2.0.23

🚀 New features and improvements

• Finish the repo key story (#2135) @cstamas
• Fix: log only once the warning in DefRemoteRepoMan (#2100) @cstamas
• Fix #2058: Add links to configuration page (#2060) @Jamison929611
• Eliminate per-node HashSet allocation in PathConflictResolver (#2075) @gnodet

🐛 Bug Fixes

• fix: accept locally cached artifacts via same-id fallback when tracking URL changes (#2133) @gnodet
• Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz
• [MRESOLVER-379] - Preserve relocated candidates from version ranges (#2114) @jjj-n
• Create the local repository directory before resolving its real path (#2111) @slachiewicz
• Optimize TrackingFileManager unit tests and fix potential lock leaks (#2094) (#2102) @slachiewicz
• Validate the repository key used in checksum summary file names (#2099) @slachiewicz
• fix: bound response reads and sanitize remote-derived strings (#2081) @gnodet
• fix: earn trust labels through verification and bind tracking to URL (#2080) @gnodet
• fix: bind credentials to origin and reject TLS downgrade redirects (#2085) @gnodet
• fix: prevent remote signals from weakening operator-configured policy (#2082) @gnodet
• fix: atomic file publication and authenticated IPC lock daemon (#2083) @gnodet
• fix: deploy-side integrity must fail closed (#2084) @gnodet
• fix: harden opt-in transport and lock backends against unauthenticated infrastructure (#2086) @gnodet
• Compose named lock keys one segment per coordinate field (#2091) @slachiewicz
• Resolve file transport locations with path operations instead of substring matching (#2088) @slachiewicz
• Validate coordinate components in the Maven 2 layout and local path composer (#2087) @slachiewicz

📝 Documentation updates

• [docs] Clarify trusted checksum sources (#2127) @jiteshkhatri11
• Fix #2058: Add links to configuration page (#2060) @Jamison929611

👻 Maintenance

• test: move from minio docker image (#2140) @cstamas
• Fix listener error swallowing (#1990), SyncContext double-close (#1992), and test flakiness (#1350) (#2108) @slachiewicz
• Fix: tidy up f013 (#2104) @cstamas
• Fix #2096: harden NamedLocksTrackingFileManagerTest against CI load (#2098) @gnodet
• Carry repository provenance into aggregateRepositories (#2090) @slachiewicz
• Validate the repository key used as a local repository path segment (#2089) @slachiewicz

📦 Dependency updates

• Bump org.apache.maven.plugin-tools:maven-plugin-tools-api from 3.15.2 to 3.16.0 (#2136) @dependabot[bot]
• Bump version.slf4j from 2.0.18 to 2.0.19 (#2130) @dependabot[bot]
• Bump org.eclipse.jetty:jetty-bom from 12.1.12 to 12.1.13 (#2131) @dependabot[bot]
• Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.1 to 0.26.2 (#2129) @dependabot[bot]
• Deps: bump to BC provider 1.85.2 (#2097) @cstamas
• Bump org.codehaus.plexus:plexus-utils from 3.6.1 to 3.6.2 (#2074) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-xml from 4.1.1 to 4.2.0 (#2071) @dependabot[bot]
• Stop dependabot from offering guice 7 on the 1.9.x line (#2072) @slachiewicz