Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-11.1.0

Checkstyle 11.1.0 - https://checkstyle.org/releasenotes.html#Release_11.1.0

New:

#17451 - false-negative: whitespace between type annotation and array declarator or ellipsis

Bug fixes:

#17540 - Annotation location rule is not enforced in package-info.java file #17507 - Google style: Missing support for multipart versioning format using underscores in method names #17778 - Add support to properly follow Rule 7.1.1 General Form in Google Style Guide Implementation #17825 - --generate-checks-and-files-suppression option generates invalid XML #13048 - JavadocTagContinuationIndentation: missing support to arbitrary indentation in <pre> tags #11867 - LineLength gets triggered on multi-line strings for Google Checks

• aa944a0 [maven-release-plugin] prepare release checkstyle-11.1.0
• 64a4b38 doc: release notes for 11.1.0
• 17343cb Issue #17540: Enforce Annotation location rule in package-info.java
• 5d52248 Issue #17507: Add support for multipart versioning format using underscores
• c6c226c Issue #14631: Update SLASH token documentation to match new AST format
• 62627bd Issue #17778: Added JavadocLeadingAsteriskAlign Check in google_checks.xml fo...
• a7149ee Issue #17507: Add support for underscores in class name
• 1c22f5b Issue #17834: Fix DTD in suppressions.xml example
• 974bf37 Issue #14631: Fixed Token docs
• 97d8d50 minor: Bump version to 11.1.0-SNAPSHOT
• Additional commits viewable in compare view

Sourced from org.apache.maven.plugins:maven-javadoc-plugin's releases.

3.12.0

:boom: Breaking changes

• remove fix mojo (#1263) @​elharo
• detectOfflineLinks is now false per default for all jar mojo issue #1258 (#1259) @​olamy

🐛 Bug Fixes

• Fix legacyMode (#1265) @​fridrich
• Fix package {...} does not exist in legacyMode (#1243) @​JackPGreen
• Ensure UTF-8 charset is used to avoid IllegalArgumentException: Null charset name (#1245) @​elharo
• Remove Javadoc 1.4+ / -1.1 switch related warning (#1240) @​perceptron8

👻 Maintenance

• protect 3.8.x branch (#1238) @​hboutemy
• feat: enable prevent branch protection rules (#1228) @​sparsick

📦 Dependency updates

• Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0 (#1257) @dependabot[bot]

• 2a06bed [maven-release-plugin] prepare release maven-javadoc-plugin-3.12.0
• a71ecf9 bump version 3.12.0-SNAPSHOT
• 88f2b71 [maven-release-plugin] prepare for next development iteration
• 7e18956 [maven-release-plugin] prepare release maven-javadoc-plugin-3.11.4
• c11b76c In legacyMode, don't use -sourcepath, unless excludePackageNames is not empty...
• bc9904b remove fix mojo (#1263)
• f310135 Fix package {...} does not exist in legacyMode (#1243)
• c8270f9 detectOfflineLinks is now false per default for all jar mojo issue #1258 ...
• 953e609 Delete flaky test (#1260)
• 2bba7a4 Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0
• Additional commits viewable in compare view

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.14.1

🚀 New features and improvements

• Improve DeltaList behavior for large projects (#335) @​gsmet
• Allow to not use --module-version for the Java compiler (#331) @​pzygielo

🐛 Bug Fixes

• Add generatedSourcesPath back to the maven project (#312) @​mensinda
• [MCOMPILER-538] - Do not add target/generated-sources/annotations to the source roots (#191) @​mensinda

📦 Dependency updates

• Enforce asm version used here, to not depend on brittle transitive (#964) @​olamy
• Bump mavenVersion from 3.9.10 to 3.9.11 (#952) @dependabot[bot]
• Bump org.apache.maven.plugins:maven-plugins from 44 to 45 (#935) @dependabot[bot]
• Bump mavenVersion from 3.9.9 to 3.9.10 (#336) @dependabot[bot]
• Bump org.codehaus.plexus:plexus-java from 1.4.0 to 1.5.0 (#324) @dependabot[bot]
• Bump org.apache.maven.plugins:maven-plugins from 43 to 44 (#316) @dependabot[bot]

• 0df6940 [maven-release-plugin] prepare release maven-compiler-plugin-3.14.1
• 1bf9e5a Enforce asm version used here, to not depend on brittle transitive (#964)
• f5161c4 Bump mavenVersion from 3.9.10 to 3.9.11 (#952)
• 63846f1 Improve DeltaList behavior for large projects (#335)
• ab3f845 Bump org.apache.maven.plugins:maven-plugins from 44 to 45
• 164bad4 Allow to not use --module-version for the Java compiler
• 0b76ccd Bump mavenVersion from 3.9.9 to 3.9.10
• 5dbc9c3 Bump org.codehaus.plexus:plexus-java from 1.4.0 to 1.5.0
• 17949d1 Bump org.apache.maven.plugins:maven-plugins from 43 to 44 (#316)
• d44d1be Add generatedSourcesPath back to the maven project
• Additional commits viewable in compare view

Sourced from org.owasp:dependency-check-maven's releases.

Version 12.1.6

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Version 12.1.5

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Sourced from org.owasp:dependency-check-maven's changelog.

Version 12.1.6 (2025-09-24)

• fix: Disable OSS Index if its credentials are missing (#7963)
• fix: Correct CVSSv4 parsing for low precision OSSIndex values (#7935)
• fix(fp): Fix false positives for Redis Server against NPM/JS client libs (#7942)
• docs: Fix legacy GitHub links within docs and CHANGELOG (#7944)
• chore: fix version typo in security policy (#7936)

See the full listing of changes

Version 12.1.5 (2025-09-20)

• fix: Update to support OSS Index Authentication Requirements (#7920)
  • Note: OSS Index will require authentication starting 9/22/2025. Users must configure a free account to continue using the OSS Index Analyzer. See https://ossindex.sonatype.org/doc/auth-required.
• fix: add CVSSv4 to suppressed entries in JSON report (#7900)
• fix: correctly utilize CVSSv4 from ossindex (#7899)
• fix: npe when processing cve with empty configuration (#7888)
• fix: Return unsorted vulnerabilities in new HashSet, avoiding CoMod (#7848)
• fix: Return unsorted vulnerabilities in new HashSet, avoiding CoMod
• fix: class loading problem with fat jars (#7786) (#7787)
• fix: Improve Artifactory handler log message (#7838)
• fix: classloading problem with fat jars (#7786)
• fix: Add null checking when parsing the license json in AbstractNpmAnalyzer. (#7784)
• fix(fp): resolves several false positives related to CVE-2021-41033 (#7736)
• docs: Clarify format of exclude patterns (#7879)
• docs: Document poetry-based analysis behaviour in Python analyzer (#7855)
• docs: request FP reporters use the latest version of ODC. (#7820)
• docs: update development pre-reqs (#7792)
• docs: fix minor typos in false positive issue template (#7763)

See the full listing of changes

• 0a9592c build: prepare release v12.1.6
• c7e992c docs: release 12.1.6
• 93b0d1b build(deps): bump netty-codec-http from 5.2.4-final to 5.2.5-final (#7965)
• 22ecc0b fix: Disable OSS Index if its credentials are missing (#7963)
• 93422d2 chore: Allow passing ossIndex credentials during false positive ops workflow ...
• 34a1235 docs: Fix legacy GitHub links within docs and CHANGELOG (#7944)
• c44ba32 fix(fp): Fix false positives for Redis Server against NPM/JS client libs (#7942)
• 4af07cc docs: Implement #7808 to make changelog links clickable (#7945)
• 6008202 test: Fix AssemblyAnalyzerTest to be robust to Grok availability (#7950)
• b3aa3f2 build: replace deprecated jlink argument (#7953)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions