[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.codehaus.mojo:exec-maven-plugin (source)	3.6.4 → 3.7.0

---

Release Notes

mojohaus/exec-maven-plugin (org.codehaus.mojo:exec-maven-plugin)

v3.7.0

Compare Source

Exec Maven Plugin 3.7.0 raises the minimum Maven version to 3.9.0, adds three long-requested exec:java options, and fixes a batch of old bugs in how commands and Java programs are started. Java 8 is still enough to run it. Builds on Maven 3.6.3 to 3.8.x must stay on 3.6.4.

✨ Highlights

• Maven 3.9.0 or later is required (#​548). Older Maven versions fail at startup with a prerequisite error.
• classpathDependencyExcludes removes chosen dependencies from the class path of exec:java and exec:exec (#​562, requested in #​68 by @​pramodanarase).
• mainClass from the manifest. When executableDependency is set and mainClass is not, the Main-Class attribute of that dependency's manifest is used (#​563, #​89 by @​sewe).
• keepClassLoaderOpen leaves the exec:java class loader open after the program returns, so shutdown hooks and background threads can still load classes (#​561, #​513 by @​tzaeschke).
• exec:java threading. The main class runs in a non-daemon bootstrap thread that the plugin waits for, so IDE builds such as m2e no longer interrupt it (#​572, #​526 by @​sbj42). A program's own UncaughtExceptionHandler now receives its uncaught exceptions (#​569, #​141 by @​dedeibel).
• exec:exec fixes. async together with outputFile keeps the output file open until the process ends (#​565, #​63 by @​tarioch). A relative executable resolves against workingDirectory again (#​567, #​92 by @​deepakab03). Unquoted line breaks and tabs in commandlineArgs count as spaces instead of creating empty arguments (#​571, #​466 by @​cebaa). A failed command logs its message at error level and keeps the stack trace for -X (#​568).
• Module path. Resource directories stay off the module path (#​560, #​534 by @​inaldt), and the %modulepath token is handled (#​532 by @​pzygielo).
• Documentation moved from APT to Markdown, and the module path argument file is now documented (#​557, #​566).

🚨 Removed

• Require Maven 3.9.0 (#​548) @​slachiewicz

🚀 New features and improvements

• Add keepClassLoaderOpen to exec:java (#​561) @​slachiewicz
• Add classpathDependencyExcludes (#​562) @​slachiewicz
• Read mainClass from the executableDependency manifest (#​563) @​slachiewicz

🐛 Bug Fixes

• Log only the message of a failed command at error level (#​568) @​slachiewicz
• Pass uncaught exceptions to the handlers of the program (#​569) @​slachiewicz
• Resolve a relative executable against the working directory (#​567) @​slachiewicz
• Treat unquoted line breaks and tabs in the arguments as spaces (#​571) @​slachiewicz
• Run the main class in a non-daemon bootstrap thread (#​572) @​slachiewicz
• Keep the output file open for asynchronous executions (#​565) @​slachiewicz
• Keep resource directories off the module path (#​560) @​slachiewicz
• Handle %modulepath token (#​532) @​pzygielo

📝 Documentation updates

• Document the module path argument file (#​566) @​slachiewicz
• Convert the site documents from APT to Markdown (#​557) @​slachiewicz
• Add AGENTS.md (#​552) @​slachiewicz

👻 Maintenance

• Ignore JVM option notices in the mexec-86 output check (#​564) @​slachiewicz
• Declare the Maven artifacts the code uses (#​553) @​slachiewicz
• Remove redundant mojo.java.target property (#​554) @​slachiewicz
• Keep Dependabot on Maven 3.9.x (#​550) @​slachiewicz
• Keep plexus-xml on 3.x in Dependabot (#​541) @​slachiewicz

🔧 Build

• Resolve the heaviest plugins of setup-parent in the main build (#​559) @​slachiewicz
• Reuse the cached prefix file in the integration tests (#​558) @​slachiewicz
• Use the runners' cached Temurin JDKs in CI (#​551) @​slachiewicz
• Serve the plexus-utils fixture dependency from a mock repository (#​549) @​slachiewicz
• Assign merged pull requests to the release milestone (#​547) @​slachiewicz
• Check dependencies monthly and group the updates (#​546) @​slachiewicz
• Run fewer JDKs on macOS and Windows and the ITs in parallel (#​545) @​slachiewicz
• Keep Dependabot off Mockito 5 (#​543) @​slachiewicz

📦 Dependency updates

• Bump the maven group with 4 updates (#​555) @​dependabot[bot]
• Bump asm.version from 9.10.1 to 9.11 (#​544) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-xml from 3.0.1 to 3.1.0 (#​542) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-utils from 3.0.24 to 3.6.1 in /src/it/projects/modulepath-from-cli (#​539) @​dependabot[bot]
• Keep plexus-xml on 3.x in Dependabot (#​541) @​slachiewicz

Thanks to @​pzygielo and @​slachiewicz.

Full changelog

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7346

[gitar-bot]

Renovate safety review: Low risk (CI pending)

Update: org.codehaus.mojo:exec-maven-plugin 3.6.4 → 3.7.0 (minor), in check-list/pom.xml and sonar-java-plugin/pom.xml.

Release notes reviewed: 3.7.0 (3.6.4 → 3.7.0 is a single release step, no intermediate releases).

Usage impact

• Maven 3.9.0+ is now required. The repo pins maven = "3.9" in mise.toml, and I found no enforcer rule or wrapper pinning an older Maven. Local or CI builds on Maven ≤ 3.8.x would fail at startup with a prerequisite error.
• check-list uses exec:java with mainClass org.sonar.java.CheckListGenerator. The release moves the main class into a non-daemon bootstrap thread and passes uncaught exceptions to the program's own handlers. The generator should not be affected, but this is the behaviour change most worth watching.
• sonar-java-plugin uses exec:exec with java and a relative-path source file (${project.basedir}/..., absolute in practice). The relative-executable, argument-whitespace and async/outputFile fixes should not affect it.
• No modulepath, classpathDependencyExcludes or executableDependency options are in use.

CI: Build and Windows unit-test jobs are still pending. verify-sca and the Renovate minimum-release-age check pass.

Uncertainties: I could not confirm which Maven version the CI runner images provide (not pinned in the workflows), and the pending build jobs will show whether the generator and profile/license steps still run.

Verdict: Low risk. Merge once the pending CI jobs pass.

[gitar-bot]

Code Review ✅ Approved 🟡 Medium risk

Updating exec-maven-plugin in two POMs to 3.7.0 raises its Maven requirement to 3.9, so older Maven builds could fail.

Bumps the org.codehaus.mojo:exec-maven-plugin dependency from 3.6.4 to 3.7.0, which raises the minimum Maven requirement to 3.9.0. No issues found.

Verification Rules 2/2 met PRs 2 inspected

Functional validation No results

Rules 2 passed 1 action taken 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance
🎸 Review major and minor Renovate updates - Posted advisory summary: low risk, noting the Maven 3.9.0+ requirement (repo uses 3.9) and pending CI.

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 6500: SONARJAVA-7320 Cache safe Maven module results in PR checks Inspected
PR 6519: Update dependency org.codehaus.mojo:build-helper-maven-plugin to v3.8.0 Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube