🚀 New features and improvements

• Implement retries in the Jetty transporter (#2242) @sakshichitnis27
• Add CycleAwareDependencyGraphDumper to visualize cycles (#2241) @arturobernalg
• Make jcl-over-slf4j an optional dependency of transport-apache (#2231) @slachiewicz
• Log retries in ApacheTransporter (#2236) @kwin
• Introduce transporter agnostic redirect handling (#2211) @kwin
• Support String properties being converted to Enums in a case insensitive (#2220) @kwin
• Fix #1269: Report a clear message when resolving an artifact with no … (#2209) @arturobernalg
• feat: use hard links for artifact installation by default (#2198) @gnodet
• GH-2196: Avoid warning for same-session repository fall-through (#2197) @efegokdemir
• Fix prefix filter verification for denied artifact paths (#2188) @harshab054
• [MRESOLVER-1736] - Re-enable expect-continue on JDK 17.0.17+ (#2180) @dhruv9b
• GH-1857: Include all repository failures in artifact messages (#2186) @efegokdemir
• Allow symlinked local path prefix directories (#2184) @findepi
• GH-13383: Match implicit ports in Apache auth cache (#2185) @efegokdemir

🐛 Bug Fixes

• Fix #1304: respect updatePolicy=never on composite metadata checks (#2261) @arturobernalg
• fix: SmartExecutor may miss to finish the jobs (#2259) @cstamas
• Fix Windows path with drive letter lost in RepositoryUriUtils.basedir() (#2224) @gnodet
• Fix several origin tracking bugs in enhanced LRM (#2238) @cstamas
• Fix testPut_StartCancelled regression introduced by #2206 (#2219) @gnodet
• fix: prefix files parsing bug (#2217) @cstamas
• Fix BF skipper handling of version-range candidates (#2208) @efegokdemir
• fix: catch only expected IO failures (#2207) @efegokdemir
• Fix #2204: Windows AccessDeniedException on install when IDE holds jar open (#2205) @gnodet
• GH-2156: Skip filters for disabled repository policies (#2192) @efegokdemir
• fix: PathConflictResolver uses BFS to guarantee correct depth ordering for shared DependencyNode instances (#2175) @gnodet

📝 Documentation updates

• Move the common misconceptions page to maven.apache.org (#2250) @slachiewicz
• Document the missing support of configurable retries in URL and Jetty (#2237) @kwin
• Render "@see" tags for configuration elements (#2218) @kwin
• Fix javadoc warnings in maven-resolver-api (#2210) @arturobernalg
• Fix #2173: Remove false deprecation from Path constructor (#2193) @efegokdemir
• Fix minor documentation issues in release-highlights page (#2187) @gnodet
• Add page that summarize 2.0.x features (#2170) @cstamas

👻 Maintenance

• Synchronize ATR configuration (#2263) @slawekjaranowski
• Fix #2257: declare commons-logging directly in maven-resolver-tools (#2258) @arturobernalg
• Assert existsButNotADirectory actually throws (#2243) @sharanggupta
• Clean up declared dependencies (#2246) @slachiewicz
• Remove compiler properties the parent chain already sets (#2249) @slachiewicz
• Declare the Maven artifacts the code uses (#2247) @slachiewicz
• Point ciManagement at GitHub Actions (#2245) @slachiewicz
• Fix flaky JettyTransporterTest progress events on macOS (#2206) @gnodet
• Use push for PR Automation and add PR Check (#2212) @slawekjaranowski

📦 Dependency updates

• deps: just drop extra management, Redisson is Java 11+ (#2260) @cstamas
• build(deps): bump ch.qos.logback:logback-classic from 1.5.32 to 1.6.6 (#2244) @dependabot[bot]
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.7 to 2.22.4 (#2254) @dependabot[bot]
• build(deps-dev): bump com.redis:testcontainers-redis from 3.0.0 to 3.0.1 (#2255) @dependabot[bot]
• Upgrade Netty and Jackson to fix security advisories (#2248) @slachiewicz
• build(deps): bump dev.sigstore:sigstore-java from 2.3.0 to 2.4.0 (#2229) @dependabot[bot]
• Upgrade brotli4j to 1.24.0 (#2232) @kwin
• build(deps): bump com.google.code.gson:gson from 2.14.0 to 2.15.0 (#2235) @dependabot[bot]
• build(deps): bump com.squareup.okhttp3:okhttp-bom from 5.5.0 to 5.5.1 (#2228) @dependabot[bot]
• Dependency updates (#2216) @cstamas
• build(deps): bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.2 to 0.26.5 (#2182, #2215) @dependabot[bot]
• build(deps-dev): bump com.redis:testcontainers-redis from 2.2.4 to 3.0.0 (#2200) @dependabot[bot]
• build(deps): bump commons-codec:commons-codec from 1.22.1 to 1.23.0 (#2202) @dependabot[bot]
• build(deps): bump org.eclipse.jetty:jetty-bom from 12.1.13 to 12.1.14 (#2195) @dependabot[bot]
• build(deps): bump com.google.guava:guava from 33.7.1-jre to 33.7.2-jre (#2176) @dependabot[bot]
• build(deps): bump maven3Version from 3.9.16 to 3.10.0 (#2172) @dependabot[bot]
• build(deps): bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#2169) @dependabot[bot]
• build(deps): bump version.slf4j from 2.0.19 to 2.0.20 (#2167) @dependabot[bot]
• build(deps): bump org.mockito:mockito-core from 5.23.0 to 5.24.0 (#2168) @dependabot[bot]

