🚀 New features and improvements

• Improve performance of transitive dependency checks (#904) @harrisric

🐛 Bug Fixes

• Fix NPE when a classifier part is specified in bannedDependencies (#905) @harrisric

📝 Documentation updates

• Move contributing information into README (#911) @slawekjaranowski
• Rewrite CONTRIBUTING.md to use the Github issue tracker instead of JIRA (#898) @elharo

👻 Maintenance

• Remove unused javax.annotations dependency (#899) @elharo
• Remove unused methods (#900) @elharo
• Remove the from parameter names (#901) @elharo
• Fix a grab bag of typos and minor grammar errors (#897) @elharo
• remove unneeded contains check as add already does that (#896) @elharo

📦 Dependency updates

• Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0 (#910) @dependabot[bot]

🚀 New features and improvements

• Warning about old enforcer api in rule implementation (#894) @slawekjaranowski
• Introduce ruleName for rules configuration (#893) @slawekjaranowski
• Improve performance of BannedPlugins and RequireReleaseDeps (#371) @harrisric
• Enforce size bounds recursively on directory content (#368) @zabetak
• Improve the performance of BannedDependencies (#367) @harrisric
• [MENFORCER-516] - Use rule configuration in POM when executed from CLI (#344) @bpfoster
• [MENFORCER-508] - Add option to enforce same versions among Maven modules (#328) @kwin
• [MENFORCER-507] - Add xsltLocation parameter to ExternalRules (#322) @ppalaga

🐛 Bug Fixes

• RequireSameVersions rule: consider entries in <plugins> when analyzing build- and report-plugins (#892) @turing85
• [MENFORCER-495] - Remove "JAVA_HOME" from rule violation message (#346) @elharo

📝 Documentation updates

• Improve example of custom rule (#890) @slawekjaranowski
• Make documentation explicit about java versions for custom rules (#370) @harrisric
• [MNGSITE-529] - Rename "Goals" to "Plugin Documentation" (#351) @Bukama
• [MENFORCER-335] - Update dependencyConvergence.apt.vm (#347) @elharo
• [MENFORCER-511] - Match start-tag to end-tag (#341) @elharo
• [MENFORCER-505] - fix documentation for requireMatchingCoordinates (#320) @kwin

👻 Maintenance

• Update site descriptor to 2.0.0 (#889) @slawekjaranowski
• Use constant 3.6.3 in prerequisites/maven as minimal Maven version (#887) @slawekjaranowski
• Enable Github Issues (#363) @Bukama
• Remove unused collections (#358) @elharo
• Eliminate some string operations (#357) @elharo
• Use cached default charset and update URL fragment (#360) @elharo
• Add GitHub Automation actions (#359) @slawekjaranowski
• A grabbag of small simplifications found by IntelliJ (#354) @elharo

🔧 Build

• Enable build by Maven 4 on GitHub (#891) @slawekjaranowski

📦 Dependency updates

• Bump mavenVersion from 3.6.3 to 3.9.10 (#888) @dependabot[bot]
• Bump org.apache.maven:maven-parent from 44 to 45 (#886) @dependabot[bot]
• Update parent to 44 (#365) @Bukama
• Bump commons-codec:commons-codec from 1.17.1 to 1.18.0 (#349) @dependabot[bot]
• Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#362) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.26.3 to 3.27.3 (#348) @dependabot[bot]
• [MENFORCER-515] - Bump commons-io:commons-io from 2.16.1 to 2.18.0 (#336) @dependabot[bot]
• [MENFORCER-514] - Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0 (#331) @dependabot[bot]
• Bump org.apache.maven:maven-parent from 42 to 43 (#324) @dependabot[bot]
• Bump org.hamcrest:hamcrest from 2.2 to 3.0 (#329) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.26.0 to 3.26.3 (#325) @dependabot[bot]
• Bump commons-codec:commons-codec from 1.17.0 to 1.17.1 (#326) @dependabot[bot]
• Bump org.assertj:assertj-core from 3.25.3 to 3.26.0 (#318) @dependabot[bot]

🚀 New features and improvements

• [MENFORCER-497] - Require Maven 3.6.3+ (#317) @slawekjaranowski
• [MENFORCER-494] - Allow banning dynamic versions in whole tree (#294) @JimmyAx
• [MENFORCER-500] - New rule to enforce that Maven coordinates match given (#309) @kwin

🐛 Bug Fixes

• [MENFORCER-503] - Pass context to ProfileActivator - fix NPE in Maven 3.9.7 (#315) @slawekjaranowski

📦 Dependency updates

• [MENFORCER-501] - Bump commons-io:commons-io from 2.16.0 to 2.16.1 (#311) @dependabot
• [MENFORCER-501] - Bump commons-codec:commons-codec from 1.16.1 to 1.17.0 (#312) @dependabot
• [MENFORCER-504] - Bump org.apache.maven:maven-parent from 41 to 42 (#314) @dependabot
• [MENFORCER-501] - Bump org.apache.commons:commons-lang3 from 3.13.0 to 3.14.0 (#298) @dependabot
• [MENFORCER-501] - Bump commons-codec:commons-codec from 1.16.0 to 1.16.1 (#305) @dependabot
• [MENFORCER-501] - Bump commons-io:commons-io from 2.13.0 to 2.16.0 (#310) @dependabot
• Bump org.apache.commons:commons-compress from 1.21 to 1.26.0 in /maven-enforcer-plugin/src/it/projects/dependency-convergence_transitive_provided/module1 (#307) @dependabot
• Bump apache/maven-gh-actions-shared from 3 to 4 (#308) @dependabot
• [MENFORCER-498] - Update parent pom to 41 (#306) @slachiewicz
• Bump org.junit:junit-bom from 5.10.1 to 5.10.2 (#303) @dependabot
• Bump org.assertj:assertj-core from 3.24.2 to 3.25.1 (#301) @dependabot
• Bump org.codehaus.mojo:mrm-maven-plugin from 1.5.0 to 1.6.0 (#295) @dependabot
• Bump org.junit:junit-bom from 5.10.0 to 5.10.1 (#296) @dependabot
• [MENFORCER-492] - Bump plexus-utils from 3.5.1 to 4.0.0 and plexus-xml 3.0.0 (#291) @slawekjaranowski
• Bump org.xerial.snappy:snappy-java from 1.1.10.1 to 1.1.10.4 in /maven-enforcer-plugin/src/it/projects/dependency-convergence_transitive_provided/module1 (#292) @dependabot

👻 Maintenance

• [MENFORCER-490] - Remove unused dependency (#316) @elharo
• Bump org.apache.commons:commons-compress from 1.21 to 1.26.0 in /maven-enforcer-plugin/src/it/projects/dependency-convergence_transitive_provided/module1 (#307) @dependabot
• Bump org.assertj:assertj-core from 3.25.1 to 3.25.3 (#304) @dependabot
• [MENFORCER-498] - Update parent pom to 41 (#306) @slachiewicz
• Bump org.junit:junit-bom from 5.10.1 to 5.10.2 (#303) @dependabot
• Bump org.xerial.snappy:snappy-java from 1.1.10.1 to 1.1.10.4 in /maven-enforcer-plugin/src/it/projects/dependency-convergence_transitive_provided/module1 (#292) @dependabot
• Oxford comma, fill to file, and tighten language (#290) @elharo
• [MENFORCER-490] - Declare enforcer-rules dependencies (#289) @elharo
• [MENFORCER-490] - fully declare maven-enforcer-plugin dependencies (#288) @elharo

🐛 Bug Fixes

• [MENFORCER-491] - Fix plugin documentation generation (#286) @slawekjaranowski

👻 Maintenance

• [MENFORCER-490] - Declare maven-enforcer-plugin dependencies (#285) @elharo
• [MENFORCER-490] - Declare org.eclipse.sisu.plexus dependencies (#283) @elharo
• [MENFORCER-490] - Declare maven-enforcer-extension dependencies (#284) @elharo
• [MENFORCER-490] - Declare maven-enforcer-extension dependencies (#282) @elharo

