2.23.0

Versions Maven Plugin 2.23.0 makes the property goals more reliable on multi-module projects and adds a few options people have asked for over the years. It still runs on Java 8 and Maven 3.6.3 or later.

Property updates

• update-property and update-properties now update a property that is defined in a reactor parent POM, rather than leaving it untouched (#997).
• A property shared by a plugin and an excluded dependency is no longer updated behind the exclude's back (#1199).
• The property goals look up all properties in parallel, which shortens runs on POMs with many version properties (#1157).
• A dependency whose type or classifier is itself a property, such as ${native.classifier}, no longer breaks the property goals on Maven 3.10 and 4 (#1409).
• lock-snapshots and unlock-snapshots now rewrite snapshot versions held in properties, where that is safe (#1269).

Other fixes and additions

• versions:set with selected projects (-pl) updates the modules that inherit the version again, on Maven 3 and Maven 4 (#1338, #1339, #1357).
• Includes and excludes now filter the candidate versions too, so an excluded version is never proposed as an update (#1378).
• display-dependency-updates -Dversions.showNewestPerSegment lists the newest incremental, minor and major version, for example 1.0.3 -> 1.0.9, 1.3.9, 4.0.6 (#1043).
• parent-updates-report supports formats, including XML (#975), and the XML property updates report now fills in the current version (#976).
• The plugin update reports share their lookup with display-plugin-updates and include plugins declared only in <reporting> (#1250).

Thanks to @wilx and @adityaanikam for their contributions to this release.

🚀 New features and improvements

• Resolve property versions in parallel (#1447, fixes #1157) @slachiewicz
• Show the newest version of each segment in display-dependency-updates (#1450, fixes #1043) @slachiewicz
• Lock and unlock snapshot versions held in properties (#1451, fixes #1269) @slachiewicz
• Support the xml format in parent-updates-report (#1446, fixes #975) @slachiewicz
• Share plugin discovery and version lookup between display and reports (#1397, fixes #1250) @wilx

🐛 Bug Fixes

• Update properties defined in a reactor parent POM (#1448, fixes #997) @slachiewicz
• Honor the excludes of modules that use an inherited property (#1449, fixes #1199) @slachiewicz
• Restore versions:set propagation with selected projects (#1440, fixes #1338, #1339, #1357) @wilx
• Apply excludes and includes to candidate versions, not just the current one (#1441, fixes #1378) @adityaanikam
• Report the property's current version in the XML property updates report (#1437, fixes #976) @slachiewicz
• Interpolate the type and classifier of dependencies whose version is a property (#1436, fixes #1409) @slachiewicz

📝 Documentation updates

• Rewrite the README and add AGENTS.md (#1435) @slachiewicz

👻 Maintenance

• Use localhost coordinates instead of real artifacts in the compare-dependencies fixtures (#1443) @slachiewicz
• Delete the two integration tests that never ran (#1442) @slachiewicz
• Move it-resolve-ranges-001 and it-unlock-snapshots-001 to unit tests (#1439) @slachiewicz
• Run use-releases in it-use-releases-issue-134 (#1433) @slachiewicz
• Write the remaining verify scripts as assertions (#1431) @slachiewicz
• Move the tests of versions-common and versions-enforcer off Hamcrest (#1430) @slachiewicz
• Drop JUnit 4, the vintage engine and Hamcrest from the plugin tests (#1427) @slachiewicz
• Move the mojo tests that take their project from a POM to JUnit 5 (#1425) @slachiewicz
• Run mojo tests on JUnit 5 with the project built from their POM (#1423) @slachiewicz
• Move the mojo tests that build their project in code to JUnit 5 (#1424) @slachiewicz
• Move the tests that do not use the plugin testing harness to JUnit 5 and off Hamcrest (#1422) @slachiewicz
• Write 54 verify scripts as assertions (#1421) @slachiewicz
• Stop calling deprecated StringUtils.equals and MavenProject reporting getters (#1420) @slachiewicz
• Move fifteen use-* ITs to unit tests (#1418) @slachiewicz
• Move sixteen display-dependency-updates ITs to unit tests (#1417) @slachiewicz
• Move twelve update-properties ITs to unit tests (#1416) @slachiewicz
• Fix two ITs that tested a different goal than their name (#1415) @slachiewicz
• Keep plexus-xml on 3.x in Dependabot (#1401) @slachiewicz
• Port the IT scripts from BeanShell to Groovy (#1399) @slachiewicz

🔧 Build

• Share the integration test setup and drop unused POM entries (#1444) @slachiewicz
• Run one integration test per CPU core (#1434) @slachiewicz
• Check dependencies monthly and group the updates (#1413) @slachiewicz
• Run fewer JDKs on macOS and Windows (#1412) @slachiewicz
• Speed up the integration tests (#1411) @slachiewicz
• Raise the CI job timeout to 45 minutes (#1410) @slachiewicz
• Keep it-resolve-ranges-issue-1287 versionless on Maven 4.0.0-rc-7 (#1405) @slachiewicz
• Keep Dependabot off Mockito 5 (#1404) @slachiewicz

📦 Dependency updates

• Build against Maven 3.9.16 and keep Maven 3.6.3 as the prerequisite (#1429) @slachiewicz
• Bump org.codehaus.woodstox:stax2-api from 4.3.0 to 4.3.1 (#1407) @dependabot[bot]
• Bump com.fasterxml.woodstox:woodstox-core from 7.2.2 to 7.3.0 (#1408) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#1406) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-xml from 3.0.1 to 3.1.0 (#1402) @dependabot[bot]
• Keep plexus-xml on 3.x in Dependabot (#1401) @slachiewicz
• Bump byteBuddyVersion from 1.18.13 to 1.18.14 (#1398) @dependabot[bot]

Thanks to @slachiewicz, @wilx and @adityaanikam.

Full changelog