🚀 New features and improvements

• Fix PathConflictResolver OOM on dense dependency graphs (#2153) @gnodet

🐛 Bug Fixes

• Fix flaky IpcClientForkedTest on Windows (#2166) @jiteshkhatri11
• fix: synchronize IPC stream access (#2163) @efegokdemir
• fix: propagate fatal errors from Jetty request content (#2161) @efegokdemir
• Use structured logging in the IPC server (#2157) @efegokdemir
• [MRESOLVER-2142] - Increase HTTP3 port allocation retries (#2150) @jiteshkhatri11
• Honor system proxy credentials in Apache transport (#2148) @goutamadwant

📝 Documentation updates

• docs: rewrite how-resolver-works.md to STE rules (#2046) @elharo
• docs: refresh resolver misconception references (#2158) @efegokdemir
• docs: clarify checksum trust boundaries (#2162) @efegokdemir
• fix: correct config filename to .mvn/maven.config (#2152) @algomaster99
• Use configuration key as link label (#2147) @kwin

📦 Dependency updates

• Bump org.apache.maven:maven-parent from 49 to 50 (#2155) @dependabot[bot]
• Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 (#2145) @dependabot[bot]
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 (#2144) @dependabot[bot]
• Bump dev.sigstore:sigstore-java from 2.2.0 to 2.3.0 (#2141) @dependabot[bot]

🚀 New features and improvements

• Finish the repo key story (#2135) @cstamas
• Fix: log only once the warning in DefRemoteRepoMan (#2100) @cstamas
• Fix #2058: Add links to configuration page (#2060) @Jamison929611
• Eliminate per-node HashSet allocation in PathConflictResolver (#2075) @gnodet

🐛 Bug Fixes

• fix: accept locally cached artifacts via same-id fallback when tracking URL changes (#2133) @gnodet
• Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz
• [MRESOLVER-379] - Preserve relocated candidates from version ranges (#2114) @jjj-n
• Create the local repository directory before resolving its real path (#2111) @slachiewicz
• Optimize TrackingFileManager unit tests and fix potential lock leaks (#2094) (#2102) @slachiewicz
• Validate the repository key used in checksum summary file names (#2099) @slachiewicz
• fix: bound response reads and sanitize remote-derived strings (#2081) @gnodet
• fix: earn trust labels through verification and bind tracking to URL (#2080) @gnodet
• fix: bind credentials to origin and reject TLS downgrade redirects (#2085) @gnodet
• fix: prevent remote signals from weakening operator-configured policy (#2082) @gnodet
• fix: atomic file publication and authenticated IPC lock daemon (#2083) @gnodet
• fix: deploy-side integrity must fail closed (#2084) @gnodet
• fix: harden opt-in transport and lock backends against unauthenticated infrastructure (#2086) @gnodet
• Compose named lock keys one segment per coordinate field (#2091) @slachiewicz
• Resolve file transport locations with path operations instead of substring matching (#2088) @slachiewicz
• Validate coordinate components in the Maven 2 layout and local path composer (#2087) @slachiewicz

📝 Documentation updates

• [docs] Clarify trusted checksum sources (#2127) @jiteshkhatri11
• Fix #2058: Add links to configuration page (#2060) @Jamison929611

👻 Maintenance

• test: move from minio docker image (#2140) @cstamas
• Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz
• Fix: tidy up f013 (#2104) @cstamas
• Fix #2096: harden NamedLocksTrackingFileManagerTest against CI load (#2098) @gnodet
• Carry repository provenance into aggregateRepositories (#2090) @slachiewicz
• Validate the repository key used as a local repository path segment (#2089) @slachiewicz

