This release introduces several important bug fixes, including improved handling of negative epoch timestamps and better sanitization of invalid Automatic-Module-Name and manifest entry values. We have addressed multiple NullPointerExceptions related to manifest configurations and plugin maps to improve overall stability. Additionally, this version includes performance optimizations, such as caching model results and reducing redundant pattern compilation, alongside updated documentation regarding null-value behavior in manifest methods.

🐛 Bug Fixes

• fix: do not clamp negative epoch timestamps to DATE_MIN (#419) @gnodet
• Remove duplicate LOGGER field in MavenArchiver (#417) @ascheman
• [MJAR-595] - Clamp outputTimestamp to DATE_MIN when SOURCE_DATE_EPOCH=0 (#401) @gnodet
• fix: report invalid archiver properties (#414) @efegokdemir
• Sanitize invalid Automatic-Module-Name instead of failing (#402) @gnodet
• fix: support negative epoch timestamps in parseBuildOutputTimestamp (#410) @gnodet
• Handle null plugin maps in BuildHelper (#409) @efegokdemir
• fix: throw NullPointerException when getManifest is called without Session and classpath is enabled (#378) @elharo
• fix: prevent NPE in ManifestConfiguration.getClasspathPrefix() when prefix is null (#381) @elharo
• [MSHARED-815] - Sanitize newlines in manifest entry values (#363) @elharo
• fix: restrict isNumeric() to ASCII digits to prevent NumberFormatExceptionRefactor digit validation logic in MavenArchiver (#376) @HarshMehta112

📝 Documentation updates

• docs: document null-value behaviour in manifest entry methods (#411) @gnodet
• Convert the reference page from xdoc to Markdown (#391) @slachiewicz
• Fix Javadoc issues per Oracle conventions (#324) @elharo

👻 Maintenance

• fix: replace deprecated testing stubs with non-deprecated equivalents (#399) @elharo
• Add tests verifying empty lines in manifest values are sanitized (#392) @elharo
• Let Dependabot bump the Maven 4 API artifacts (#394) @slachiewicz
• [MSHARED-815] - Pattern.compile() called on every invocation of handleSpecificationEntries (#377) @elharo
• small optimization (#389) @elharo
• Build against Maven 4.0.0-rc-6 (#390) @slachiewicz
• Fix #371: Cache model.getBuild() result to avoid repeated calls (#379) @HarshMehta112
• Skip unused dependency resolution for addExtensions (#380) @HarshMehta112
• Mockito improvements (#347) @slachiewicz
• JUnit Jupiter best practices (#329) @slachiewicz

🔧 Build

• Add ATR configuration to .asf.yaml (#421) @gnodet
• Build with the shared workflow's Maven 4 version instead of rc-6 (#416) @slachiewicz
• Keep Dependabot off Mockito 5 on maven-archiver-3.x (#415) @slachiewicz

📦 Dependency updates

• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.20 (#359, #400, #412) @dependabot[bot]
• Bump org.apache.maven.shared:maven-shared-components from 45 to 50 (#339, #343, #360, #406) @dependabot[bot]
• Bump mavenVersion from 4.0.0-rc-6 to 4.0.0-rc-7 (#408) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.30.0 (#330, #397) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.2 to 4.14.0 (#325, #333, #341, #353, #395) @slachiewicz
• Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#385) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (#382) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#383) @dependabot[bot]
• Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml from 4 to 5 (#384) @dependabot[bot]
• Bump SLF4J API dependency to version 2.0.17 (#357) @slachiewicz
• Bump Maven version to 4.0.0-rc-5 (#356) @slachiewicz
• Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 4.0.3 (#348, #355) @slachiewicz
• Update to parent 48 (#352) @Bukama
• Bump org.assertj:assertj-core from 3.27.6 to 3.27.7 (#345) @dependabot[bot]

🚀 New features and improvements

• Backport sorting of properties to maven archiver 3.x (#79) (#328) @algomaster99

👻 Maintenance

• Convert to MARKDOWN with doxia-converter (#337) @slachiewicz
• Add more timestamp tests (#336) @slachiewicz

📦 Dependency updates

• Bump Maven to 3.9.12 (#335) @slachiewicz
• Bump org.codehaus.plexus:plexus-archiver from 4.10.3 to 4.10.4 (#332) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.2 to 4.10.3 (#326) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29 (#331) @dependabot[bot]

🚀 New features and improvements

• add Java-Version entry to default MANIFEST.MF (#298) @hboutemy

🐛 Bug Fixes

• avoid negative entry time: upgrade plexus-archiver (#320) @hboutemy
• don't limit outputTimestamp to zip (MS DOS) range (#311) @hboutemy

📝 Documentation updates

• remove extra newline in code blocks (#318) @hboutemy
• reformat descriptor description to match usual Modello-generated ones (#316) @hboutemy
• document Java-Version entry added in #298 (#314) @hboutemy

👻 Maintenance

• Update site descriptor to 2.0.0 (#293) @slawekjaranowski

📦 Dependency updates

• Bump org.assertj:assertj-core from 3.27.4 to 3.27.6 (#310) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#289) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.0 to 4.10.1 (#296) @dependabot[bot]

🚀 New features and improvements

• [MSHARED-1466] - add Java-Version entry to default MANIFEST.MF (#299) @hboutemy

🐛 Bug Fixes

• avoid negative entry time: upgrade plexus-archiver (#323) @hboutemy
• don't limit outputTimestamp to zip (MS DOS) range (#312) @hboutemy

