plexus-archiver 4.16.0 is a feature release of the 4.x line. It requires Java 8 or later and is a drop-in replacement for 4.15.0: the public API is binary compatible with 4.15.0.

✨ Highlights

• Archivers without a dependency-injection container. The new ServiceLoaderArchiverManager finds archivers, unarchivers and resource collections through java.util.ServiceLoader. Code that cannot get Sisu components injected, such as plugins written against the Maven 4 API, can now use the 4.x line. Inside Maven, the injected DefaultArchiverManager works as before. The provider interfaces in org.codehaus.plexus.archivers.spi are internal and change incompatibly in 5.0, so use ServiceLoaderArchiverManager rather than implementing them. (#525, #526, #531)
• Buffered uncompressed tar output. TarArchiver now buffers its output when it writes a tar archive without compression. Contributed by @Nixxx11 in #498 and ported in #522.
• Default excludes on Windows. plexus-io 3.8.1 applies the default excludes on Windows as well. (#515)
• Deprecation. org.codehaus.plexus.archiver.par.PlexusIoJarFileResourceCollection is deprecated in favor of PlexusIoParFileResourceCollection. The par component itself is unchanged. (#528)

🚀 New features and improvements

• Backport the ServiceLoader based ArchiverManager to 4.x (#525) @slachiewicz

🐛 Bug Fixes

• Keep the 4.15.0 DefaultArchiverManager API and deprecate par.PlexusIoJarFileResourceCollection (#528) @slachiewicz
• Unpack archived file sets in archivers created without a container on 4.x (#526) @slachiewicz
• Fix buffering in TarArchiver (#522) @slachiewicz

📝 Documentation updates

• Document archivers.spi as internal on 4.x (#531) @slachiewicz
• Backport the README to 4.x with Java 8 examples (#529) @slachiewicz

👻 Maintenance

• Replace deprecated IOUtil.close and TarArchiveEntry id getters (#532) @slachiewicz

🔧 Build

• Carry the default-branch settings to 4.x (#527) @slachiewicz

📦 Dependency updates

• Bump org.eclipse.sisu:org.eclipse.sisu.inject from 1.1.0 to 1.1.2 (#517, #523) @dependabot[bot]
• Bump com.google.guava:guava from 33.7.2-jre to 33.8.0-jre (#520) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-io from 3.8.0 to 3.8.1 (#515) @dependabot[bot]

Full changelog

🐛 Bug Fixes

• Copy the target when DirectoryArchiver cannot create a symbolic link (#509) @slachiewicz
• Copy the target when the file system refuses a symbolic link (#507) @slachiewicz

📝 Documentation updates

• Port the site index fixes from master (#511) @slachiewicz

👻 Maintenance

• Bump version to 4.15.0-SNAPSHOT (#514) @slachiewicz

🔧 Build

• Port the CI workflow updates from master (#510) @slachiewicz

📦 Dependency updates

• Bump release-drafter/release-drafter from 7.7.0 to 7.10.0 (#504, #513) @dependabot[bot]
• Bump com.google.guava:guava from 33.7.1-jre to 33.7.2-jre (#502) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-io from 3.7.0 to 3.8.0 (#495) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.7-15 to 1.5.7-16 (#489) @dependabot[bot]

Full changelog

🚀 New features and improvements

• Let a FileSet follow symbolic links (#481) @slachiewicz

📝 Documentation updates

• Describe the artifact in the POM (#477) @slachiewicz

📦 Dependency updates

• Pin Guava on the test classpath (#485) @slachiewicz
• Bump com.github.luben:zstd-jni from 1.5.7-14 to 1.5.7-15 (#479) @dependabot[bot]

The jar declares Automatic-Module-Name: org.codehaus.plexus.archiver, which is what makes this 4.13.0
rather than a patch. It also picks up plexus-io 3.7.0, whose FileSelector now follows symbolic links to
files when isFollowingSymLinks() is set.

slf4j stays on 1.7.36 on this line: the 2.0.18 bump was taken and reverted, since the 4.x line targets
consumers that have not moved.

🚀 New features and improvements

• Establish an automatic module name @slachiewicz

📦 Dependency updates

• Bump plexus-io to 3.7.0 @slachiewicz
• Bump plexus-utils to 3.6.2 @slachiewicz
• Update parent to plexus 27, from 25 @slachiewicz, @dependabot
• Bump com.github.luben:zstd-jni from 1.5.7-9 to 1.5.7-14 @dependabot
• Bump org.eclipse.sisu:org.eclipse.sisu.inject from 1.0.0 to 1.1.0 @dependabot
• Revert "Bump slf4jVersion from 1.7.36 to 2.0.18" @slachiewicz

🔧 Build

• Name the sisu property after what it versions @slachiewicz
• Keep the 4.x release drafter config on the 4.x branch @slachiewicz

🐛 Bug Fixes

• Fix ZIP CRC regression in OffloadingOutputStream (#431) @slachiewicz
• Fix NPE when reading posixfileattributes on windows (#419) @Postremus

📦 Dependency updates

• Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#426) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1 (#422) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.7-6 to 1.5.7-9 #428 #427 #415 @dependabot[bot]
• Bump org.tukaani:xz from 1.11 to 1.12 (#420) @dependabot[bot]
• Bump org.eclipse.sisu:org.eclipse.sisu.inject from 0.9.0.M4 to 1.0.0 (#416) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.6 to 3.27.7 (#414) @dependabot[bot]
• Bump release-drafter/release-drafter from 6 to 7 (#421) @dependabot[bot]

📦 Dependency updates

• Replace Airlift Snappy with Apache Commons Compress #413 @slachiewicz
• Removal of dependency to AirCompressor that contains vulnerabilities #411
• Bump org.codehaus.plexus:plexus from 24 to 25 #412
• Bump org.tukaani:xz from 1.10 to 1.11 #410

🚀 New features and improvements

• Replace PlexusIoZipFileResourceCollection with PlexusArchiverZipFileResourceCollection for non-JAR formats (#398) @copilot-swe-agent[bot]

🐛 Bug Fixes

• Revert "Utilize VT if possible (#381)" (#408) @slachiewicz

👻 Maintenance

• JUnit Jupiter best practices (#405) @slachiewicz
• Replace FileUtils.deleteDirectory(File) with JDK provided API (#406) @slachiewicz

📦 Dependency updates

• Bump plexus-io to 3.6.0 (#409) @slachiewicz
• Bump com.github.luben:zstd-jni from 1.5.7-5 to 1.5.7-6 (#401) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 23 to 24 (#397) @dependabot[bot]

• Fix AbstractZipUnArchiver handling of zip entries with unspecified modification time (#393) @copilot-swe-agent[bot]
• Fix AbstractArchiver.getFiles() to return forward slashes for ZIP-based archivers (#392) @copilot-swe-agent[bot]
• Reduce heap usage in Zip archiver to prevent OutOfMemoryError in CI builds (#390) @copilot-swe-agent[bot]

👻 Maintenance

• Convert to Markdown and compare to Commons Compress (#395) @slachiewicz

📦 Dependency updates

• Update plexus-io to 3.5.2 and downgrade plexus-utils to 3.6.0 (#394) @slachiewicz
• Bump com.github.luben:zstd-jni from 1.5.7-4 to 1.5.7-5 (#389) @dependabot[bot]

🐛 Bug Fixes

• check minimum timestamp: avoid negative Zip 5455 Extended Timestamp (#388) @hboutemy

📦 Dependency updates

• Bump org.assertj:assertj-core from 3.27.5 to 3.27.6 (#386) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.4 to 3.27.5 (#385) @dependabot[bot]

🚀 New features and improvements

• Utilize VT if possible (#381) @cstamas

👻 Maintenance

• Cleanups of using deprecated methods (#384) @slawekjaranowski
• symLinks:Enhance the compatibility of regen.sh (#374) @hgqxjj
• Apply spotless re-formatting (#367) @ascheman

📦 Dependency updates

• Bump org.codehaus.plexus:plexus from 22 to 23 (#383) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#380) @dependabot[bot]
• Bump org.apache.commons:commons-compress from 1.27.1 to 1.28.0 (#379) @dependabot[bot]
• Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#378) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.7-3 to 1.5.7-4 (#375) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 21 to 22 (#373) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 20 to 21 (#372) @dependabot[bot]
• Bump org.eclipse.sisu:org.eclipse.sisu.inject from 0.9.0.M3 to 0.9.0.M4 (#371) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.7-2 to 1.5.7-3 (#370) @dependabot[bot]
• Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#369) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.7-1 to 1.5.7-2 (#368) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-10 to 1.5.7-1 (#366) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 19 to 20 (#364) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-9 to 1.5.6-10 (#365) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.2 to 3.27.3 (#363) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.1 to 3.27.2 (#362) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-8 to 1.5.6-9 (#361) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.27.0 to 3.27.1 (#360) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.26.3 to 3.27.0 (#359) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-7 to 1.5.6-8 (#357) @dependabot[bot]
• Bump commons-io:commons-io from 2.17.0 to 2.18.0 (#356) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 18 to 19 (#353) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-6 to 1.5.6-7 (#355) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-5 to 1.5.6-6 (#351) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 4.0.1 to 4.0.2 (#352) @dependabot[bot]
• Bump commons-io:commons-io from 2.16.1 to 2.17.0 (#350) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-4 to 1.5.6-5 (#348) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-io from 3.5.0 to 3.5.1 (#349) @dependabot[bot]
• Bump org.apache.commons:commons-compress from 1.26.2 to 1.27.1 (#347) @dependabot[bot]
• Bump org.tukaani:xz from 1.9 to 1.10 (#344) @dependabot[bot]
• Bump com.github.luben:zstd-jni from 1.5.6-3 to 1.5.6-4 (#343) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.26.0 to 3.26.3 (#342) @dependabot[bot]