📦 Dependency updates

• Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from 3.15.2 to 3.16.0 (#2136) @dependabot[bot]
• Bump version.slf4j from 2.0.18 to 2.0.19 (#2130) @dependabot[bot]
• Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (#2131) @dependabot[bot]
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2 (#2129) @dependabot[bot]
• Deps: bump to BC provider 1.85.2 (#2097) @cstamas
• Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (#2074) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-xml from 4.1.1 to 4.2.0 (#2071) @dependabot[bot]
• Stop dependabot from offering guice 7 on the 1.9.x line (#2072) @slachiewicz

🚀 New features and improvements

• Fix #1994: log exceptions from IpcNamedLock.tryUnlock() (#2045) @elharo
• Consider "Retry-After" header in Java HTTP Client (#2044) @kwin
• Fix compilation error in DefaultRepositorySystemReentrancyTest (#2047) @gnodet
• Extend re-entrancy detection for broken trace chains (#2009) @gnodet
• Fix #2013: optimize TransitiveDependencyManager performance (#2014) @gnodet
• Extract included checksums from x-amz-meta-* headers (#2023) @iarvind
• Enh: Allow validator factory to abstain (#2008) @cstamas

🐛 Bug Fixes

• Fix InterruptedException silently dropping task in SmartExecutor.Limited.submit(Runnable) (#2012) @elharo

📝 Documentation updates

• docs: rewrite expected-checksums.md to STE rules (#2041) @elharo
• Support deprecated tag. (#2059) @kwin
• Reconcile the two download pages and modernise them (#2057) @slachiewicz
• Convert the index page from xdoc to Markdown (#2055) @slachiewicz
• docs: rewrite creating-a-repository-system-session.md to STE rules (#2034) @elharo
• docs: rewrite common-misconceptions.md to ASD-STE100 rules (#2035) @elharo
• docs: rewrite deployment.md in ASD-STE100 Simplified Technical English (#2040) @elharo
• docs: rewrite dependency-graph.md in ASD-STE100 Simplified Technical English (#2039) @elharo
• docs: rewrite about-checksums.md to STE rules (#2024) @elharo
• docs: rewrite api-compatibility.md to STE rules (#2026) @elharo
• Docs: rewrite what-is-resolver page in Simplified Technical English (ASD-STE100) (#2022) @elharo
• Fix documentation issues across site docs (#2010) @elharo
• Improve rendering of javadoc content (#1981) @kwin
• Edit version comparison (#1714) @elharo

👻 Maintenance

• Drop the versions.junit5 property the parent already provides (#2054) @slachiewicz
• Fix #1998: use try-with-resources in test file utilities (#2056) @elharo
• Convert the index page from xdoc to Markdown (#2055) @slachiewicz
• Use https in license URLs as recommended by ASF (#2051) @elharo
• Exclude ODG graphics from RAT checks (#2029) @elharo
• Build against Maven 4.0.0-rc-6 (#2027) @slachiewicz
• Fix resource leak pattern in DependencyGraphParser.parseLiteral() (#2018) @joshinii
• Replace printStackTrace with proper error handling (#2011) @elharo

🔧 Build

• Improve error reporting (#1983) @kwin
• .gitignore .vscode/ (#2025) @elharo
• Improve rendering of javadoc content (#1981) @kwin

📦 Dependency updates

• deps: Updates (#2061) @cstamas
• Drop the versions.junit5 property the parent already provides (#2054) @slachiewicz
• Bump org.redisson:redisson from 4.6.1 to 4.7.0 (#2053) @dependabot[bot]
• Bump commons-codec:commons-codec from 1.22.0 to 1.22.1 (#2020) @dependabot[bot]
• Bump sisuVersion from 1.0.1 to 1.1.0 (#2016) @dependabot[bot]

🚀 New features and improvements

• RRF: self-heal from provably broken auto-discovered prefixes files (#1976) @ascheman
• Feat: config to close connection at end of tx (#1978) @cstamas
• Feat: new (limited) transport (#1966) @cstamas
• Expose additional transport details to TransportListener (#1762) @kwin
• Support HTTP/3 in Jetty and JRE HTTP Client (#1949) @kwin
• Skip validation and decoration on re-entrant RepositorySystem calls (#1957) @gnodet

🐛 Bug Fixes

• Fix: preserve original trace data when stamping re-entrancy marker (#1980) @gnodet
• Bug: in certain cases Resolver caused build failure (#1975) @cstamas
• Make sure to always close input streams bound to responses (#1970) @kwin
• Fix: be more defensive regarding request traces (#1973) @cstamas
• Fix reporting of HTTP/3 in JdkTransporter (#1967) @kwin
• Validate path components (#1959) @cstamas
• Bug: Apache transport deadlock in concurrent use case (#1953) @cstamas
• Fix potential NPEs in IpcClient and resource leak in DependencyGraphParser (#1945) @gnodet
• Bug: Jetty transport used wrong config (#1948) @cstamas