📝 Documentation updates

• remove extra newline in code blocks (#318) (#319) @hboutemy
• reformat descriptor description to match usual Modello-generated ones… (#317) @hboutemy
• document Java-Version entry added in #299 (#315) @hboutemy
• some javadoc nits (#290) @elharo

👻 Maintenance

• feat: enable prevent branch protection rules (#301) @sebtiem
• Update site descriptor to 2.0.0 (#292) @slawekjaranowski
• Add tag-template to release-drafter configuration (#291) @slawekjaranowski

📦 Dependency updates

• Bump org.assertj:assertj-core from 3.27.4 to 3.27.6 (#309) @dependabot[bot]
• Cleanup dependencies (#302) @slachiewicz
• Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#288) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.0 to 4.10.1 (#297) @dependabot[bot]

What's Changed

• Update Maven CI to 4.0rc1 by @slachiewicz in #80
• Declare used dependencies by @elharo in #81
• Bump org.assertj:assertj-core from 3.26.3 to 3.27.2 by @dependabot[bot] in #85
• Bump org.mockito:mockito-core from 4.6.1 to 5.0.0 by @dependabot[bot] in #82
• Bump org.assertj:assertj-core from 3.27.2 to 3.27.3 by @dependabot[bot] in #87
• Enable GitHub Issues by @Bukama in #92
• Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28 by @dependabot[bot] in #91
• Bump org.apache.maven.shared:maven-shared-components from 43 to 45 by @dependabot[bot] in #272
• Fall back on SOURCE_DATE_EPOCH if it exists by @fridrich in #273
• Treat empty Automatic-Module-Name as no Automatic-Module-Name at all by @fridrich in #274
• improve Reproducible Builds javadoc after #273 by @hboutemy in #285
• The requested profile "run-its" could not be activated because it doe… by @fridrich in #286
• Upgrade to maven-4.0.0-rc-4 and maven-plugin-testing-harness-4.0.0-beta-4 by @fridrich in #282

New Contributors

• @slachiewicz made their first contribution in #80

Full Changelog: maven-archiver-4.0.0-beta-3...maven-archiver-4.0.0-beta-4

🚀 New features and improvements

• improve Reproducible Builds javadoc (#284) @hboutemy
• Fall back on SOURCE_DATE_EPOCH if it exists (3.x) (#281) @fridrich

🐛 Bug Fixes

• Treat empty Automatic-Module-Name as no Automatic-Module-Name at all (3.x) (#280) @fridrich

👻 Maintenance

• Enable GitHub Issues (3.x) (#93) @Bukama

📦 Dependency updates

• Bump org.apache.maven.shared:maven-shared-components from 43 to 45 (#278) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28 (#279) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.26.0 to 3.27.3 (#277) @dependabot[bot]

What's Changed

• Remove commented code by @elharo in #75
• [MSHARED-1452] Rename package by @gnodet in #76
• Remove unused class by @elharo in #78
• Remove unused parameters, use CachingWriter, simplify a bit by @gnodet in #79

Full Changelog: maven-archiver-4.0.0-beta-2...maven-archiver-4.0.0-beta-3

What's Changed

• [MSHARED-1421] Bump org.codehaus.plexus:plexus-archiver from 4.9.2 to 4.10.0 by @dependabot[bot] in #66
• Bump org.junit.jupiter:junit-jupiter from 5.10.2 to 5.10.3 by @dependabot[bot] in #64
• Bump org.assertj:assertj-core from 3.26.0 to 3.26.3 by @dependabot[bot] in #68
• [MSHARED-1447] Bump org.apache.maven.shared:maven-shared-components from 42 to 43 by @dependabot[bot] in #67
• Upgrade to beta-5 by @gnodet in #74
• Bump slf4jVersion from 2.0.13 to 2.0.16 by @dependabot[bot] in #71
• [MSHARED-546] Change groupId to org.apache.maven.shared by @gnodet in #65

Full Changelog: maven-archiver-4.0.0-beta-1...maven-archiver-4.0.0-beta-2

Bug

• [MSHARED-1445] - Unix timestamps since the epoch are not subject to the boundary checks

Task

• [MSHARED-1446] - Add docs about repro build output timestamp boundaries

Dependency upgrade

• [MSHARED-1417] - Upgrade parent POM to version 42
• [MSHARED-1421] - Update org.codehaus.plexus:plexus-archiver to 4.10.0
• [MSHARED-1447] - Upgrade to Parent 43

Full Changelog: maven-archiver-3.6.2...maven-archiver-3.6.3

Release Notes - Maven Shared Components - Version maven-archiver-4.0.0-beta-1

New Feature

• [MSHARED-1415] - Switch to the Maven 4 API

Dependency upgrade

• [MSHARED-1417] - Upgrade parent POM to version 42

What's Changed

• Bump org.assertj:assertj-core from 3.25.3 to 3.26.0 by @dependabot[bot] in #60
• [MSHARED-1417] Bump org.apache.maven.shared:maven-shared-components from 41 to 42 by @dependabot[bot] in #58
• [MSHARED-1415] Switch to the Maven 4 API by @gnodet in #46
• Cleanup dependencies by @gnodet in #61
• Fix license/notice by @gnodet in #62
• Build with JDK 17 and 21 in Jenkins by @gnodet in #63

Full Changelog: maven-archiver-3.6.2...maven-archiver-4.0.0-beta-1