Flatten Maven Plugin 1.9.0 fixes CI-friendly property interpolation when custom pomElements are configured, updates its Plexus XML/interpolation dependencies, and cleans up declared Maven dependencies. It requires Maven 3.9.0 or later and Java 8 or later.

✨ Highlights

• CI-friendly property interpolation with custom <pomElements>: Fixed a bug where configuring custom <pomElements> alongside <flattenMode>resolveCiFriendliesOnly</flattenMode> failed to initialize the CI-friendly property interpolator, leaving ${revision}, ${sha1}, and ${changelist} placeholders unresolved in the flattened POM (#528).
• Updated Plexus stack: Upgraded plexus-xml to 3.1.0, plexus-utils to 4.1.0, and plexus-interpolation to 1.30.0 (#526, #527, #533).

🚨 Removed

• Require Maven 3.9.0 (#543) @slachiewicz

🐛 Bug Fixes

• Fix CI interpolation with custom POM elements (#528) @sfkamath

📝 Documentation updates

• Add AGENTS.md (#546) @slachiewicz

👻 Maintenance

• Raise the IT projects' Maven prerequisite to 3.9.0 (#556) @slachiewicz
• Declare the Maven artifacts the code uses (#555) @slachiewicz
• Clean up declared dependencies (#553) @slachiewicz
• Skip resolve-properties-ci IT on Maven 3.10.0 and later (#552) @slawekjaranowski
• Remove the stale bot (#549) @slachiewicz
• Apply the JUnit 5 best practices to the tests (#548) @slachiewicz
• Keep Dependabot on Maven 3.9.x (#547) @slachiewicz
• Migrate the unit tests to JUnit 5 (#544) @slachiewicz
• Stop dependabot from updating test fixtures (#525) @slachiewicz

🔧 Build

• Keep Dependabot on Mockito 4 (#560) @slachiewicz
• Keep Dependabot on Maven 3.9.x and Resolver 1.9.x (#557) @slachiewicz
• Use the runners' cached Temurin JDKs in CI (#550) @slachiewicz
• Use localhost coordinates for the copied BOM entries in bom-flattenMode (#545) @slachiewicz
• Run one integration test per CPU core (#542) @slachiewicz
• Check dependencies monthly and group the updates (#541) @slachiewicz
• Run fewer JDKs on macOS and Windows (#540) @slachiewicz
• Run the integration tests in parallel (#538) @slachiewicz
• Keep Dependabot off plexus-xml 4.x and SLF4J 2.x (#532) @slachiewicz

📦 Dependency updates

• Bump com.google.guava:guava from 32.0.0-jre to 33.7.2-jre in /src/it/projects/bom-pomElements/bom (#554, #559) @dependabot[bot]
• Bump the maven group with 2 updates (#558) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-core from 2.15.0 to 2.18.11 in /src/it/projects/bom-flattenMode/bom (#539) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-core from 2.18.6 to 2.18.11 in /src/it/projects/bom-pomElements/bom (#521, #537) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.11 in /src/it/projects/bom-flattenMode/bom (#530, #535) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.11 in /src/it/projects/bom-pomElements/bom (#531, #536) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-xml from 3.0.1 to 3.1.0 (#533) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 (#526) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0 (#527) @dependabot[bot]

Thanks to @sfkamath, @slachiewicz, @slawekjaranowski and @codex.

Full changelog

🚀 New features and improvements

• Configurable name for the revision variable (#487) @senivam

🐛 Bug Fixes

• Fix for #408, ensure nested dependency exclusions aren't overrided (#485) @treilhes
• Fix for Maven 3.10.x (#517) @slawekjaranowski

🔧 Build

• Add PR automation workflow to GitHub Actions (#522) @slawekjaranowski

📦 Dependency updates

• Bump mavenVersion from 3.9.15 to 3.9.16 (#511) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#514) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#516) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml from 4 to 5 (#515) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 96 to 97 (#519) @dependabot[bot]
• Bump mavenVersion from 3.9.14 to 3.9.15 (#509) @dependabot[bot]
• Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#510) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 (#508) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.6 to 3.27.7 (#502) @dependabot[bot]
• Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (#503) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-core from 2.15.0 to 2.18.6 in /src/it/projects/bom-pomElements/bom (#504) @dependabot[bot]
• Bump mavenVersion from 3.9.12 to 3.9.14 (#506) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 95 to 96 (#507) @dependabot[bot]
• Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.4.0 to 3.5.0 (#501) @dependabot[bot]
• Bump mavenVersion from 3.9.11 to 3.9.12 (#498) @dependabot[bot]
• Bump parent to 95 (#500) @slachiewicz
• Bump org.assertj:assertj-core from 3.27.5 to 3.27.6 (#484) @dependabot[bot]
• Bump commons-io:commons-io from 2.20.0 to 2.21.0 (#492) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29 (#493) @dependabot[bot]
• Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.3.0 to 3.4.0 (#491) @dependabot[bot]

