Dependency compatibility
This records the compatibility review of the dependency updates proposed on October 13, 2026, against development commit 4291395. It explains the build constraints behind the selected versions. It is not a release or publication record.
Reviewed upgrades
The Maven runtime target remains Java 17. Static analysis still runs on JDK 21 and later; contributor verification uses JDK 25. The wrapper now selects Maven 3.10.0, while the plugin's declared Maven minimum remains unchanged. All Actions references remain pinned to full commit IDs.
| Proposal | Selected version | Compatibility evidence |
|---|---|---|
| #1 (efa7613), checkout | 7.0.1 | Hosted runners support Node 24. Credential persistence remains disabled. The Pages workflow checks out only a successful same-repository develop push; it does not opt into unsafe fork checkout. |
| #3 (0ea2fe8), cache | 6.1.0 | Existing cache inputs are supported; database cache keys and scope remain unchanged. |
| #4 (cfa706e), static analysis | Spotless 3.10.4, Checkstyle 14.3.0, PMD 7.28.0 | Existing rules, failure behavior and coverage floors remain enabled. No suppressions were added for the upgrades. |
| #5 (ac701a6), JAR plugin | 3.5.1 | Packaging retains Java 17 bytecode and manifest settings. |
| #6 (6c005f7), setup-java | 6.0.1 | Temurin and Semeru remain supported. Existing inputs need no deprecated aliases. |
| #7 (76c58e9), Shade plugin | 3.6.2 | Agent and CLI packaging retain existing relocations and filters. |
| #8 (84ead5a), Maven Plugin Tools | 3.16.0 | Descriptor generation and the real Maven Invoker builds exercise the plugin. |
| #9 (f37bbbb), Invoker Groovy | 6.0.0, with test-hook changes | Five JSON-reading hooks now use explicit Map.get('properties'); every original assertion remains. See the migration below. |
| #10 (d2438d8), Failsafe | 3.6.0 | Forked runtime integration tests and their coverage checks remain enabled. Static-only and bootstrap commands explicitly skip ITs; full verification does not. |
| #12 (6ebe393), Deploy plugin | 3.2.0 | Plugin resolution and disposable local-file deployment validate the upgrade without publishing a release. |
| #13 (0082190), Install plugin | 3.2.0 | Local installation and the Invoker repository exercise installation. |
| #20 (7c3e5da), Maven wrapper distribution | 3.10.0 | Fresh wrapper bootstrap verifies SHA-256; an independent download also matches upstream SHA-512. The proposal's unrelated Windows line-ending conversion is omitted. |
| #21 (25c537b), Site plugin | 3.22.0 | Plugin goal resolution is checked. The public website continues to use VitePress, not Maven Site. |
| #22 (caf2234), deploy-pages | 5.0.1 | Artifact name, environment, OIDC permissions and exact-source deployment checks remain unchanged. A production deployment is a separate verification step. |
| #23 (159bbaf), TypeScript | Retain 5.9.3; defer 7.0.2 | TypeScript 7 removes the compiler API required by the current Vue type checker. Type checking is not disabled. |
| #24 (1ac48b1), upload-artifact | 7.0.2 | Named ZIP artifacts, retention and missing-file behavior remain unchanged. Coverage is still downloaded from the exact producing run. |
Each proposal links to the exact head reviewed. Their existing hosted CI is supporting evidence, not a substitute for testing the combined change. Most proposals passed the supported matrix individually. The existing JDK 28 early-access advisory failure is separate from the supported release gates.
Maven 3.10 migration
Maven 3.10.0 changes dependency traversal order, tightens model validation, and scopes repository credentials more strictly. This project keeps the new validation and credential protections enabled. Do not add compatibility flags that disable them merely to make a build green.
The distribution SHA-256 is 1f6d9909266510f039f59aa0e13dcd2c66da85f043e56276e41f2918f8bddaff. Updating the wrapper URL and checksum together is required. A warm wrapper cache alone does not prove a new checksum works; verify a fresh bootstrap too.
Maven's plugin documentation and the individual plugin release notes establish their supported Java and Maven baselines. The selected plugin updates do not require raising this project's Java 17 runtime baseline. In particular, Install 3.2.0 and Deploy 3.2.0 include trust-boundary hardening.
Failsafe 3.6 migration
Failsafe 3.6 stops treating skipTests as an integration-test skip. Commands that intentionally run static analysis or install the dogfood plugin without tests now pass both -DskipTests and -DskipITs. The full clean verify, pre-push and supported CI matrix still run integration tests and enforce coverage. A fresh clean verify -DskipTests -DskipITs was also checked and skips both test phases successfully. The shaded-agent runtime coverage gate now follows actual integration-test execution: skipTests alone no longer disables that gate. Explicit skipITs, maven.test.skip and jacoco.skip remain supported.
An IT-only check (clean verify -DskipTests) ran all 33 agent integration tests (31 passed, two existing opt-in skips), then failed the unchanged unit-coverage floor because unit tests were absent. Invoking the runtime gate against that fresh child-JVM data also failed its unchanged line floor (79% versus 80%). This confirms that skipping unit tests does not silently waive coverage requirements. Use the complete verification command for a passing quality gate.
Groovy JSON hooks
The unmodified Groovy 6 proposal failed five Invoker scenarios with MissingPropertyException: No such property: name for class: java.util.LinkedHashMap$Entry. Reading component.properties did not yield the JSON array expected by those hooks. Explicit component.get('properties') reads the JSON key without invoking Groovy's object-property shorthand.
This changes test access syntax, not Census findings or the assertions against them. Core, JSON and XML Groovy artifacts stay on the same version. The Groovy 6 release notes also describe security and parsing changes; application code does not acquire a Groovy runtime dependency.
Why TypeScript 7 is deferred
The proposed TypeScript 7.0.2 update fails npm run docs:typecheck before checking any theme code:
ERR_PACKAGE_PATH_NOT_EXPORTED:
Package subpath './lib/tsc' is not defined by "exports"The current vue-tsc 3.3.13 expects the JavaScript compiler API. Microsoft's TypeScript 7 announcement confirms that 7.0 does not expose that API and specifically identifies Vue/Volar as affected. Retain the working pin until the Vue toolchain supports the new compiler API. Revisit this with a coordinated tooling upgrade and passing type, build, link and browser checks; do not replace Vue template checking with plain tsc.
Actions compatibility
The selected checkout, cache and setup-java releases use Node 24 and require an appropriately updated runner. This repository uses GitHub-hosted runners. Organizations copying the workflows to self-hosted runners should check each action's documented runner minimum before upgrading.
Upload artifact and deploy-pages preserve the configured artifact workflow. The newer checkout's fork protections supplement the Pages job's existing trust checks. Never enable unsafe checkout to work around a failed provenance check.
Verification scope
The combined upgrades passed clean verify on macOS with JDK 25 and a fresh Maven 3.10.0 wrapper distribution: 774 tests discovered, 770 passed, four existing opt-in tests skipped, and all 21 Maven Invoker scenarios passed. Static analysis and coverage thresholds remained enabled. Documentation type checking, dependency audit (zero findings), coverage-provenance regression tests and production build/link checks also passed.
Install and Deploy were exercised with the parent POM and a disposable local file repository; deployed bytes matched the source POM. Site's help goal resolved successfully. These checks do not establish Maven Central publication, a production Pages deployment, or the combined cross-platform CI matrix. Those remain integration/release checks.