Adapt maven central deployment & upgrade dependencies (#653)

Author: kaklakariada

dependencies.md

@@ -1,4 +1,4 @@
-# Project Keeper 5.2.0, released 2025-??-??
+# Project Keeper 5.2.0, released 2025-06-06
 
 Code name: Maven Central Portal Deployment
 
@@ -10,10 +10,23 @@ This release updates the Maven Central release process to use the new Central Po
 
 * #647: Migrate to Central Portal for Maven Central publishing
 
+## Security
+
+* #649: Fixed CVE-2025-4949 in `org.eclipse.jgit:org.eclipse.jgit:jar:7.2.0.202503040940-r:compile`
+
 ## Dependency Updates
 
 ### Project Keeper Shared Model Classes
 
+#### Compile Dependency Updates
+
+* Updated `org.eclipse.jgit:org.eclipse.jgit:7.2.0.202503040940-r` to `7.3.0.202506031305-r`
+
+#### Test Dependency Updates
+
+* Updated `org.junit.jupiter:junit-jupiter-params:5.12.2` to `5.13.0`
+* Updated `org.mockito:mockito-core:5.17.0` to `5.18.0`
+
 #### Plugin Dependency Updates
 
 * Added `org.sonatype.central:central-publishing-maven-plugin:0.7.0`
@@ -24,6 +37,7 @@ This release updates the Maven Central release process to use the new Central Po
 #### Compile Dependency Updates
 
 * Updated `com.exasol:project-keeper-shared-model-classes:5.1.0` to `5.2.0`
+* Updated `org.xmlunit:xmlunit-core:2.10.0` to `2.10.2`
 
 #### Runtime Dependency Updates
 
@@ -32,6 +46,9 @@ This release updates the Maven Central release process to use the new Central Po
 #### Test Dependency Updates
 
 * Updated `com.exasol:project-keeper-shared-test-setup:5.1.0` to `5.2.0`
+* Updated `org.junit.jupiter:junit-jupiter-params:5.12.2` to `5.13.0`
+* Updated `org.mockito:mockito-junit-jupiter:5.17.0` to `5.18.0`
+* Updated `org.xmlunit:xmlunit-matchers:2.10.0` to `2.10.2`
 
 #### Plugin Dependency Updates
 
@@ -43,10 +60,12 @@ This release updates the Maven Central release process to use the new Central Po
 #### Compile Dependency Updates
 
 * Updated `com.exasol:project-keeper-core:5.1.0` to `5.2.0`
+* Updated `org.apache.maven:maven-model:3.9.9` to `3.9.10`
 
 #### Test Dependency Updates
 
 * Updated `com.exasol:project-keeper-shared-test-setup:5.1.0` to `5.2.0`
+* Updated `org.junit.jupiter:junit-jupiter-params:5.12.2` to `5.13.0`
 
 #### Plugin Dependency Updates
 
@@ -59,6 +78,12 @@ This release updates the Maven Central release process to use the new Central Po
 
 * Updated `com.exasol:project-keeper-core:5.1.0` to `5.2.0`
 
+#### Test Dependency Updates
+
+* Updated `org.junit.jupiter:junit-jupiter-params:5.12.2` to `5.13.0`
+* Updated `org.mockito:mockito-core:5.17.0` to `5.18.0`
+* Updated `org.xmlunit:xmlunit-matchers:2.10.0` to `2.10.2`
+
 #### Plugin Dependency Updates
 
 * Added `org.sonatype.central:central-publishing-maven-plugin:0.7.0`
@@ -69,10 +94,15 @@ This release updates the Maven Central release process to use the new Central Po
 #### Compile Dependency Updates
 
 * Updated `com.exasol:project-keeper-shared-model-classes:5.1.0` to `5.2.0`
+* Updated `org.eclipse.jgit:org.eclipse.jgit:7.2.0.202503040940-r` to `7.3.0.202506031305-r`
 
 #### Test Dependency Updates
 
 * Updated `com.exasol:project-keeper-shared-test-setup:5.1.0` to `5.2.0`
+* Updated `org.junit.jupiter:junit-jupiter-params:5.12.2` to `5.13.0`
+* Updated `org.mockito:mockito-core:5.17.0` to `5.18.0`
+* Updated `org.mockito:mockito-junit-jupiter:5.17.0` to `5.18.0`
+* Updated `org.xmlunit:xmlunit-matchers:2.10.0` to `2.10.2`
 
 #### Plugin Dependency Updates
 

doc/changes/changes_5.2.0.md

@@ -113,3 +113,71 @@ This makes PK in all repositories to verify that the file `test/my_file.md` exis
 ## Adding a Pom File Validation
 
 Validations for the POM file are defined using code. For maven plugins there is the abstract base class `AbstractPluginPomTemplate` that facilitates the template implementation.
+
+## Debugging Maven Central Deployment
+
+The PK module `maven_central` specified in `.project-keeper.yml` will deploy the marked Maven module to Maven Central. For debugging you can run this deployment locally.
+
+### Verify Bundle Content
+
+Maven plugin `central-publishing-maven-plugin` creates a bundle and uploads it to Maven Central. To verify the content of this bundle without uploading, run the following command. You don't need to Maven Central credentials to do this.
+
+```sh
+mvn clean deploy -Dgpg.skip=false -DskipTests \
+  -Dcentral-publishing.deploymentName="Testing Deployment" \
+  -Dcentral-publishing.autoPublish=false \
+  -Dcentral-publishing.skipPublishing=true
+```
+
+This will create a bundle containing all published modules **in one of the Maven modules**. You can find the bundle using `find . -name central-bundle.zip`. In Project Keeper this might return `./shared-model-classes/target/central-publishing/central-bundle.zip`. Check the content with `unzip -l`:
+
+```
+$ unzip -l ./shared-model-classes/target/central-publishing/central-bundle.zip
+Archive:  ./shared-model-classes/target/central-publishing/central-bundle.zip
+  Length      Date    Time    Name
+---------  ---------- -----   ----
+       64  06-06-2025 13:18   com/exasol/project-keeper-java-project-crawler/5.2.0/project-keeper-java-project-crawler-5.2.0.jar.sha256
+       32  06-06-2025 13:18   com/exasol/project-keeper-cli/5.2.0/project-keeper-cli-5.2.0.pom.md5
+       64  06-06-2025 13:18   com/exasol/project-keeper-shared-model-classes/5.2.0/project-keeper-shared-model-classes-5.2.0.pom.sha256
+       64  06-06-2025 13:18   com/exasol/project-keeper-java-project-crawler/5.2.0/project-keeper-java-project-crawler-5.2.0-sources.jar.sha256
+      833  06-06-2025 13:18   com/exasol/project-keeper-java-project-crawler/5.2.0/project-keeper-java-project-crawler-5.2.0-javadoc.jar.asc
+       64  06-06-2025 13:18   com/exasol/project-keeper-core/5.2.0/project-keeper-core-5.2.0.jar.sha256
+     3126  06-06-2025 13:18   com/exasol/project-keeper-java-project-crawler/5.2.0/project-keeper-java-project-crawler-5.2.0.pom
+      833  06-06-2025 13:18   com/exasol/project-keeper-shared-model-classes/5.2.0/project-keeper-shared-model-classes-5.2.0.jar.asc
+       32  06-06-2025 13:18   com/exasol/project-keeper-maven-plugin/5.2.0/project-keeper-maven-plugin-5.2.0.jar.md5
+...
+```
+
+Ensure that **only modules meant for publishing** are contained in this bundle and that it does not contain test modules.
+
+### Verify Bundle Upload
+
+To test the bundle upload to Maven Central **without publishing**, configure Maven Central credentials in `~/.m2/settings.xml`:
+
+```xml
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+    <servers>
+        <server>
+            <id>maven-central-portal</id>
+            <username>user</username>
+            <password>password</password>
+        </server>
+    </servers>
+</settings>
+```
+
+Then run the following command:
+
+```sh
+mvn clean deploy -Dgpg.skip=false -DskipTests \
+  -Dcentral-publishing.deploymentName="Testing Deployment" \
+  -Dcentral-publishing.autoPublish=false
+```
+
+**Important:** Make sure to specify argument `-Dcentral-publishing.autoPublish=false`. Without this option, the bundle will be published automatically.
+
+Then login to Maven Central Portal and go to the [deployments page](https://central.sonatype.com/publishing/deployments). Verify that your component was deployed successfully and has the expected content.
+
+Don't forget to click the "Drop" button for the deployment to avoid accidentally publishing it.

doc/developer_guide/developer_guide.md

@@ -21,11 +21,11 @@
         <revision>5.2.0</revision>
         <!-- Integration test ProjectKeeperMojoIT starts a Maven build which requires Java 17. -->
         <java.version>17</java.version>
-        <maven.version>3.9.9</maven.version>
+        <maven.version>3.9.10</maven.version>
         <minimum.maven.version>3.8.7</minimum.maven.version>
-        <junit.version>5.12.2</junit.version>
-        <xmlunit.version>2.10.0</xmlunit.version>
-        <mockito.version>5.17.0</mockito.version>
+        <junit.version>5.13.0</junit.version>
+        <xmlunit.version>2.10.2</xmlunit.version>
+        <mockito.version>5.18.0</mockito.version>
         <slf4j.version>2.0.17</slf4j.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
@@ -103,7 +103,7 @@
             <dependency>
                 <groupId>org.eclipse.jgit</groupId>
                 <artifactId>org.eclipse.jgit</artifactId>
-                <version>7.2.0.202503040940-r</version>
+                <version>7.3.0.202506031305-r</version>
             </dependency>
             <dependency>
                 <groupId>net.steppschuh.markdowngenerator</groupId>

maven-project-crawler/pk_generated_parent.pom

@@ -213,6 +213,7 @@ private ElementBuilder properties(final Collection<ProjectKeeperModule> enabledM
             properties
                     .child(element("gpg.skip").text("true"))
                     .child(element("central-publishing.autoPublish").text("true"))
+                    .child(element("central-publishing.skipPublishing").text("false"))
                     // Other options for waitUntil: published, uploaded
                     .child(element("central-publishing.waitUntil").text("validated"))
                     .child(element("central-publishing.deploymentName")

parent-pom/pom.xml

@@ -9,5 +9,6 @@
         <autoPublish>${central-publishing.autoPublish}</autoPublish>
         <waitUntil>${central-publishing.waitUntil}</waitUntil>
         <deploymentName>${central-publishing.deploymentName}</deploymentName>
+        <skipPublishing>${central-publishing.skipPublishing}</skipPublishing>
     </configuration>
 </plugin>