plexus-utils 4.2.0 makes the file deletion helpers safe around symbolic links, lets CommandLineUtils forward the console's standard input to a child process, and fixes several FileUtils and command-line parsing edge cases. It requires Java 8 or later. The XML classes live in plexus-xml, which this release moves up to 3.1.1.

✨ Highlights

• Deleting a tree no longer deletes outside it. FileUtils.forceDeleteOnExit followed symbolic links to directories, so a link inside the tree got every file under its target deleted when the JVM exited. deleteDirectory could empty a link's target when the link itself could not be removed. Both now remove only the link (#348, thanks @kakkar87d).
• Child processes can read the console. When CommandLineUtils.executeCommandLine gets System.in as the process input, it now polls it instead of blocking in read(), so the call returns once the process exits rather than hanging on an idle terminal (#351, fixes #260).
• translateCommandline splits at tabs and line breaks. Outside quotes, \t, \n and \r now separate arguments like a space does. Input that held one of these characters unquoted now yields more arguments; quoted text is unchanged (#352, fixes #329).
• Clearer FileUtils failures. forceDelete uses Files.deleteIfExists, so it also removes dangling symbolic links and skips the Windows retry delay for files that are already gone (#350, fixes #21). copyDirectoryStructure and cleanDirectoryOnExit report an unreadable directory as an IOException naming it, instead of a NullPointerException (#349).
• plexus-xml 3.1.1 fixes a parser buffer overrun on a supplementary character in an XML comment (#354).

The same fixes, without the standard-input change, are in 3.6.3 for the 3.x line.

🚀 New features and improvements

• Poll System.in for stdin in CommandLineUtils.executeCommandLine (#351) @slachiewicz

🐛 Bug Fixes

• Do not follow symlinks in forceDeleteOnExit and deleteDirectory (#348) @kakkar87d
• Split translateCommandline at tabs and line breaks (#352) @slachiewicz
• Use Files.deleteIfExists in FileUtils.forceDelete (#350) @slachiewicz
• Report an unlistable directory as IOException instead of NullPointerException (#349) @slachiewicz

📝 Documentation updates

• Drop the Source Xref menu item (#344) @slachiewicz
• Stop pinning a version in the README snippet (#343) @slachiewicz
• Advertise 4.1.0 in the README (#341) @slachiewicz

🔧 Build

• Allow running the release drafter by hand (#346) @slachiewicz
• Draft the version the labels imply, not always a patch (#342) @slachiewicz

📦 Dependency updates

• Bump plexus-xml to 3.1.1 and keep Dependabot on 3.x (#354) @slachiewicz
• Bump release-drafter/release-drafter from 7.7.0 to 7.10.0 (#345, #347) @dependabot[bot]

Full changelog

plexus-utils 3.6.4 fixes a crash in the XML parser bundled with the 3.x line. It requires Java 8 or later, as before.

✨ Highlights

• XML comments with emoji no longer crash the parser. MXParser threw ArrayIndexOutOfBoundsException when a comment that needed line-ending normalisation put a surrogate pair, such as an emoji, exactly at the end of its internal buffer. This is the fix from plexus-xml 3.1.1, applied to the copy of MXParser that plexus-utils 3.x still carries. plexus-utils 4.x gets it from plexus-xml 3.1.1 (#356).

🐛 Bug Fixes

• Fix ArrayIndexOutOfBoundsException for surrogate pair in comment at buffer boundary (#356) @slachiewicz

Full changelog

plexus-utils 3.6.3 brings the bug fixes of 4.2.0 to the 3.x line (#355). It requires Java 8 or later, as before.

✨ Highlights

• Deleting a tree no longer deletes outside it. FileUtils.forceDeleteOnExit followed symbolic links to directories, so a link inside the tree got every file under its target deleted when the JVM exited. deleteDirectory could empty a link's target when the link itself could not be removed. Both now remove only the link (#348, thanks @kakkar87d).
• translateCommandline splits at tabs and line breaks. Outside quotes, \t, \n and \r now separate arguments like a space does. Input that held one of these characters unquoted now yields more arguments; quoted text is unchanged (#352).
• Clearer FileUtils failures. forceDelete uses Files.deleteIfExists, so it also removes dangling symbolic links and skips the Windows retry delay for files that are already gone (#350). copyDirectoryStructure and cleanDirectoryOnExit report an unreadable directory as an IOException naming it, instead of a NullPointerException (#349).

🐛 Bug Fixes

• Do not follow symlinks in forceDeleteOnExit and deleteDirectory (#348) @kakkar87d
• Split translateCommandline at tabs and line breaks (#352) @slachiewicz
• Use Files.deleteIfExists in FileUtils.forceDelete (#350) @slachiewicz
• Report an unlistable directory as IOException instead of NullPointerException (#349) @slachiewicz

Full changelog

DirectoryScanner no longer excludes .gitignore and .cvsignore by default. Code that relied on
the old defaults has to add the two patterns explicitly. That change is what makes this a minor
release rather than 4.0.4.

