License Maven Plugin 2.9.0 caches downloaded license texts between builds, adds name-based URL overrides and stricter download checks, and fixes a long list of reported bugs in headers, the third-party report and dependency resolution. The requirements are unchanged: Maven 3.9.0 or later, Java 8.

⚠️ Changes to check when upgrading

• -Dlicense.licenceFile is now -Dlicense.licenseFile for update-project-license and check-project-license. The misspelled property still works for now, with a deprecation warning (#797, #479 by @zdenek-jonas).
• verbose is deprecated. Its messages are logged at debug level, so use -X instead (#810, #340 by @digulla).

✨ Highlights

• License texts are cached between builds in ${settings.localRepository}/.cache/mojohaus-license-maven-plugin and reused for 30 days, then revalidated with ETag/Last-Modified. CI builds that restore the local repository stop downloading the same license pages on every run (#780).
• licenseNameUrlOverrides downloads a license text from a URL you choose, matched by a regular expression on the license name, so variants of one license share a clean text (#718 by @MrBanana05).
• Stricter downloads. failOnForbidden fails the build when a dependency has a license listed in forbiddenLicenses (#792, #323 by @ppalaga), and failOnMissingLicenseFile fails it when a license text could not be downloaded (#791). HTML pages are no longer accepted as license texts (#790).
• Dependency POMs are read from the repositories of the POMs that lead to them, so licenses of dependencies hosted outside the project's repositories are no longer "Unknown" (#807, #752 by @lrozenblyum).
• The third-party report links each license to its URL (#799, #212 by @digulla).
• Proxy: every download of the plugin now uses the active Maven proxy (#804, #434 by @lexx9999).
• File headers: the FreeMarker directive stays first when a header is added (#806, #412 by @smokemaker). Blank lines of the license are kept when an existing header is read (#808, #347 by @heapifyman). The package statement is no longer matched inside comments (#803, #562 by @onacit). Files fall back to LF when no file sets the end of line (#800, #511 by @jacek-lewandowski).
• Other fixes: relative file: URLs of license texts resolve against the base directory (#809, #428 and #431 by @duracotton). The third-party file is added to the resources whatever its name (#796, #124 by @bnese), and the template can read the project (#801, #365 by @ST-DDT). A missing classpath license repository fails with a clear error (#802, #384 by @HenningL), and unknown missing-file entries are logged at debug level when the file is remote (#798, #201 by @TorstenKruse). The artifact cache no longer leaks between helper instances (#793, #375 by @cwholmes), and the dead EUPL 1.1 header URL is replaced (#795, #443 by @dodinh).
• overrideFile is no longer deprecated. It is the choice for a file inside the project, and overrideUrl stays for remote and classpath: locations (#794, #416 by @bogdanb).
• Documentation moved to Markdown (#783), and says that includes and excludes are relative to the roots (#805).

🚀 New features and improvements

• Reject HTML responses as license texts (#790) @slachiewicz
• Cache downloaded license texts between builds (#780) @slachiewicz
• Add failOnMissingLicenseFile to the download goals (#791) @slachiewicz
• Scope the artifact cache of DefaultThirdPartyHelper to the helper (#793) @slachiewicz
• Remove the deprecation of the overrideFile parameter (#794) @slachiewicz
• Add failOnForbidden to the download goals (#792) @slachiewicz
• Feat: Allow easier Reusing / Normalization of License Texts (#718) @MrBanana05

🐛 Bug Fixes

• Read dependency POMs from the repositories of the POMs that lead to them (#807) @slachiewicz
• Link licenses to their URL in the third-party report (#799) @slachiewicz
• Log the verbose messages at debug level and deprecate verbose (#810) @slachiewicz
• Replace the dead URL in the EUPL 1.1 header (#795) @slachiewicz
• Use the active proxy for the other downloads of the plugin (#804) @slachiewicz
• Add the third-party file to the resource directory regardless of its name (#796) @slachiewicz
• Fall back to LF when no file can set the end of line (#800) @slachiewicz
• Rename the licenseFile property to license.licenseFile (#797) @slachiewicz
• Resolve relative file URLs of license texts against the basedir (#809) @slachiewicz
• Keep the ftl directive first when adding a file header (#806) @slachiewicz
• Keep blank lines of the license when reading an existing header (#808) @slachiewicz
• Log unknown missing file entries at DEBUG when the file is remote (#798) @slachiewicz
• Expose the project to the third-party file template (#801) @slachiewicz
• Fail with a clear error when a classpath license repository is missing (#802) @slachiewicz
• Anchor the package statement search outside comments (#803) @slachiewicz

📝 Documentation updates

• Document that includes and excludes are relative to the roots (#805) @slachiewicz
• Convert the site documents to Markdown (#783) @slachiewicz

👻 Maintenance

• Remove license headers from invoker.properties fixtures (#788) @slachiewicz
• Declare the plugin version inline in fixtures that need no pluginManagement (#789) @slachiewicz
• Assert what the licence whitelist and blacklist ITs claim (#787) @slachiewicz
• Move the download error report out of AbstractDownloadLicensesMojo.execute() (#785) @slachiewicz

🔧 Build

• Resolve the site fixture's plugins in the main build (#786) @slachiewicz
• Reuse the cached prefix file in the integration tests (#784) @slachiewicz

Thanks to @MrBanana05, @slachiewicz and Bjarne Cornelius.

Full changelog

License Maven Plugin 2.8.0 improves the speed, reliability, and configurability of license downloads and third-party license reports. It requires Maven 3.9.0 or later and Java 8 or later.

✨ Highlights

• Bundled well-known license texts (download-licenses, test-download-licenses): Common plain-text license URLs — including Apache 2.0, EPL 2.0, and the GNU GPL (1.0, 2.0, 3.0), LGPL (2.0, 2.1, 3.0), AGPL (3.0), and FDL (1.1, 1.2, 1.3) families — are now written directly from texts bundled with the plugin instead of being downloaded over the network on every build (#781).
• License classification in third-party-report: You can now classify third-party licenses using <forbiddenLicenses>, <problematicLicenses>, and <okLicenses> so the generated report highlights compliance status (Forbidden, Warning, OK, Unknown) as plain text without relying on external skin images (#731, #777).
• Configurable license summary ordering: Added the <orderBy> parameter to download-licenses (name by default, gav, or license) to control the ordering of entries in licenses.xml (#730).
• Authenticated license downloads: download-licenses can now authenticate against protected license hosts using credentials configured in Maven's settings.xml via <loginServerId> (#717).
• More resilient license downloads and filtering:
  • Restored support for Windows file: URLs (such as file:/C:/... and file://C:/...) in license URLs (#778).
  • When a license host returns HTTP 429 Too Many Requests or 503 Service Unavailable, the plugin stops querying that host for the rest of the execution instead of repeatedly failing or timing out (#771).
  • Requests now include a plugin-specific User-Agent header so servers that block default Java HTTP clients accept requests (#728).
  • License names in <includedLicenses>, <excludedLicenses>, and pipe-separated license lists now have surrounding whitespace trimmed consistently (#734, #737).
  • Fixed a NullPointerException when excluding transitive dependencies with a null dependency trail (#739) and a ConcurrentModificationException when multiple dependencies declare multiple licenses (#706).

🚨 Removed

• Require Maven 3.9.0 (#757) @slachiewicz

🚀 New features and improvements

• Write well-known licenses from bundled texts instead of downloading them (#781) @slachiewicz
• Show report status as text instead of skin images (#777) @slachiewicz
• Classify licenses as forbidden, problematic or ok (#731) @slachiewicz
• Order the license summary by name, GAV or license (#730) @slachiewicz
• Feat: Allow using Authentication when downloading License Texts (#717) @MrBanana05

🐛 Bug Fixes

• Accept file: URLs with a Windows path again (#778) @slachiewicz
• Stop requesting a license host after it answers 429 or 503 (#771) @slachiewicz
• Skip null dependency trail when excluding transitives #310 (#739) @AzazelSensei
• Fixed license name splitting (#737) @Master-Code-Programmer
• Trim the license names in includedLicenses and excludedLicenses (#734) @slachiewicz
• Send a plugin-specific User-Agent when downloading licenses (#728) @slachiewicz
• fix a ConcurrentModificationException (#706) @wuwu2000

