify workflow maven-native#192 (also fixes the site build on Maven 3.10), Build with the shared Maven verify workflow native2ascii-maven-plugin#101, Draft the release notes with Release Drafter templating-maven-plugin#129 (Release Drafter), Bring the workflow templates in line with the repositories #16 (workflow templates)
• Point the released-version ITs at the URL the build uses for central build-helper-maven-plugin#256: on Maven 3.10, two ITs with their own settings for central re-downloaded about 25 jars into the shared local repository, which fails on Windows while a parallel IT has the jar open
• Labels: the canonical set from .github/labels.js was missing 8 to 16 labels per repository, because the weekly label sync only reports drift and its apply run (which needs LABEL_SYNC_TOKEN) has never run; the missing labels are now created, existing ones untouched. Raising the minimum Maven version is labelled removed, so it shows near the top of the release notes without a major version
• PR automation (merged pull requests go to the release milestone) in 22 repositories, after the milestones were cleaned up: one open milestone per branch, or a branch: master description where several stay open
• Not rolled out yet: the stale bot runs in only 6 repositories; a maintainer decision

Wave 2: fixtures and build

• Fixture POMs that raised Dependabot alerts use localhost mocks served by mrm from src/it-repo (each mock jar directory carries its source next to the class), and Dependabot skips src/it, src/it-repo and src/test/resources: Serve the vulnerable IT fixture dependencies from a mock repository license-maven-plugin#759 (15 alerts), Serve the log4j fixture dependency from a mock repository rpm-maven-plugin#152 (24), Serve the vulnerable fixture dependencies from a mock repository extra-enforcer-rules#379 (6), Serve the plexus-utils fixture dependency from a mock repository exec-maven-plugin#549 (4), Use localhost coordinates in the tidy fixture POMs tidy-maven-plugin#144 (4), Use localhost coordinates for the copied BOM entries in bom-flattenMode flatten-maven-plugin#545 (3), Weave a local fixture jar in MASPECTJ-86 instead of commons-lang aspectj-maven-plugin#282 (1), Replace the mysql connector in the win32 JNI fixture maven-native#195 (1); Stop tracking the jar mrm generates in src/it-repo license-maven-plugin#761 stops tracking the _*.jar mrm generates while serving the mocks. The alerts close when Dependabot rescans master
• Maven 3.9.0 as the prerequisite, built against 3.9.16: Require Maven 3.9.0 versions#1453, Require Maven 3.9.0 and build against 3.9.16 aspectj-maven-plugin#280, Require Maven 3.9.0 buildplan-maven-plugin#309, Require Maven 3.9.0 flatten-maven-plugin#543, Require Maven 3.9.0 jdepend-maven-plugin#102, Require Maven 3.9.0 keytool#156, Require Maven 3.9.0 license-maven-plugin#757, Require Maven 3.9.0 maven-native#191, Require Maven 3.9.0 mrm#326, Require Maven 3.9.0 native2ascii-maven-plugin#103 (re-lands #100), Require Maven 3.9.0 animal-sniffer#359, Require Maven 3.9.0 build-helper-maven-plugin#257, Require Maven 3.9.0 buildnumber-maven-plugin#292, Require Maven 3.9.0 extra-enforcer-rules#377, Require Maven 3.9.0 l10n-maven-plugin#65, Require Maven 3.9.0 properties-maven-plugin#173, Require Maven 3.9.0 taglist-maven-plugin#206, Require Maven 3.9.0 templating-maven-plugin#131, Require Maven 3.9.0 tidy-maven-plugin#143, Require Maven 3.9.0 xml-maven-plugin#191, Require Maven 3.9.0 exec-maven-plugin#548, Require Maven 3.9.0 javacc-maven-plugin#123, Require Maven 3.9.0 jaxb2-maven-plugin#442; wagon-maven-plugin and rpm-maven-plugin got it in wave 1

Wave 3: tests and documentation

• Unit tests on JUnit 5, without JUnit 4, the vintage engine or Hamcrest: Migrate the unit tests to JUnit 5 aspectj-maven-plugin#281, Migrate the unit tests to JUnit 5 flatten-maven-plugin#544, Migrate the unit tests to JUnit 5 maven-native#194, Migrate the unit tests to JUnit 5 javacc-maven-plugin#124, Migrate the unit tests to JUnit 5 properties-maven-plugin#174, Migrate the unit tests to JUnit 5 xml-maven-plugin#192, Migrate the tests to JUnit 5 buildnumber-maven-plugin#293, Migrate SignatureCheckerTest to JUnit 5 animal-sniffer#360. Not migrated: wagon-maven-plugin's takari ITs, because the Jupiter support of takari-plugin-testing 3.1.1 needs Java 10 (Migrate the integration tests to JUnit 5 wagon-maven-plugin#186); the JUnit 4 left in build-helper, exec, rpm and jdepend sits in IT fixture projects, not in the plugins' own tests
• Verify scripts written as assertions: Write the integration test scripts as plain assertions license-maven-plugin#758, Write the regex and timestamp verify scripts as assertions build-helper-maven-plugin#258, Write the jaxb2 verify scripts as assertions jaxb2-maven-plugin#443, Write the smokes verify script as an assertion extra-enforcer-rules#378, Write the MKEYTOOL-10 post-build script as assertions keytool#158. BeanShell scripts ported to Groovy: Port the BeanShell verify scripts to Groovy native2ascii-maven-plugin#104, Port the BeanShell verify scripts to Groovy animal-sniffer#361; buildnumber-maven-plugin's one BeanShell script belongs to a disabled test and stays as it is
• AGENTS.md with the repository's build and test conventions, as in mojohaus/versions, linked from the README: Add AGENTS.md flatten-maven-plugin#546, Add AGENTS.md license-maven-plugin#760, Add AGENTS.md aspectj-maven-plugin#284 (re-lands #283), Add AGENTS.md animal-sniffer#366, Add AGENTS.md build-helper-maven-plugin#263, Add AGENTS.md buildnumber-maven-plugin#299, Add AGENTS.md buildplan-maven-plugin#315, Add AGENTS.md exec-maven-plugin#552, Add AGENTS.md extra-enforcer-rules#384, Add AGENTS.md javacc-maven-plugin#129, Add AGENTS.md jaxb2-maven-plugin#448, Add AGENTS.md jdepend-maven-plugin#107, Add AGENTS.md keytool#162, Add AGENTS.md l10n-maven-plugin#68, Add AGENTS.md maven-native#201, Add AGENTS.md mrm#331, Add AGENTS.md native2ascii-maven-plugin#109, Add AGENTS.md properties-maven-plugin#179, Add AGENTS.md rpm-maven-plugin#156, Add AGENTS.md taglist-maven-plugin#212, Add AGENTS.md templating-maven-plugin#137, Add AGENTS.md tidy-maven-plugin#148, Add AGENTS.md wagon-maven-plugin#193, Add AGENTS.md xml-maven-plugin#198; Run the integration tests in CI l10n-maven-plugin#69 makes l10n's CI run its integration tests, which it had never done
• JUnit 5 for the last JUnit 3 harness: Migrate the unit tests to JUnit 5 taglist-maven-plugin#208 (AbstractMojoTestCase and the vintage engine). wagon-maven-plugin's integration tests run through maven-executor on JUnit 5 instead of takari-plugin-testing (Run the integration tests with maven-executor on JUnit 5 wagon-maven-plugin#187), and use the JDK's HTTP server instead of Jetty 9.4, which is end of life (Serve the HTTP integration tests with the JDK's HTTP server instead of Jetty wagon-maven-plugin#192, closes the four Jetty alerts)
• OpenRewrite JUnit5BestPractices (rewrite-testing-frameworks 3.44.0) on every repository whose tests are on JUnit 5, with the same test count per class before and after: Apply the JUnit 5 best practices to the tests animal-sniffer#364, Apply the JUnit 5 best practices to the tests aspectj-maven-plugin#287, Apply the JUnit 5 best practices to the tests build-helper-maven-plugin#261, Apply the JUnit 5 best practices to the tests buildnumber-maven-plugin#296, Apply the JUnit 5 best practices to the tests extra-enforcer-rules#382, Apply the JUnit 5 best practices to the tests flatten-maven-plugin#548, Apply the JUnit 5 best practices to the tests javacc-maven-plugin#126, Apply the JUnit 5 best practices to the tests jaxb2-maven-plugin#445, Apply the JUnit 5 best practices to the tests license-maven-plugin#763, Apply the JUnit 5 best practices to the tests maven-native#198, Apply the JUnit 5 best practices to the tests native2ascii-maven-plugin#107, Apply the JUnit 5 best practices to the tests properties-maven-plugin#176, Apply the JUnit 5 best practices to the tests taglist-maven-plugin#211, Apply the JUnit 5 best practices to the tests templating-maven-plugin#133, Apply the JUnit 5 best practices to the tests tidy-maven-plugin#146, Apply the JUnit 5 best practices to the tests xml-maven-plugin#194. jaxb2 also lost six fail() calls that ended assertThrows lambdas and could never run

