Versions Maven Plugin 2.25.1 fixes a false warning in display-plugin-updates.

✨ Highlights

• No more false "version not specified" warnings for inherited plugins. display-plugin-updates used a parent plugin's version only when the parent declared <inherited>true</inherited>. A plugin versioned in the parent's build/plugins or reporting and used without a version in the child was reported as unversioned. Omitting <inherited> now counts as inherited, and <inherited>false</inherited> still keeps the version out (#1489, #1488 by @hkoosha).

🐛 Bug Fixes

• Treat a parent plugin without as inherited in display-plugin-updates (#1489) @slachiewicz

Thanks to @slachiewicz.

Full changelog

Versions Maven Plugin 2.25.0 stops suggesting pre-release versions by default, can hold back releases until they have been published for a set number of days, and can follow the ignore rules of a project's Dependabot configuration. It requires Maven 3.9.0 or later and Java 8 or later.

✨ Highlights

• Pre-releases are left out by default: every goal and report now skips alpha, beta, milestone, release-candidate, preview and early-access versions, so the newest stable version is reported instead of, say, 3.34.0.CR1. Pass -DallowPreReleases=true to get the previous output. When the current version is itself a pre-release or snapshot, newer pre-releases of the same release line are still offered: from 4.0.0-beta-3, both 4.0.0-beta-4 and 4.0.0 are offered (#1482).
• minimumReleaseAge: offer a release as an update only after it has been published for the given number of days (-Dversions.minimumReleaseAge=7). minimumReleaseAgeExcludes exempts trusted groupId:artifactId patterns. The publication date is read through Maven's own transport, so proxies, mirrors and server credentials apply (#1484).
• Dependabot ignore rules: with -Dversions.dependabotConfig=.github/dependabot.yml, the goals and reports skip the versions that the Dependabot configuration ignores for the branch being built (#1480).
• processPlugins for the use-latest-* and use-next-* goals: these goals can now also update plugins with a literal version in build/plugins, build/pluginManagement and reporting. A plugin version that needs a newer Maven than the project's minimum is skipped (#1477).
• set-property -Dinsert: adds a property the POM doesn't declare yet, optionally inside a profile given with profileId (#1340).
• rulesUri is loaded through the Maven Resolver: it works with whichever transports Maven is configured with, and the Wagon dependencies are gone. Code that constructs the mojos, reports or the maxDependencyUpdates enforcer rule directly now passes a TransporterProvider instead of a Map<String, Wagon> (#1475).
• Fixes: BOMs imported as ${project.groupId}:bom:${project.version} no longer fail with "Not fully interpolated artifact" on Maven 3.10 and 4 (#1486). A property that only a child module uses is evaluated with that module's rules again, as in 2.22.0 (#1481). numThreads is honored by the use-latest-* and use-next-* goals (#1478).

🚨 Removed

• Leave pre-release versions out by default in every goal and report (#1482) @slachiewicz

🚀 New features and improvements

• Add minimumReleaseAge to hold back recent releases (#1484) @slachiewicz, carrying a commit by @Master-Code-Programmer
• Apply the ignore rules from the Dependabot configuration (#1480) @slachiewicz
• set-property should add the property if it does not yet exist (#1340) @mandritschke
• Load rulesUri through the Resolver transporter instead of Wagon (#1475) @slachiewicz
• Update plugin versions with processPlugins in the use-latest and use-next goals (#1477) @slachiewicz

🐛 Bug Fixes

• Interpolate raw dependencyManagement coordinates before resolving versions (#1486) @slachiewicz
• Allow downgrading x.0.0-SNAPSHOT to an x.0.0 pre-release with allowMajorUpdates=false (#1374) @dcolazin
• Evaluate a parent property used only by a module in that module (#1481) @slachiewicz
• Honor numThreads in the use-latest and use-next goals (#1478) @slachiewicz

📦 Dependency updates

• Remove the maven-shared-utils dependency (#1483) @slachiewicz
• Use doxiaVersion for doxia-module-xhtml5 (#1476) @slachiewicz

Thanks to @dcolazin, @mandritschke, @Master-Code-Programmer and @slachiewicz.

Full changelog

Versions Maven Plugin 2.24.0 improves compatibility with modern Maven distributions when loading remote rulesUri configurations, refreshes its HTML report rendering and documentation site, and raises the minimum Maven version. It requires Maven 3.9.0 or later and Java 8 or later.

✨ Highlights

• Bundled file and http(s) Wagons for rulesUri: wagon-file and wagon-http are now bundled with the plugin so loading version comparison rules via <rulesUri> (http://, https://, or file://) works out of the box on Maven distributions (including Maven 4) that no longer bundle Wagon (#1474).
• Plain-text status indicators in HTML reports: The dependency, plugin, and property update reports now render status indicators as clear text instead of relying on external Doxia skin icon images (#1472).
• Documentation site improvements: Added a top-level landing page and navigation bar to the documentation site and clarified the XMLStreamException FAQ (#1454, #1465).

🚨 Removed

• Require Maven 3.9.0 (#1453) @slachiewicz

🚀 New features and improvements

• Show report status as text instead of skin images (#1472) @slachiewicz

📝 Documentation updates

• Fix typo in XMLStreamException documentation (#1465) @ngocnhan-tran1996
• Use the MojoHaus license header on the site pages (#1455) @slachiewicz
• Add a landing page and a top bar to the site (#1454) @slachiewicz

👻 Maintenance

• Bundle the file and HTTP wagons used to load rulesUri (#1474) @slachiewicz
• Declare the Maven artifacts the code uses (#1467) @slachiewicz
• Clean up declared dependencies (#1466) @slachiewicz
• Keep Dependabot on SLF4J 1.7.x (#1460) @slachiewicz
• Remove the stale bot (#1458) @slachiewicz
• Keep Dependabot on Maven 3.9.x (#1456) @slachiewicz

🔧 Build

• Keep Dependabot on Resolver 1.9.x (#1471) @slachiewicz
• Run the fail-fast build with verify instead of install (#1462) @slachiewicz
• Use the runners' cached Temurin JDKs in CI (#1459) @slachiewicz

📦 Dependency updates

• Stay on maven-reporting-api 4.0.0 (#1473) @slachiewicz
• Bump the maven group across 1 directory with 7 updates (#1469) @dependabot[bot]
• Bump the maven group with 4 updates (#1463) @dependabot[bot]
• Bump org.codehaus.woodstox:stax2-api from 4.3.1 to 4.3.2 in the maven group (#1461) @dependabot[bot]
• Bump commons-codec:commons-codec from 1.22.1 to 1.23.0 in the maven group (#1457) @dependabot[bot]

Thanks to @ngocnhan-tran1996 and @slachiewicz.

Full changelog

Versions Maven Plugin 2.23.0 makes the property goals more reliable on multi-module projects and adds a few options people have asked for over the years. It still runs on Java 8 and Maven 3.6.3 or later.

Property updates

• update-property and update-properties now update a property that is defined in a reactor parent POM, rather than leaving it untouched (#997).
• A property shared by a plugin and an excluded dependency is no longer updated behind the exclude's back (#1199).
• The property goals look up all properties in parallel, which shortens runs on POMs with many version properties (#1157).
• A dependency whose type or classifier is itself a property, such as ${native.classifier}, no longer breaks the property goals on Maven 3.10 and 4 (#1409).
• lock-snapshots and unlock-snapshots now rewrite snapshot versions held in properties, where that is safe (#1269).

Other fixes and additions

• versions:set with selected projects (-pl) updates the modules that inherit the version again, on Maven 3 and Maven 4 (#1338, #1339, #1357).
• Includes and excludes now filter the candidate versions too, so an excluded version is never proposed as an update (#1378).
• display-dependency-updates -Dversions.showNewestPerSegment lists the newest incremental, minor and major version, for example 1.0.3 -> 1.0.9, 1.3.9, 4.0.6 (#1043).
• parent-updates-report supports formats, including XML (#975), and the XML property updates report now fills in the current version (#976).
• The plugin update reports share their lookup with display-plugin-updates and include plugins declared only in <reporting> (#1250).

Thanks to @wilx and @adityaanikam for their contributions to this release.

🚀 New features and improvements

• Resolve property versions in parallel (#1447, fixes #1157) @slachiewicz
• Show the newest version of each segment in display-dependency-updates (#1450, fixes #1043) @slachiewicz
• Lock and unlock snapshot versions held in properties (#1451, fixes #1269) @slachiewicz
• Support the xml format in parent-updates-report (#1446, fixes #975) @slachiewicz
• Share plugin discovery and version lookup between display and reports (#1397, fixes #1250) @wilx

🐛 Bug Fixes

• Update properties defined in a reactor parent POM (#1448, fixes #997) @slachiewicz
• Honor the excludes of modules that use an inherited property (#1449, fixes #1199) @slachiewicz
• Restore versions:set propagation with selected projects (#1440, fixes #1338, #1339, #1357) @wilx
• Apply excludes and includes to candidate versions, not just the current one (#1441, fixes #1378) @adityaanikam
• Report the property's current version in the XML property updates report (#1437, fixes #976) @slachiewicz
• Interpolate the type and classifier of dependencies whose version is a property (#1436, fixes #1409) @slachiewicz

