Keep plugin dependencies on Maven 3.9.x, Resolver 1.9.x and Sisu 1.0.0 #23

The plugins require Maven 3.9.0 and compile against Maven 3.9.16, which ships Resolver 1.9.27. A plugin that compiles against a newer core artifact can call API that the running Maven lacks.

Each repository gets its own Dependabot ignore for:

• every org.apache.maven core artifact it uses: >= 3.10.0;
• org.apache.maven.resolver:*: >= 2.0.0.

Sisu is not held back. Where a plugin declares org.eclipse.sisu.plexus, it also declares org.eclipse.sisu.inject at the same version: exec-maven-plugin#555 moved only the first to 1.1.1, and 12 tests failed with NoSuchMethodError on DefaultBeanLocator.setBeanEntryPredicateSupplier.

A bare org.apache.maven:* ignore is replaced, because it also blocks updates of the other artifacts in that group.

These pull requests make the change:

• Keep Dependabot on Maven 3.9.x and Resolver 1.9.x animal-sniffer#372

• Keep Dependabot on Maven 3.9.x for maven-model buildnumber-maven-plugin#306

• Keep Dependabot on Maven 3.9.x for maven-model buildplan-maven-plugin#326

• Bump the maven group with 4 updates exec-maven-plugin#555 (Sisu 1.1.1, with org.eclipse.sisu.inject kept in step)

• Keep Dependabot on Maven 3.9.x and Resolver 1.9.x extra-enforcer-rules#392

• Keep Dependabot on Maven 3.9.x and Resolver 1.9.x flatten-maven-plugin#557

• Keep Dependabot on Maven 3.9.x for maven-settings jaxb2-maven-plugin#454

• Keep Dependabot on Maven 3.9.x without ignoring every Maven artifact l10n-maven-plugin#73

• Keep Dependabot on maven-archiver 3.x license-maven-plugin#774

• Keep Dependabot on Maven 3.9.x and plexus-xml 3.x templating-maven-plugin#144 and #143 (plexus-utils 4.1.0, with plexus-xml 3.1.0 for the tests)

• Keep Dependabot on Resolver 1.9.x versions#1471

• Keep Dependabot on Maven 3.9.x for maven-settings-builder wagon-maven-plugin#204

• Keep Dependabot on Maven 3.9.x and Resolver 1.9.x xml-maven-plugin#207

• Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus animal-sniffer#374, Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus buildplan-maven-plugin#327, Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus extra-enforcer-rules#393, Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus license-maven-plugin#775, Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus wagon-maven-plugin#205: declare org.eclipse.sisu.inject next to org.eclipse.sisu.plexus

The other plugin repositories already ignore every core artifact they use.

Report plugins stay on maven-reporting-api 4.0.0: maven-site-plugin 3.22 and older load 4.0.0 and call the multi-page generate only through MavenMultiPageReport, which 4.1.0 deprecates. Doxia 2.2 is fine, as long as the reports keep org.apache.maven.doxia.sink.impl.SinkEventAttributeSet; its 2.2.0 replacement is missing under those site plugins.

• Stay on maven-reporting-api 4.0.0 license-maven-plugin#779, Stay on maven-reporting-api 4.0.0 versions#1473, Stay on maven-reporting-api 4.0.0 l10n-maven-plugin#74 (back to reporting API 4.0.0)
• Keep Dependabot on maven-reporting-api 4.0.0 taglist-maven-plugin#219, Keep Dependabot on maven-reporting-api 4.0.0 buildplan-maven-plugin#330, Keep Dependabot on maven-reporting-api 4.0.0 javacc-maven-plugin#135, Keep Dependabot on maven-reporting-api 4.0.0 jdepend-maven-plugin#113, Keep Dependabot on maven-reporting-api 4.0.0 aspectj-maven-plugin#294 (Dependabot ignore only)
• Keep Dependabot on Mockito 4 flatten-maven-plugin#560 (Mockito 4, as the build still runs on JDK 8)

Release order

mojo-parent pins seven MojoHaus plugins: animal-sniffer, build-helper, flatten, l10n, license, taglist and versions. The codehaus-plexus parent pins taglist and extra-enforcer-rules. Releasing those plugins first lets both parents ship with the new versions:

1. Release the plugins that the parents pin.
2. Bump them in mojo-parent and the codehaus-plexus parent, then release mojo-parent 98 and plexus 28.
3. Release the remaining plugins on mojo-parent 98.
4. Make a patch release of a plugin from step 1 only if building it on mojo-parent 98 changes something users see.

Every plugin draft that lists "Require Maven 3.9.0" under "Removed" is a minor release. The draft title shows the patch version from the POM, so set the release version explicitly.