🐛 Bug Fixes

• Fixes condition-activated profiles not considered in effective model (#481) @oldhen

📦 Dependency updates

• Bump org.assertj:assertj-core from 3.27.4 to 3.27.5 (#482) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 92 to 93 (#480) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#479) @dependabot[bot]

🐛 Bug Fixes

• Create missing target directories, use NIO for file block operations (#471) @slawekjaranowski

📝 Documentation updates

• Clarify example in usage about updatePomFile behavior (#477) @slawekjaranowski

👻 Maintenance

• Add stale GitHub Action (#476) @slawekjaranowski
• Add Maven 4 to build matrix on GitHub Actions (#474) @slawekjaranowski
• Improve assertions in no-overwrite tests (#475) @slawekjaranowski
• Add a missing plugin version in ITS (#473) @slawekjaranowski
• Add integration test for install and deploy flattened pom (#472) @slawekjaranowski

📦 Dependency updates

• Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#470) @dependabot[bot]
• Bump mavenVersion from 3.9.10 to 3.9.11 (#467) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-core from 2.3.3 to 2.15.0 in /src/it/projects/bom-flattenMode/bom (#464) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-core from 2.13.0 to 2.15.0 in /src/it/projects/bom-pomElements/bom (#463) @dependabot[bot]

🐛 Bug Fixes

• Fix #400 - Preserve POM content ordering (and formatting) on resolveCiFriendliesOnly flattenMode (#446) @stechio
• Fix FilteringValueSourceWrapper for a newer version of plexus-interpolation, Maven 3.9.10 (#453) @slawekjaranowski

📝 Documentation updates

• Use resolveCiFriendliesOnly in examples instead of minimum for flattenMode (#460) @slawekjaranowski
• Remove a dead link to MOJO-2030 from documentation (#459) @slawekjaranowski
• Rename 'Goals' to 'Plugin Documentation' in site manu (#456) @slawekjaranowski

👻 Maintenance

• Fix typo in License name (#458) @slawekjaranowski
• Use constant 3.6.3 in prerequisites/maven as minimal Maven version (#457) @slawekjaranowski

📦 Dependency updates

• Bump mavenVersion from 3.6.3 to 3.9.10 (#455) @dependabot[bot]
• Bump com.fasterxml.jackson.core:jackson-core from 2.3.3 to 2.13.0 in /src/it/projects/bom-pomElements/bom (#450) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 87 to 92 (#454) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28 (#443) @dependabot[bot]
• Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#444) @dependabot[bot]

🚀 New features and improvements

• Bind :clean to 'clean' phase by default (#435) @pzygielo
• Feature/extended interpolate (#384) @SergeDemoulinGebit

🐛 Bug Fixes

• Fix Issue#377 Regression: parent dependencies missing in flattened pom (#417) @hkampbjorn

📦 Dependency updates

• Bump org.codehaus.mojo:mojo-parent from 86 to 87 (#437) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.2 to 3.27.3 (#434) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.1 to 3.27.2 (#433) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.0 to 3.27.1 (#432) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.26.3 to 3.27.0 (#431) @dependabot[bot]
• Bump commons-io:commons-io from 2.17.0 to 2.18.0 (#430) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 85 to 86 (#425) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.1 to 4.0.2 (#428) @dependabot[bot]
• Bump commons-io:commons-io from 2.16.1 to 2.17.0 (#427) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.26.0 to 3.26.3 (#421) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 84 to 85 (#424) @dependabot[bot]
• Bump org.eclipse.sisu:org.eclipse.sisu.inject from 0.9.0.M2 to 0.9.0.M3 (#418) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 82 to 84 (#420) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.25.3 to 3.26.0 (#416) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-xml from 3.0.0 to 3.0.1 (#415) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 81 to 82 (#414) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 80 to 81 (#413) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.0 to 4.0.1 (#411) @dependabot[bot]
• Bump commons-io:commons-io from 2.16.0 to 2.16.1 (#410) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 78 to 80 (#406) @dependabot[bot]
• Bump commons-io:commons-io from 2.15.1 to 2.16.0 (#409) @dependabot[bot]
• Bump apache/maven-gh-actions-shared from 3 to 4 (#407) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.25.2 to 3.25.3 (#404) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.25.1 to 3.25.2 (#402) @dependabot[bot]

👻 Maintenance

• Avoid using deprecated items (#439) @slawekjaranowski
• Remove Maven wrapper configuration (#438) @slawekjaranowski
• Remove no-overwrite-3.6.2-before IT (#436) @pzygielo

🚀 New features and improvements

• Require Maven 3.6.3 as minimum (#399) @slawekjaranowski
• Make the default operation configurable (#371) @hgschmie
• Add skip flags (#385) @korthout
• Make more elements configurable in pomElements (#370) @hgschmie

🐛 Bug Fixes

• Fix next ITs for Maven 4 (#393) @slawekjaranowski
• #376 🐛 - Support interpolation for external profile properties (#378) @CedricMtta