📝 Documentation updates

• Rewrite the README and add AGENTS.md (#1435) @slachiewicz

👻 Maintenance

• Use localhost coordinates instead of real artifacts in the compare-dependencies fixtures (#1443) @slachiewicz
• Delete the two integration tests that never ran (#1442) @slachiewicz
• Move it-resolve-ranges-001 and it-unlock-snapshots-001 to unit tests (#1439) @slachiewicz
• Run use-releases in it-use-releases-issue-134 (#1433) @slachiewicz
• Write the remaining verify scripts as assertions (#1431) @slachiewicz
• Move the tests of versions-common and versions-enforcer off Hamcrest (#1430) @slachiewicz
• Drop JUnit 4, the vintage engine and Hamcrest from the plugin tests (#1427) @slachiewicz
• Move the mojo tests that take their project from a POM to JUnit 5 (#1425) @slachiewicz
• Run mojo tests on JUnit 5 with the project built from their POM (#1423) @slachiewicz
• Move the mojo tests that build their project in code to JUnit 5 (#1424) @slachiewicz
• Move the tests that do not use the plugin testing harness to JUnit 5 and off Hamcrest (#1422) @slachiewicz
• Write 54 verify scripts as assertions (#1421) @slachiewicz
• Stop calling deprecated StringUtils.equals and MavenProject reporting getters (#1420) @slachiewicz
• Move fifteen use-* ITs to unit tests (#1418) @slachiewicz
• Move sixteen display-dependency-updates ITs to unit tests (#1417) @slachiewicz
• Move twelve update-properties ITs to unit tests (#1416) @slachiewicz
• Fix two ITs that tested a different goal than their name (#1415) @slachiewicz
• Keep plexus-xml on 3.x in Dependabot (#1401) @slachiewicz
• Port the IT scripts from BeanShell to Groovy (#1399) @slachiewicz

🔧 Build

• Share the integration test setup and drop unused POM entries (#1444) @slachiewicz
• Run one integration test per CPU core (#1434) @slachiewicz
• Check dependencies monthly and group the updates (#1413) @slachiewicz
• Run fewer JDKs on macOS and Windows (#1412) @slachiewicz
• Speed up the integration tests (#1411) @slachiewicz
• Raise the CI job timeout to 45 minutes (#1410) @slachiewicz
• Keep it-resolve-ranges-issue-1287 versionless on Maven 4.0.0-rc-7 (#1405) @slachiewicz
• Keep Dependabot off Mockito 5 (#1404) @slachiewicz

📦 Dependency updates

• Build against Maven 3.9.16 and keep Maven 3.6.3 as the prerequisite (#1429) @slachiewicz
• Bump org.codehaus.woodstox:stax2-api from 4.3.0 to 4.3.1 (#1407) @dependabot[bot]
• Bump com.fasterxml.woodstox:woodstox-core from 7.2.2 to 7.3.0 (#1408) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#1406) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-xml from 3.0.1 to 3.1.0 (#1402) @dependabot[bot]
• Keep plexus-xml on 3.x in Dependabot (#1401) @slachiewicz
• Bump byteBuddyVersion from 1.18.13 to 1.18.14 (#1398) @dependabot[bot]

Thanks to @slachiewicz, @wilx and @adityaanikam.

Full changelog

🚀 New features and improvements

• Add artifact classifier to ChangeRocorderXML (#1327) @ggkochanski

🐛 Bug Fixes

• Fix #1342: avoid shared include/exclude filters in parallel dependency updates (#1351) @slachiewicz

📝 Documentation updates

• docs(markdown): fix grammar, typos, and markup in .md.vm files (#1364) @kranthipoturaju
• docs: fix spelling in markdown docs (#1345) @kranthipoturaju

👻 Maintenance

• Stop dependabot from updating test fixtures (#1387) @slachiewicz

📦 Dependency updates

🚀 New features and improvements

• Add versions.skip parameter to skip plugin execution (#1328) @jorgheymans

🐛 Bug Fixes

• #1331: Fix NPE in restrictionForUnchangedSegment if actual version is null (#1332) @andrzejj0
• #1310: Corrected UseDepVersionMojo + handling a similar case in SetMojo, SetScmTagMojo, UpdateChildModulesMojo (#1322) @andrzejj0
• UseDepVersionMoto should process all projects on the project list (#1320) @andrzejj0
• Fixed #1317: Regression coming from ArtifactVersions::filter when currentVersion is null and ignoredVersions is not null (#1319) @andrzejj0