💥 Breaking changes

• Do not exclude ".gitignore" and ".cvsignore" by default (#326) @kwin

👻 Maintenance

• Rewrite README with usage, status and version guidance (#332) @slachiewicz

🔧 Build

• Update parent to plexus 27 (#338) @slachiewicz
• Drop the Publish Site workflow (#337) @slachiewicz
• Add the Publish Site workflow (#334) @slachiewicz
• Use the shared release-drafter config instead of a local copy (#333) @slachiewicz

📦 Dependency updates

• Bump the plexus dependencies released today (#340) @slachiewicz
• Bump org.codehaus.plexus:plexus from 25 to 26 (#335) @dependabot[bot]
• Bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#331) @dependabot[bot]
• Bump release-drafter/release-drafter from 7 to 7.6.0 (#330) @dependabot[bot]

A build-metadata release on the 3.x maintenance line: the parent POM moves to plexus 27. No library
code changed since 3.6.1, so consumers that only need the classes can stay where they are.

🔧 Build

• [plexus-utils-3.x] Update parent to plexus 27 (#339) @slachiewicz

📦 Dependency updates

• Bump org.codehaus.plexus:plexus from 25 to 26 (#336) @dependabot[bot]

💥 Breaking changes

• Do not exclude ".gitignore" and ".cvsignore" by default (#326) (#327) @kwin

🚀 New features and improvements

• Do not exclude ".gitignore" and ".cvsignore" by default (#326) (#327) @kwin
• [3.x] Add Automatic-Module-Name manifest entry (#324) @cstamas

🐛 Bug Fixes

• Fix Zip Slip vulnerability in archive extraction (#296) (#304) @slachiewicz

👻 Maintenance

• Remove obsolete and time consuming Java 7 issue #51 regression test (#328) @slachiewicz
• [3.x] Add license to POM (#325) @cstamas
• Move to Site 2.0 descriptor (#306) @slachiewicz
• JUnit Jupiter best practices & tests cleanups (#303) @slachiewicz

📦 Dependency updates

• Bump org.codehaus.plexus:plexus from 24 to 25 (#310) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 23 to 24 (#298) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 22 to 23 (#293) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 21 to 22 (#290) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 20 to 21 (#287) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 19 to 20 (#286) @dependabot[bot]
• Bump jmhVersion from 1.36 to 1.37 (#285) @dependabot[bot]

🚀 New features and improvements

• Add Automatic-Module-Name manifest entry (#314) @gnodet
• V4 changes to make external usage easier (#278) @Claudenw

🐛 Bug Fixes

• Fix Zip Slip vulnerability in archive extraction (#296) @copilot-swe-agent[bot]

👻 Maintenance

• Move to Site 2.0 descriptor (#305) @slachiewicz
• JUnit Jupiter best practices & code cleanups (#302) @slachiewicz
• Replace FileUtils.fileExists(String) with JDK provided API (#301) @slachiewicz
• Declare license info in POM (#291) @Goooler
• Cleanup tests (#283) @slachiewicz

📦 Dependency updates

• Bump release-drafter/release-drafter from 6 to 7 (#313) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 24 to 25 (#309) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 23 to 24 (#297) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 22 to 23 (#292) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 21 to 22 (#289) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 20 to 21 (#288) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 19 to 20 (#284) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 18 to 19 (#274) @dependabot[bot]

What's Changed

• [3.x] Fix false difference detected with CachingOutputStream/CachingWriter when streams are flushed by @gnodet in #253
• V3 changes to make external usage easier by @Claudenw in #277
• Bump parent pom to 19 and reformat sources by @slachiewicz in #280
• Convert to JUnit 5 with OpenRewrite by @slachiewicz in #281
• sync pom changes from master branch by @slachiewicz in #282

Full Changelog: plexus-utils-3.5.1...plexus-utils-3.6.0

🐛 Bug Fixes

• Specify /D for cmd.exe to bypass the Command Processor Autorun folder (#272) @sebthom

📦 Dependency updates

• Bump org.codehaus.plexus:plexus from 17 to 18 (#271) @dependabot
• Bump org.codehaus.plexus:plexus-xml from 3.0.0 to 3.0.1 (#270) @dependabot

🚀 New features and improvements

• Add .gitignore to default excludes (#269) @slawekjaranowski
• downgrade plexus-xml from 4 to 3: keep Maven 3 compatibility (#263) @hboutemy

📦 Dependency updates

• downgrade plexus-xml from 4 to 3: keep Maven 3 compatibility (#263) @hboutemy
• Bump org.codehaus.plexus:plexus from 13 to 17 (#262 #265 #266 #268) @dependabot
• Bump plexus-xml from 4.0.0 to 4.0.2 (#259) @dependabot
• Bump org.junit.jupiter:junit-jupiter from 5.9.2 to 5.10.0 (#251 #261) @dependabot

👻 Maintenance

• pom.mxl and site.xml cleanup (#257) @hboutemy
• Bump release-drafter/release-drafter from 5 to 6 (#267) @dependabot