📦 Dependency updates

• Bump plexus-utils from 3.5.1 to 4.0.0 (#359) @dependabot
• Bump org.codehaus.mojo:mojo-parent from 77 to 78 (#392) @dependabot
• Bump org.assertj:assertj-core from 3.24.2 to 3.25.1 (#391) @dependabot
• Bump org.codehaus.plexus:plexus-interpolation from 1.26 to 1.27 (#389) @dependabot
• Bump commons-io:commons-io from 2.15.0 to 2.15.1 (#388) @dependabot
• Bump commons-io:commons-io from 2.14.0 to 2.15.0 (#381) @dependabot
• Bump org.codehaus.mojo:mojo-parent from 76 to 77 (#380) @dependabot
• Bump commons-io:commons-io from 2.13.0 to 2.14.0 (#375) @dependabot
• upgrade sisu.inject: fixes Reproducible Builds (#357) @hboutemy
• Bump guava from 31.1-jre to 32.0.0-jre in /src/it/projects/bom-pomElements/bom (#364) @dependabot
• Bump guava from 31.1-jre to 32.0.0-jre in /src/it/projects/flatten-shaded-drp (#365) @dependabot
• Bump guava from 31.1-jre to 32.0.0-jre in /src/it/projects/bom-flattenMode/bom (#363) @dependabot
• Bump mojo-parent from 74 to 76 (#366) @dependabot
• Bump commons-io from 2.12.0 to 2.13.0 (#361) @dependabot
• Bump commons-io from 2.11.0 to 2.12.0 (#358) @dependabot

👻 Maintenance

• upgrade sisu.inject: fixes Reproducible Builds (#357) @hboutemy

🔧 Build

• Use default config for build (#398) @slawekjaranowski
• Use Shared ASF Action from Release Drafter - fix (#396) @slawekjaranowski
• Use Shared ASF Action from Release Drafter (#395) @slawekjaranowski
• Use Maven 3.9.6 for build (#394) @slawekjaranowski

🚀 New features and improvements

• Update Maven to 3.5.0 - fix for Maven 4 (#351) @gnodet

📦 Dependency updates

• Bump jackson-databind from 2.13.4.1 to 2.13.4.2 in /src/it/projects/bom-pomElements/bom (#354) @dependabot
• Bump jackson-databind from 2.13.4.1 to 2.13.4.2 in /src/it/projects/bom-flattenMode/bom (#353) @dependabot

👻 Maintenance

• Require Maven 3.5.4+ (#356) @slachiewicz
• Bump m-shade-p to 3.4.1 in flatten-shaded-drp test - fix for Maven 4 (#355) @slawekjaranowski
• Bump jackson-databind from 2.13.4.1 to 2.13.4.2 in /src/it/projects/bom-pomElements/bom (#354) @dependabot
• Bump jackson-databind from 2.13.4.1 to 2.13.4.2 in /src/it/projects/bom-flattenMode/bom (#353) @dependabot

🐛 Bug Fixes

• Fix #348 - Use repositories defined in project for artifact resolving (#350) @slawekjaranowski

🚀 New features and improvements

• Remove old and deprecated items, use Resolver API (#336) @cstamas
• Use System.lineSeparator() on all systems (#335) @ppkarwasz

🐛 Bug Fixes

• Fix #220 - multimodule-module-with-parent there is a missing direct-dependency (#329) @KemalSoysal
• #320 Fix importing dependency management in profiles from BOM imports (#321) @Syquel

📦 Dependency updates

• Bump parent from 70 to 74 (#343) @slawekjaranowski
• update maven-invoker-plugin to 3.5.0 (java 19+ support) (#341) @slachiewicz
• Bump plexus-utils from 3.5.0 to 3.5.1 (#338) @dependabot
• Bump assertj-core from 3.23.1 to 3.24.2 (#333) @dependabot
• Bump maven-dependency-tree from 3.2.0 to 3.2.1 (#328) @dependabot
• Bump plexus-utils from 3.4.2 to 3.5.0 (#325) @dependabot
• Bump jackson-databind from 2.12.6.1 to 2.13.4.1 in /src/it/projects/bom-flattenMode/bom (#323) @dependabot
• Bump jackson-databind from 2.12.6.1 to 2.13.4.1 in /src/it/projects/bom-pomElements/bom (#322) @dependabot
• Bump maven-dependency-tree from 3.1.1 to 3.2.0 (#315) @dependabot

👻 Maintenance

• Move CiModelInterpolator to JSR-330 component (#347) @slawekjaranowski
• Enable spotless plugin - automatic code formatting (#346) @slawekjaranowski
• fix some ide warmings and modernize a bit (#319) @olamy

🔧 Build

• Upgrade Maven versions used on GitHub 3.8.7 -> 3.8.8, 3.9.0 -> 3.91 (#344) @slawekjaranowski
• Run tests with latest Maven versions 3.8.7 and 3.9.0 (#340) @slachiewicz