📝 Documentation updates

• fix: Some since javadoc tags were off; fixed (#1968) @cstamas
• Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#1950) @potiuk

👻 Maintenance

• Use try-with-resources in AbstractTransporter (#1947) @Aayush10016
• Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#1950) @potiuk
• Fix potential NPEs in IpcClient and resource leak in DependencyGraphParser (#1945) @gnodet
• Limit internal retries to 1 with Java 26+ (#1946) @kwin

🔧 Build

• Use custom doclet to extract configuration metadata with the help of (#1965) @kwin

📦 Dependency updates

• Bump Jetty to 12.1.11 (#1969) @cstamas
• Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#1963) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#1961) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml from 4 to 5 (#1960) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (#1962) @dependabot[bot]
• Bump bouncycastleVersion from 1.84 to 1.85 (#1956) @dependabot[bot]

🚀 New features and improvements

• Reduce PathConflictResolver memory and auto-select resolver (#1938) @gnodet
• Fix dependency selector cache regression in DF collector (#1941) @gnodet
• Fix thread contention in GenericVersionScheme and WeakInternPool (#1937) @gnodet
• Improve thread safety across modules (#1902) @gnodet
• WarnChecksumPolicy: proceed on no checksums (#1922) @ascheman
• Extend AuthenticationBuilder to support SSLContext for mTLS authentication (#1907) @jiteshkhatri11
• DependencyCollectionChecker: new session member (#1899) @cstamas
• Add any media type to RFC9457 content type header (#1894) @slawekjaranowski
• fix: Configuration to be able to control sending RFC 9457 related Accept HTTP header (#1891) @cstamas
• Improvement: BF dependency selector hot methods (#1882) @cstamas

🐛 Bug Fixes

• Fix ApacheTransport auth cache CCEx (#1923) @cstamas
• Checksums: lack of information (#1917) @cstamas
• Fix inverted SIGTSTP condition in IPC server (#1915) @gnodet
• Bug: fix IPC named lock client-side robustness for Windows (#1910) @gnodet
• Bugfix: Fix NPE in PathConflictResolver (#1904) @cstamas
• Bug: fix IPC named lock server-side waiter leak on client timeout (#1901) @gnodet
• Bug: fix new PCR as it in certain cases left duplicates (#1896) @cstamas

📝 Documentation updates

• Javadoc update (#1925) @cstamas
• Doc: Trusted Checksums Summary File Procedure (#1886) @adambkaplan

👻 Maintenance

• Put PCR aside for now (#1942) @cstamas
• Get rid of BND warnings (#1933) @cstamas
• Align generators (#1929) @cstamas
• Fix for ChainedWorkspaceReader (#1909) @cstamas
• Create simple JMH benchmark to compare CCR and PCR (#1908) @cstamas
• Tidy up suppliers (#1898) @cstamas
• Disable IPC lock tests on Windows (#1900) @cstamas

📦 Dependency updates

• Bump org.apache.maven:maven-parent from 48 to 49 (#1939) @dependabot[bot]
• Bump roasterVersion from 2.31.0.Final to 2.31.1.Final (#1935) @dependabot[bot]
• Bump sisuVersion from 1.0.0 to 1.0.1 (#1936) @dependabot[bot]
• Bump org.redisson:redisson from 4.6.0 to 4.6.1 (#1932) @dependabot[bot]
• Deps: Jetty 12.1.10 (#1930) @cstamas
• Bump org.redisson:redisson from 4.5.0 to 4.6.0 (#1927) @dependabot[bot]
• Bump io.minio:minio from 9.0.2 to 9.0.3 (#1926) @dependabot[bot]
• Bump dev.sigstore:sigstore-java from 2.1.0 to 2.2.0 (#1918) @dependabot[bot]
• Bump io.minio:minio from 9.0.1 to 9.0.2 (#1916) @dependabot[bot]
• Bump okhttpVersion from 5.3.2 to 5.4.0 (#1914) @dependabot[bot]
• Bump biz.aQute.bnd:bnd-maven-plugin from 7.2.3 to 7.3.0 (#1897) @dependabot[bot]
• Bump org.redisson:redisson from 4.4.0 to 4.5.0 (#1906) @dependabot[bot]
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.0 to 0.26.1 (#1892) @dependabot[bot]
• Bump io.minio:minio from 9.0.0 to 9.0.1 (#1883) @dependabot[bot]
• Bump org.ow2.asm:asm from 9.10 to 9.10.1 (#1890) @dependabot[bot]
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.7 to 0.26.0 (#1887) @dependabot[bot]
• Bump dev.sigstore:sigstore-java from 2.0.0 to 2.1.0 (#1889) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-classworlds from 2.11.0 to 2.12.0 (#1885) @dependabot[bot]
• Bump org.ow2.asm:asm from 9.9.1 to 9.10 (#1879) @dependabot[bot]
• Bump maven3Version from 3.9.15 to 3.9.16 (#1880) @dependabot[bot]