Wave 4: CI cost

• JDKs from the runners' tool cache: the shared workflow downloads Zulu in every job, while the runners ship Temurin 8, 11, 17, 21 and 25; every repository sets jdk-distribution-matrix: '[ "temurin" ]' (our matrices skip JDK 8 on macOS, which Temurin lacks): Use the runners' cached Temurin JDKs in CI animal-sniffer#365, Use the runners' cached Temurin JDKs in CI aspectj-maven-plugin#289, Use the runners' cached Temurin JDKs in CI build-helper-maven-plugin#262, Use the runners' cached Temurin JDKs in CI buildnumber-maven-plugin#298, Use the runners' cached Temurin JDKs in CI buildplan-maven-plugin#316, Use the runners' cached Temurin JDKs in CI exec-maven-plugin#551, Use the runners' cached Temurin JDKs in CI extra-enforcer-rules#383, Use the runners' cached Temurin JDKs in CI flatten-maven-plugin#550, Use the runners' cached Temurin JDKs in CI javacc-maven-plugin#128, Use the runners' cached Temurin JDKs in CI jaxb2-maven-plugin#447, Use the runners' cached Temurin JDKs in CI keytool#161, Use the runners' cached Temurin JDKs in CI l10n-maven-plugin#67, Use the runners' cached Temurin JDKs in CI license-maven-plugin#764, Use the runners' cached Temurin JDKs in CI maven-native#200, Use the runners' cached Temurin JDKs in CI mrm#330, Use the runners' cached Temurin JDKs in CI native2ascii-maven-plugin#108, Use the runners' cached Temurin JDKs in CI properties-maven-plugin#178, Use the runners' cached Temurin JDKs in CI rpm-maven-plugin#157, Use the runners' cached Temurin JDKs in CI taglist-maven-plugin#210, Use the runners' cached Temurin JDKs in CI templating-maven-plugin#136, Use the runners' cached Temurin JDKs in CI tidy-maven-plugin#147, Use the runners' cached Temurin JDKs in CI versions#1459, Use the runners' cached Temurin JDKs in CI wagon-maven-plugin#191, Use the runners' cached Temurin JDKs in CI xml-maven-plugin#197
• Stale bot removed: Remove the stale bot buildnumber-maven-plugin#297, Remove the stale bot flatten-maven-plugin#549, Remove the stale bot jdepend-maven-plugin#106, Remove the stale bot taglist-maven-plugin#209, Remove the stale bot versions#1458, Remove the stale bot wagon-maven-plugin#190
• GitHub Actions caches: every topic branch and Dependabot branch saved its own ~170 MB per OS, so repositories hit the 10 GB limit and evicted master's entries; deleting the caches of deleted branches and closed pull requests in 27 repositories freed 42.6 GB
• In the shared workflow, pending review: Set up Maven without the wrapper apache/maven-gh-actions-shared#338 (Maven without the wrapper: the runner's Maven when it matches, otherwise a cached download, so jobs stop fetching the wrapper and Maven from Central) and Cache the toolchain JDKs and save caches only on the default branch apache/maven-gh-actions-shared#339 (cache the toolchain JDKs; pull requests and dependabot/ branches stop saving caches). Once released, MojoHaus sets cache-save-default-branch-only: true

Also done

• Bump versions-maven-plugin from 2.22.0 to 2.23.0 mojo-parent#789: versions-maven-plugin 2.23.0
• Maven 4 in CI: Run CI on Maven 4 rpm-maven-plugin#154 (configuration of Dependency includes and excludes on Maven 4) and Run CI on Maven 4 buildplan-maven-plugin#313 (Maven 4 phase names in list-phase); Resolve the enforcer rule's signature through Maven Resolver animal-sniffer#367 moves the enforcer rule off maven-compat to Maven Resolver

Open

• JDK 27: Spotless fails on JDK 27 until palantir-java-format ships Support JDK 27 (JDK-8372948, JDK-8268850) palantir/palantir-java-format#1786; no repository tests 26 or 27 yet
• buildplan-maven-plugin is the only repository on the ITF test framework (last release December 2023); its four ITs could move to maven-executor as wagon's did