From 95cfdd98425bd0b15763d805b8e2e9512ca3f3c4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 07:26:24 +0000
Subject: [PATCH 1/4] Bump org.apache.maven:maven-parent from 49 to 50

Bumps [org.apache.maven:maven-parent](https://github.com/apache/maven-parent) from 49 to 50.
- [Release notes](https://github.com/apache/maven-parent/releases)
- [Commits](https://github.com/apache/maven-parent/commits)

---
updated-dependencies:
- dependency-name: org.apache.maven:maven-parent
  dependency-version: '50'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 3be02a2..d10ad93 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.maven</groupId>
     <artifactId>maven-parent</artifactId>
-    <version>49</version>
+    <version>50</version>
     <relativePath />
   </parent>
 

From 2f2c1cf12f82caf77781878174183da3721a54fa Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Fri, 25 Sep 2026 12:37:04 +0200
Subject: [PATCH 2/4] Use inputExcludes for apache-rat 0.18

Keep the rat configuration in pluginManagement; the check itself is
activated by the parent's java17+ profile on JDK 17+.

Signed-off-by: Sylwester Lachiewicz <slachiewicz@apache.org>
---
 pom.xml | 44 +++++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 21 deletions(-)

diff --git a/pom.xml b/pom.xml
index d10ad93..b226fc1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -212,6 +212,27 @@
   <build>
     <pluginManagement>
       <plugins>
+        <plugin>
+          <groupId>org.apache.rat</groupId>
+          <artifactId>apache-rat-plugin</artifactId>
+          <configuration>
+            <inputExcludes combine.children="append">
+
+              <exclude>Jenkinsfile</exclude>
+              <exclude>.github/**</exclude>
+              <exclude>deploySite.bat</exclude>
+              <exclude>deploySite.sh</exclude>
+              <exclude>LICENCE</exclude>
+              <exclude>NOTICE</exclude>
+              <exclude>LICENCE</exclude>
+              <!--
+          ! Excluded the license files itself cause they do not have a license of themselves.
+          -->
+              <exclude>src/main/appended-resources/licenses/**</exclude>
+
+            </inputExcludes>
+          </configuration>
+        </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-compiler-plugin</artifactId>
@@ -264,30 +285,11 @@
         </plugin>
       </plugins>
     </pluginManagement>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.rat</groupId>
-        <artifactId>apache-rat-plugin</artifactId>
-        <configuration>
-          <excludes>
-            <exclude>Jenkinsfile</exclude>
-            <exclude>.github/**</exclude>
-            <exclude>deploySite.bat</exclude>
-            <exclude>deploySite.sh</exclude>
-            <exclude>LICENCE</exclude>
-            <exclude>NOTICE</exclude>
-            <exclude>LICENCE</exclude>
-            <!--
-              ! Excluded the license files itself cause they do not have a license of themselves.
-            -->
-            <exclude>src/main/appended-resources/licenses/**</exclude>
-          </excludes>
-        </configuration>
-      </plugin>
-    </plugins>
+    <plugins />
   </build>
 
   <profiles>
+
     <profile>
       <id>reporting</id>
       <reporting>

From a35e78060aa6da39d7557fd068a69e5da95f99f7 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Fri, 25 Sep 2026 21:34:12 +0200
Subject: [PATCH 3/4] Pin maven-compiler-plugin to 3.15.0

maven-parent 50 (via apache 40) manages 3.16.0, whose stricter
"recompile when dependencies change" check forces docker-exe's
compile-java9 to rerun inside the site plugin's forked, compile-only
javadoc:aggregate build. There, reactor dependencies are still plain
target/classes directories, and module-info can't see maven-executor's
MR-JAR module descriptor until it's packaged as a real jar (nesting
under META-INF/versions/9 is a jar-format concept) - so the forked
compile fails with "module not found: org.apache.maven.executor".
3.15.0's weaker staleness check instead reuses the classes already
compiled during the preceding verify, where packaging happens before
docker-exe compiles and the module is visible. Remove this pin only
once that forked-compile module path resolution is fixed.
---
 pom.xml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pom.xml b/pom.xml
index b226fc1..0136c12 100644
--- a/pom.xml
+++ b/pom.xml
@@ -70,6 +70,19 @@
     <project.build.outputTimestamp>2026-06-12T10:14:54Z</project.build.outputTimestamp>
     <testTmpDir>${project.build.directory}/tmp</testTmpDir>
 
+    <!--
+      ! Pinned below the version maven-parent 50 (apache 40) manages. 3.16.0's stricter
+      ! "recompile when dependencies change" check forces docker-exe's compile-java9 to
+      ! rerun inside the site plugin's forked, compile-only javadoc:aggregate build, where
+      ! reactor dependencies are still plain target/classes directories. module-info there
+      ! only sees maven-executor's MR-JAR module descriptor once it is packaged as a real
+      ! jar (META-INF/versions/9 is a jar-format concept), so the forked compile fails with
+      ! "module not found: org.apache.maven.executor". 3.15.0's weaker staleness check
+      ! instead reuses the classes already compiled during the preceding `verify`, where
+      ! packaging happens before docker-exe compiles and the module is visible.
+      ! Remove this pin only once that forked-compile module path resolution is fixed.
+    -->
+    <version.maven-compiler-plugin>3.15.0</version.maven-compiler-plugin>
     <version.maven3>3.9.16</version.maven3>
     <version.maven3resolver>1.9.27</version.maven3resolver>
     <version.maven4>4.0.0-rc-6</version.maven4>

From 7d49ef445a9c825c17cf51b2a7d56275cc8c2009 Mon Sep 17 00:00:00 2001
From: Sylwester Lachiewicz <slachiewicz@apache.org>
Date: Sat, 26 Sep 2026 00:01:03 +0200
Subject: [PATCH 4/4] Shorten the compiler plugin pin comment

---
 pom.xml | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/pom.xml b/pom.xml
index 0136c12..40711f7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -70,18 +70,8 @@
     <project.build.outputTimestamp>2026-06-12T10:14:54Z</project.build.outputTimestamp>
     <testTmpDir>${project.build.directory}/tmp</testTmpDir>
 
-    <!--
-      ! Pinned below the version maven-parent 50 (apache 40) manages. 3.16.0's stricter
-      ! "recompile when dependencies change" check forces docker-exe's compile-java9 to
-      ! rerun inside the site plugin's forked, compile-only javadoc:aggregate build, where
-      ! reactor dependencies are still plain target/classes directories. module-info there
-      ! only sees maven-executor's MR-JAR module descriptor once it is packaged as a real
-      ! jar (META-INF/versions/9 is a jar-format concept), so the forked compile fails with
-      ! "module not found: org.apache.maven.executor". 3.15.0's weaker staleness check
-      ! instead reuses the classes already compiled during the preceding `verify`, where
-      ! packaging happens before docker-exe compiles and the module is visible.
-      ! Remove this pin only once that forked-compile module path resolution is fixed.
-    -->
+    <!-- 3.16.0 recompiles docker-exe inside the site build, where the sibling's MR-JAR module-info
+         (META-INF/versions/9) is not visible from target/classes; a clean compile fails on 3.15.0 too. -->
     <version.maven-compiler-plugin>3.15.0</version.maven-compiler-plugin>
     <version.maven3>3.9.16</version.maven3>
     <version.maven3resolver>1.9.27</version.maven3resolver>