📝 Documentation updates

• Add AGENTS.md (#760) @slachiewicz

👻 Maintenance

• Keep Dependabot on Apache POI 5.x (#782) @slachiewicz
• Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus (#775) @slachiewicz
• Keep the remaining Maven artifacts on 3.9.x in Dependabot (#770) @slachiewicz
• Declare the Maven artifacts the code uses (#765) @slachiewicz
• Remove redundant mojo.java.target property (#766) @slachiewicz
• Apply the JUnit 5 best practices to the tests (#763) @slachiewicz
• Keep Dependabot on Maven 3.9.x (#762) @slachiewicz
• Write the integration test scripts as plain assertions (#758) @slachiewicz
• Stub repository.jboss.org in ISSUE-80 and download-licenses-include-exclude-types ITs (#744) @slachiewicz
• Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#743) @slachiewicz
• Stop dependabot from offering wiremock 3 (#725) @slachiewicz
• Stop dependabot from updating integration test fixtures (#721) @slachiewicz

🔧 Build

• Keep Dependabot on maven-archiver 3.x (#774) @slachiewicz
• Use the runners' cached Temurin JDKs in CI (#764) @slachiewicz
• Stop tracking the jar mrm generates in src/it-repo (#761) @slachiewicz
• Serve the vulnerable IT fixture dependencies from a mock repository (#759) @slachiewicz
• Run one integration test per CPU core (#756) @slachiewicz
• Check dependencies monthly and group the updates (#755) @slachiewicz
• Run fewer JDKs on macOS and Windows (#754) @slachiewicz
• Run the integration tests in parallel (#753) @slachiewicz
• Keep Dependabot off Mockito 5 (#749) @slachiewicz
• Stop dependabot from updating integration test fixtures (#721) @slachiewicz
• Fix build with Maven 3.10.x (#719) @slawekjaranowski

📦 Dependency updates

Thanks to @AzazelSensei, @Master-Code-Programmer, @MrBanana05, @slachiewicz, @slawekjaranowski, @wuwu2000, Bjarne Cornelius and Jan Diederich.

Full changelog

💥 Breaking changes

• Bump LibreOffice library odfdom-java to 0.12.0, require JDK 11+ for generating Calc file ODS (#684) @slawekjaranowski

🚀 New features and improvements

• Bump LibreOffice library odfdom-java to 0.12.0, require JDK 11+ for generating Calc file ODS (#684) @slawekjaranowski
• Fix for issues/533 (dual licensed dependency with one license on whitelist and the other on blacklist) (#670) @wuwu2000
• Make Mojos thread-safe and improve concurrent cache handling (#674) @shaikhu

👻 Maintenance

• Add PR automation workflow (#682) @slawekjaranowski

📦 Dependency updates

• Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-345 (#691) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 94 to 95 (#690) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-508 (#677) @dependabot[bot]
• Bump org.apache.maven:maven-archiver from 3.6.5 to 3.6.6 (#689) @dependabot[bot]
• Bump org.apache.logging.log4j:log4j-to-slf4j from 2.25.2 to 2.25.3 (#688) @dependabot[bot]
• Bump mavenVersion from 3.9.11 to 3.9.12 (#687) @dependabot[bot]
• Bump org.apache.poi:poi-ooxml from 5.5.0 to 5.5.1 (#683) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.9 to 3.18.0 in /src/it/ISSUE-312/child2 (#681) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0 (#679) @dependabot[bot]
• Bump org.apache.poi:poi-ooxml from 5.4.1 to 5.5.0 (#680) @dependabot[bot]
• Bump org.wiremock:wiremock-standalone from 3.13.1 to 3.13.2 (#678) @dependabot[bot]
• Bump commons-io:commons-io from 2.20.0 to 2.21.0 (#676) @dependabot[bot]
• Bump org.apache.maven:maven-archiver from 3.6.4 to 3.6.5 (#671) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 93 to 94 (#669) @dependabot[bot]
• Bump org.apache.logging.log4j:log4j-to-slf4j from 2.25.1 to 2.25.2 (#667) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0 (#668) @dependabot[bot]

🚀 New features and improvements

• Check project license goal (#650) @sewerwal

🐛 Bug Fixes

• Adding missing @Inject to LicenseListMojo class (#656) @jhonnymertz

🔧 Build

• Disable fail-fast build in matrix, skip download-licenses-configured IT (#657) @slawekjaranowski

📦 Dependency updates

• Bump org.apache.maven:maven-archiver from 3.6.3 to 3.6.4 (#659) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/add-third-party-with-deps-name-order (#661) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 92 to 93 (#660) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-423 (#653) @dependabot[bot]
• Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#655) @dependabot[bot]
• Bump mavenVersion from 3.9.10 to 3.9.11 (#654) @dependabot[bot]
• Bump org.apache.logging.log4j:log4j-to-slf4j from 2.25.0 to 2.25.1 (#652) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 (#649) @dependabot[bot]
• Bump org.apache.commons:commons-lang3 from 3.8.1 to 3.18.0 in /src/it/ISSUE-345-2 (#651) @dependabot[bot]

🚀 New features and improvements

• Implement Optional Parameters to include and exclude submodules (#620) @MrBanana05

📝 Documentation updates

• Rename 'Goals' to 'Plugin Documentation' in site manu (#647) @slawekjaranowski

👻 Maintenance

• Use constant 3.6.3 in prerequisites/maven as minimal Maven version (#646) @slawekjaranowski
• Use MavenProjectHelper for adding resources (#643) @slawekjaranowski

📦 Dependency updates

• Bump mavenVersion from 3.6.3 to 3.9.10 (#645) @dependabot[bot]
• Bump org.apache.logging.log4j:log4j-to-slf4j from 2.24.3 to 2.25.0 (#648) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 87 to 92 (#644) @dependabot[bot]
• Bump org.wiremock:wiremock-standalone from 3.13.0 to 3.13.1 (#642) @dependabot[bot]
• Bump org.wiremock:wiremock-standalone from 3.12.1 to 3.13.0 (#635) @dependabot[bot]
• Bump org.igniterealtime.smack:smack-core from 4.1.6 to 4.1.9 in /src/it/ISSUE-361 (#634) @dependabot[bot]
• Bump org.apache.poi:poi-ooxml from 5.4.0 to 5.4.1 (#631) @dependabot[bot]
• Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#632) @dependabot[bot]
• Bump org.wiremock:wiremock-standalone from 3.12.0 to 3.12.1 (#627) @dependabot[bot]
• Bump org.wiremock:wiremock-standalone from 3.10.0 to 3.12.0 (#625) @dependabot[bot]
• Bump org.codehaus.mojo:mojo-parent from 86 to 87 (#623) @dependabot[bot]
• Bump org.apache.poi:poi-ooxml from 5.3.0 to 5.4.0 (#618) @dependabot[bot]
• Bump org.freemarker:freemarker from 2.3.33 to 2.3.34 (#617) @dependabot[bot]
• Bump org.apache.logging.log4j:log4j-to-slf4j from 2.24.2 to 2.24.3 (#616) @dependabot[bot]
• Bump org.wiremock:wiremock-standalone from 3.9.2 to 3.10.0 (#614) @dependabot[bot]

❗ NOTICE

Due to Doxia 2.x stack maven-site-plugin 3.20+ is required.
https://cwiki.apache.org/confluence/display/MAVEN/Towards+Doxia+2.0.0+Stack

🚀 New features and improvements

• Update Doxia to 2.x stack (#603) @slawekjaranowski
• Added an option to control if output directory is added as resource directory (#580) @AB-xdev
• Enhance exception handling for license execution when the URL tag of the license is empty. (#588) @djjeon
• Parallel processing of files (#568) @mkarg

🐛 Bug Fixes

• Manage open streams in correct way (#609) @slawekjaranowski
• licenseName is required (#607) @vitalijr2
• Fix issue #560: fail to download license file because license name contains invalid characters (#561) @nhuongmh
• Generate latest version of mvnw with no additional resources (#551) @VonUniGE

📦 Dependency updates

• Bump org.apache.logging.log4j:log4j-to-slf4j from 2.24.1 to 2.24.2 (#612) @dependabot
• Bump commons-io:commons-io from 2.17.0 to 2.18.0 (#611) @dependabot
• Update Doxia to 2.x stack (#603) @slawekjaranowski
• Bump org.codehaus.mojo:mojo-parent from 85 to 86 (#590) @dependabot
• Bump org.codehaus.plexus:plexus-utils from 4.0.1 to 4.0.2 (#594) @dependabot
• Bump commons-io:commons-io from 2.16.1 to 2.17.0 (#592) @dependabot
• Bump commons-logging:commons-logging from 1.3.3 to 1.3.4 (#584) @dependabot
• Bump org.apache.commons:commons-lang3 from 3.16.0 to 3.17.0 (#585) @dependabot
• Bump org.apache.commons:commons-lang3 from 3.15.0 to 3.16.0 (#582) @dependabot
• Bump org.codehaus.mojo:mojo-parent from 84 to 85 (#583) @dependabot
• Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.15.0 (#578) @dependabot
• Bump commons-logging:commons-logging from 1.3.2 to 1.3.3 (#577) @dependabot
• Bump org.apache.poi:poi-ooxml from 5.2.5 to 5.3.0 (#576) @dependabot
• Bump org.codehaus.mojo:mojo-parent from 80 to 84 (#573) @dependabot
• Bump org.freemarker:freemarker from 2.3.32 to 2.3.33 (#570) @dependabot
• Bump commons-logging:commons-logging from 1.3.1 to 1.3.2 (#565) @dependabot
• Bump org.codehaus.plexus:plexus-xml from 3.0.0 to 3.0.1 (#566) @dependabot
• Bump org.codehaus.plexus:plexus-utils from 4.0.0 to 4.0.1 (#559) @dependabot
• Bump commons-io:commons-io from 2.16.0 to 2.16.1 (#558) @dependabot
• Bump commons-io:commons-io from 2.15.1 to 2.16.0 (#556) @dependabot
• Bump commons-logging:commons-logging from 1.3.0 to 1.3.1 (#555) @dependabot
• Bump org.codehaus.mojo:mojo-parent from 78 to 80 (#548) @dependabot

👻 Maintenance

• Replace deprecated Component annotation (#613) @slawekjaranowski
• Use WireMock in integration test (#610) @slawekjaranowski
• Move to jUnit5 (#608) @vitalijr2
• Add Log4j2 to SLF4J Adapter (#605) @slawekjaranowski
• Drop Maven wrapper from project (#602) @slawekjaranowski
• Re-enable checkstyle plugin (#589) @slawekjaranowski
• Prepare for doxia 2.0 (#575) @slawekjaranowski
• Bump apache/maven-gh-actions-shared from 3 to 4 (#550) @dependabot

🔧 Build

• Build with Maven 4 (#574) @slawekjaranowski

🚀 New features and improvements

• Require Maven 3.6.3 as minimum (#543) @slawekjaranowski
• Get rid usage of MavenSession#lookup (#541) @slawekjaranowski
• Deploy snapshot version to oss.sonatype.org (#539) @slawekjaranowski
• Write Excel files with extensive License Information (inc. infos from the JARs) (#527) @Master-Code-Programmer

🐛 Bug Fixes

• update xsd to match generated xmls (#528) @amanica

📦 Dependency updates

• Bump org.codehaus.mojo:mojo-parent from 77 to 78 (#542) @dependabot
• Bump org.apache.poi:poi-ooxml from 5.2.4 to 5.2.5 (#537) @dependabot
• Bump commons-io:commons-io from 2.13.0 to 2.15.1 (#535) @dependabot
• Bump commons-logging:commons-logging from 1.2 to 1.3.0 (#532) @dependabot
• Bump org.apache.commons:commons-lang3 from 3.13.0 to 3.14.0 (#530) @dependabot
• Bump commons-io:commons-io from 2.15.0 to 2.15.1 (#531) @dependabot
• Bump commons-io:commons-io from 2.14.0 to 2.15.0 (#526) @dependabot

👻 Maintenance

• Execute download-licenses-proxy test at the end (#545) @slawekjaranowski
• Added extended-info and spreadsheet-report author to the contributor list (#534) @Master-Code-Programmer

🔧 Build

• Use Shared ASF Action from Release Drafter (#544) @slawekjaranowski

🚀 New features and improvements

• #519 minor updates to reduce verbosity of standard execution (#520) @d-ryan-ashcraft
• #517: optionally support copyright values that only contain inception year rather than year range (#518) @d-ryan-ashcraft

🐛 Bug Fixes

• Fix #508 - Avoid NPE in AggregatorAddThirdPartyMojo (#512) @slawekjaranowski

📦 Dependency updates

• Downgrade plexus-xml to version 3.0.0 (#523) @slawekjaranowski
• Bump org.codehaus.mojo:mojo-parent from 76 to 77 (#516) @dependabot
• Bump commons-io:commons-io from 2.13.0 to 2.14.0 (#515) @dependabot
• Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.13.0 (#514) @dependabot
• Bump plexus-xml from 4.0.1 to 4.0.2 (#510) @dependabot