📝 Documentation updates

• Fix README typos in Contributing section (#1337) @kranthipoturaju
• #1323: Documentation (#1324) @andrzejj0

📦 Dependency updates

• Bump byteBuddyVersion from 1.18.3 to 1.18.4 (#1335) @dependabot[bot]
• Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.4.0 to 3.5.0 (#1333) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.4 to 4.11.0 (#1334) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 94 to 95 (#1330) @dependabot[bot]
• Bump byteBuddyVersion from 1.18.2 to 1.18.3 (#1329) @dependabot[bot]
• Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0 (#1325) @dependabot[bot]
• Bump byteBuddyVersion from 1.18.1 to 1.18.2 (#1318) @dependabot[bot]

🐛 Bug Fixes

• Fixed #1313: Do not show existing version as update (#1315) @andrzejj0

🚀 New features and improvements

• Allow filtering out pre releases in use-latest-versions (#1283) @Artur-
• #979: Output file is not overwritten by default (#1279) @andrzejj0

🐛 Bug Fixes

• Fixed a problem with dependency management filtering in the logged results (#1298) @andrzejj0
• Fixes #1295: getAllUpdates(boolean) should respect currentVersionRange (#1297) @andrzejj0
• Fixed #1287 - Versionless dependencies in dependencyManagement accepted by maven, but not bij resolve-ranges (#1288) @maroschutte
• Artifact comparison should use semantic version comparison. (#1281) @andrzejj0
• Resolves #1150: Resolve multiple level properties (properties resolving to properties) (#1276) @andrzejj0

📝 Documentation updates

• Add more examples of ignoredVersions config parameter (#1296) @mikkoi
• Fix broken href link in site (#1294) @mikkoi
• Added remaining javadoc comments. (#1293) @andrzejj0
• Getting rid of javadoc warnings (#1292) @andrzejj0

👻 Maintenance

• ResolverAdapter: a thin adapter over Resolver (#1301) @andrzejj0
• Fixed a problem with dependency management filtering in the logged results (#1298) @andrzejj0
• Fix broken href link in site (#1294) @mikkoi
• Added remaining javadoc comments. (#1293) @andrzejj0
• Getting rid of javadoc warnings (#1292) @andrzejj0
• Removed a redundant integration test (#1280) @andrzejj0

📦 Dependency updates

• Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0 (#1312) @dependabot[bot]
• Bump byteBuddyVersion from 1.18.0 to 1.18.1 (#1311) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.3 to 4.10.4 (#1307) @dependabot[bot]
• Bump byteBuddyVersion from 1.17.7 to 1.18.0 (#1309) @dependabot[bot]
• Bump commons-codec:commons-codec from 1.19.0 to 1.20.0 (#1303) @dependabot[bot]
• Bump commons-io:commons-io from 2.20.0 to 2.21.0 (#1305) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-i18n from 1.0.0 to 1.1.0 (#1306) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interactivity-api from 1.4 to 1.5.1 (#1308) @dependabot[bot]
• Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.3.0 to 3.4.0 (#1302) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.2 to 4.10.3 (#1290) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 93 to 94 (#1285) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.1 to 4.10.2 (#1282) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0 (#1278) @dependabot[bot]

🐛 Bug Fixes

• Resolves #1270: Ensuring thread safety when creating VersionsHelper (#1273) @andrzejj0
• Resolves #1266: Applying the include filter during association resolution (#1274) @andrzejj0

📝 Documentation updates

• Resolves #1271: Fixed broken Site links (#1275) @andrzejj0

💥 Breaking changes

• Removed numeric and mercury comparators, further refactoring (#1222) @andrzejj0

🚀 New features and improvements

• Parallel version updates (#1207) @andrzejj0
• Fixes #1140: Added showVersionless (default true) (#1187) @andrzejj0

🐛 Bug Fixes

• Resolves #1227: revert working in case of a non-standard "pom.xml" filename (#1263) @andrzejj0
• Resolves #1255: set-property special case when a property has no value (#1261) @andrzejj0
• Resolves #1251: nextSnapshotIndexToIncrement should zeros on the right (#1262) @andrzejj0
• Fixed #1233- set-property in profile without module property (#1234) @mcarlett
• Fix closing code tags (#1206) @pzygielo
• Resolves #1197: Handling a no-version case in dependencyManagement for CompareDependenciesMojo (#1198) @andrzejj0
• Fixed the failed release build (#1194) @andrzejj0
• Fixed #1191: Processes (all) profiles from original model if transitive is false (#1193) @andrzejj0
• Fixes #1140 for reports (#1188) @andrzejj0
• Fixes #1140: Added showVersionless (default true) (#1187) @andrzejj0
• Fixes #1182 and #1184: Bug fixes (#1185) @andrzejj0