🚀 New features and improvements

• Feat: Reuse same RemoteRepository to HTTP URI creation logic (#1878) @cstamas
• Enh: Maven 3 is with us (#1869) @cstamas
• Feat: Maven 3 experimental scope manager (#1868) @cstamas
• Feat: Pull in version filter builder (#1867) @cstamas
• Feat: Resolution scope aliases (#1863) @cstamas
• Feat: Expose scope related bits via scope manager (#1862) @cstamas

🐛 Bug Fixes

• Fix: Remove javax.inject dependency (#1859) @cstamas

📦 Dependency updates

• Deps: update slf4j to 2.0.18 (#1872) @cstamas
• Deps: update Redisson to 4.4.0 (#1873) @cstamas
• Bump org.codehaus.plexus:plexus-classworlds from 2.10.0 to 2.11.0 (#1871) @dependabot[bot]
• Deps: Update parent POM 48 (#1866) @cstamas
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.6 to 0.25.7 (#1861) @dependabot[bot]

🚀 New features and improvements

• Lower various component selection debug noise (#1841) @cstamas
• GH-1835: Expose qualifiers for generic version scheme (#1837) @cstamas
• Provide modern TrackingFileManager (#1814) @cstamas

🐛 Bug Fixes

• Send "Accept" request header to indicate RFC 9457 compliance (#1846) @kwin
• Remove unnecessary repository preparation in metadata resolution for prefixes (#1830) @slawekjaranowski
• GH-1834: Version filtering context with BF fails (#1836) @cstamas

📝 Documentation updates

• RRF: Place remark about broken MRMs (#1820) @cstamas

👻 Maintenance

• Maintenance: tidy up IPC locks, make exclusive test timeout a bit longer (#1849) @cstamas
• Increase timeout in tests (#1816) @cstamas

📦 Dependency updates

• Bump commons-codec:commons-codec from 1.21.0 to 1.22.0 (#1855) @dependabot[bot]
• Bump com.google.code.gson:gson from 2.13.2 to 2.14.0 (#1853) @dependabot[bot]
• Deps: Updates (#1848) @cstamas
• Bump testcontainersVersion from 2.0.4 to 2.0.5 (#1847) @dependabot[bot]
• Bump maven3Version from 3.9.14 to 3.9.15 (#1842) @dependabot[bot]
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.5 to 0.25.6 (#1840) @dependabot[bot]
• Bump bouncycastleVersion from 1.83 to 1.84 (#1831) @dependabot[bot]
• Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#1833) @dependabot[bot]
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.25.4 to 0.25.5 (#1828) @dependabot[bot]
• Better control of plexus-utils (#1826) @cstamas
• Bump org.redisson:redisson from 4.3.0 to 4.3.1 (#1824) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to 2.10.0 (#1822) @dependabot[bot]
• Bump biz.aQute.bnd:bnd-maven-plugin from 7.2.1 to 7.2.3 (#1818) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3 in /maven-resolver-demos/maven-resolver-demo-snippets (#1817) @dependabot[bot]
• Bump io.minio:minio from 8.6.0 to 9.0.0 (#1813) @dependabot[bot]
• Bump testcontainersVersion from 2.0.3 to 2.0.4 (#1811) @dependabot[bot]
• Bump maven3Version from 3.9.12 to 3.9.14 (#1810) @dependabot[bot]
• Bump org.mockito:mockito-core from 5.21.0 to 5.23.0 (#1808) @dependabot[bot]
• Bump org.redisson:redisson from 4.2.0 to 4.3.0 (#1805) @dependabot[bot]

🐛 Bug Fixes

• Undo some changes TrackingFileManager happened in 1.9.25 (#1801) @cstamas
• Catch IOException with message "Resource deadlock avoided" which can happen on Unix level when multiple process try to lock same file (#1799) @olamy
• Set content length for PUT in JDK transport (#1798) @cstamas

🐛 Bug Fixes

• Sync TrackingFileManager with 2.x (#1802) @cstamas