👻 Maintenance

• Build improvements - one profile for ITs (#525) @slawekjaranowski
• Cleanups in FileUtil - direct use methods from NIO (#513) @slawekjaranowski

🚀 New features and improvements

• Switch components to JSR-330, Require JDK 1.8 (#501) @slawekjaranowski
• Log message about skip due to packaging in info level (#499) @slawekjaranowski

🐛 Bug Fixes

• Fix #358, #352 NPE on site generation caused by null returned by deprecated MavenProject.getDependencyArtifacts() (#373) @tomred-net
• Fix #413 Use 'GAV' for result keys in LicensedArtifactResolver (#414) @attilapuskas
• Fix #498 add-third-party should not override third-party file with the same content (#500) @slawekjaranowski
• Fix #351 License override does not work for third-party dependencies with multiple licenses (#374) @lama0206
• Fixed '[WARNING] There were 0 download errors - check the warnings above to not log warning unless download errors > 0 (#402) @blekinge

📦 Dependency updates

• Bump mojo-parent from 75 to 76 (#504) @dependabot
• Bump json from 20070829 to 20230227 in /src/it/add-third-party-missing-file (#460) @dependabot
• Bump plexus-xml from 4.0.0 to 4.0.1 (#496) @dependabot
• Bump commons-io from 2.12.0 to 2.13.0 (#493) @dependabot

👻 Maintenance

• Use project.version instead of pom.version in ITs (#507) @slawekjaranowski
• Use JDK 1.8 in ITs - allow build on JDK 20 (#506) @slawekjaranowski
• Enable spotless for automatic code formatting (#505) @slawekjaranowski
• Add LICENSE.txt file (#503) @slawekjaranowski
• Fix formatting in example-thirdparty document (#502) @slawekjaranowski

🚀 New features and improvements

• Fix #379 allow users to customize the copyright string format (#380) @davenice
• Update GPL licenses (#362) @camlloyd
• Recognize classpath protocol as external (#486) @slawekjaranowski

🐛 Bug Fixes

• fix #361 - sortArtifactByName: artifacts with the same name are lost (#363) @lrozenblyum
• Fix #354 Make artifact cache safe for concurrent access (#355) @Stephan202
• Fix cookie header warning (#472) @danHayworth

📦 Dependency updates

• Bump maven-reporting-impl from 3.0.0 to 3.2.0 (#452) @dependabot
• Bump maven-reporting-api from 3.0 to 3.1.1 (#456) @dependabot
• Bump plexus-utils from 3.5.1 to 4.0.0 (#481) @dependabot
• Bump mojo-parent from 74 to 75 (#488) @dependabot
• Bump plexus-container-default from 2.0.0 to 2.1.1 (#487) @dependabot
• Bump build-helper-maven-plugin from 1.10 to 3.4.0 (#483) @dependabot
• Bump slf4j-api from 1.7.26 to 1.7.36 (#485) @dependabot
• Bump doxia-site-renderer from 1.8.1 to 1.11.1 (#482) @dependabot
• Bump httpclient from 4.5.13 to 4.5.14 (#478) @dependabot
• Bump commons-io from 2.6 to 2.12.0 (#477) @dependabot
• Bump doxiaVersion from 1.8 to 1.12.0 (#475) @dependabot
• Bump commons-lang3 from 3.7 to 3.12.0 (#467) @dependabot
• Bump httpcore from 4.4.8 to 4.4.16 (#473) @dependabot
• Bump plexus-utils from 3.1.0 to 3.5.1 (#469) @dependabot
• Bump plexusComponentVersion from 1.7.1 to 2.1.1 (#453) @dependabot

👻 Maintenance

• Update plugins in ITs and cleanups (#492) @slawekjaranowski
• Use license plugin version from parent, update THIRD-PARTY.properties (#491) @slawekjaranowski
• fix copy&paste issue in property description (#376) @CCFenner
• Get rid of plexus-container-default from dependencies (#490) @slawekjaranowski
• Get rid of localRepository parameter (#489) @slawekjaranowski

🔧 Build

• Add release-drafter (#484) @slawekjaranowski