👻 Maintenance

• Remove manual default from docs for parameters (#1264) @slawekjaranowski
• Use default configuration for release-drafter (#1256) @slawekjaranowski
• Bump project version to 2.19.0-SNAPSHOT (#1237) @slawekjaranowski
• Exposing the problem causing artifact if Resolver throws an exception (#1224) @andrzejj0
• Site fix for rule-2.1.0.xsd and rule-2.0.0.xsd; getOutputPath() for reports (#1223) @andrzejj0
• Removed numeric and mercury comparators, further refactoring (#1222) @andrzejj0
• Pom helper refactoring (#1221) @andrzejj0
• PR Automation only on close event (#1220) @slawekjaranowski
• Refactoring: ArtifactFactory and ArtifactVersionService (#1218) @andrzejj0
• Versions refactor 2 (#1204) @andrzejj0
• Refactoring: coalesce use-- goals. (#1202) @andrzejj0
• PR Automation - must use pull_request_target (#1205) @slawekjaranowski
• Add PR Automation (#1201) @slawekjaranowski

📦 Dependency updates

• Bump actions/stale from 9 to 10 (#1265) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-i18n from 1.0-beta-10 to 1.0.0 (#1260) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.0 to 4.10.1 (#1259) @dependabot[bot]
• Bump byteBuddyVersion from 1.17.6 to 1.17.7 (#1258) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 92 to 93 (#1257) @dependabot[bot]
• Bump org.apache.commons:commons-text from 1.13.1 to 1.14.0 (#1254) @dependabot[bot]
• Bump commons-codec:commons-codec from 1.18.0 to 1.19.0 (#1253) @dependabot[bot]
• Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#1252) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 (#1249) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 91 to 92 (#1248) @dependabot[bot]
• Bump byteBuddyVersion from 1.17.5 to 1.17.6 (#1247) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 87 to 91 (#1246) @dependabot[bot]
• Bump com.fasterxml.woodstox:woodstox-core from 7.1.0 to 7.1.1 (#1244) @dependabot[bot]
• Bump commons-beanutils:commons-beanutils from 1.10.1 to 1.11.0 (#1243) @dependabot[bot]
• Bump org.apache.commons:commons-collections4 from 4.4 to 4.5.0 (#1236) @dependabot[bot]
• Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#1235) @dependabot[bot]
• Bump org.apache.commons:commons-text from 1.13.0 to 1.13.1 (#1232) @dependabot[bot]
• Bump org.apache.poi:poi-ooxml from 3.17 to 5.4.0 in /versions-maven-plugin/src/it/it-property-updates-report-002-slow (#1231) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interactivity-api from 1.3 to 1.4 (#1230) @dependabot[bot]
• Bump byteBuddyVersion from 1.17.4 to 1.17.5 (#1228) @dependabot[bot]
• Bump byteBuddyVersion from 1.17.2 to 1.17.4 (#1226) @dependabot[bot]
• Bump commons-beanutils:commons-beanutils from 1.10.0 to 1.10.1 (#1215) @dependabot[bot]
• Bump byteBuddyVersion from 1.17.1 to 1.17.2 (#1219) @dependabot[bot]
• Bump commons-codec:commons-codec from 1.17.2 to 1.18.0 (#1211) @dependabot[bot]
• Bump byteBuddyVersion from 1.16.1 to 1.17.1 (#1216) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 86 to 87 (#1214) @dependabot[bot]
• Bump byteBuddyVersion from 1.15.11 to 1.16.1 (#1210) @dependabot[bot]
• Bump commons-beanutils:commons-beanutils from 1.9.4 to 1.10.0 (#1208) @dependabot[bot]
• Bump commons-codec:commons-codec from 1.17.1 to 1.17.2 (#1209) @dependabot[bot]
• Bump byteBuddyVersion from 1.15.10 to 1.15.11 (#1195) @dependabot[bot]
• Bump org.apache.commons:commons-text from 1.12.0 to 1.13.0 (#1196) @dependabot[bot]
• Bump commons-io:commons-io from 2.17.0 to 2.18.0 (#1186) @dependabot[bot]