🚀 New features and improvements

• [MENFORCER-488] - Add EnforcerLogger.isEnabled() (#279) @kwin

🐛 Bug Fixes

• [MENFORCER-393] - Extend IT for dependencyConvergence and no standard protocol in repository (#271) @slawekjaranowski
• [MENFORCER-426] - DependencyConvergence transitive dependencies with version range (#259) @slawekjaranowski
• [MENFORCER-480] - BanDynamicVersions: fix ignores parameter (#269) @Stephan202
• [MENFORCER-481] - BanDynamicVersions: make excludedScopes optional (#270) @Stephan202

📦 Dependency updates

• [MENFORCER-489] - Bump commons-lang3 from 3.12.0 to 3.13.0 (#281) @slawekjaranowski
• Bump org.junit:junit-bom from 5.9.3 to 5.10.0 (#280) @dependabot
• [MENFORCER-487] - Bump commons-codec from 1.15 to 1.16.0 (#277) @slawekjaranowski
• [MENFORCER-486] - Bump commons-codec from 1.15 to 1.16.0 (#276) @slawekjaranowski
• [MENFORCER-485] - Upgrade Parent to 40 (#275) @slawekjaranowski
• Bump guava from 30.1.1-jre to 32.0.0-jre in /maven-enforcer-plugin/src/it/projects/dependency-convergence-cycle (#274) @dependabot
• Bump snappy-java from 1.1.8.3 to 1.1.10.1 in /maven-enforcer-plugin/src/it/projects/dependency-convergence_transitive_provided/module1 (#273) @dependabot
• Bump junit-bom from 5.9.2 to 5.9.3 (#268) @dependabot

📝 Documentation updates

• Clarify availability of AbstractEnforcerRule (#278) @kwin

👻 Maintenance

• Bump org.junit:junit-bom from 5.9.3 to 5.10.0 (#280) @dependabot
• Bump snappy-java from 1.1.8.3 to 1.1.10.1 in /maven-enforcer-plugin/src/it/projects/dependency-convergence_transitive_provided/module1 (#273) @dependabot
• [MNG-6829] - Replace StringUtils#isEmpty(String) and #isNotEmpty(String) (#272) @timtebeek

🚀 New features and improvements

• [MENFORCER-276] - Allow ignoring dependency scopes in RequireUpperBoundDeps (#261) @slawekjaranowski
• [MENFORCER-470] - Configurable scopes for DependencyConvergence rule - refactor (#255) @slawekjaranowski
• [MENFORCER-470] - AdvancedDependencyConvergence rule (#246) @alexey-anufriev

🐛 Bug Fixes

• [MENFORCER-467] - banDynamicVersions excludedScopes on project level (#262) @slawekjaranowski
• [MENFORCER-474] - Filter dependency by scope on project level (#256) @slawekjaranowski
• [MENFORCER-466] - Apply the all levels scope and optional selectors on RequireUpperBoundDeps (#254) @ajarmoniuk
• [MENFORCER-469] - Fix banTransitiveDependencies and transitive dependen… (#253) @slawekjaranowski
• [MENFORCER-466] - Changed the default set of dependency exclusions to exclude provided (#248) @ajarmoniuk

📦 Dependency updates

• Bump maven-invoker-plugin from 3.5.0 to 3.5.1 (#266) @dependabot
• [MENFORCER-472] - Bump maven-invoker-plugin from 3.4.0 to 3.5.0 (#250) @dependabot
• [MENFORCER-471] - Bump plexus-utils from 3.5.0 to 3.5.1 (#252) @dependabot
• Bump apache/maven-gh-actions-shared from 2 to 3 (#251) @dependabot

📝 Documentation updates

• [MENFORCER-473] - Notice about max JDK in custom rules (#264) @slawekjaranowski
• improve documentation of banDynamicVersions (#265) @kwin
• (doc) fix banDynamicVersions example (#247) @lorenzpahl
• Fix two typos in banDynamicVersions.apt.vm (#249) @rickie

👻 Maintenance

• [MENFORCER-472] - Install maven-enforcer-plugin for ITs in maven-enforcer-extension (#263) @slawekjaranowski
• [MENFORCER-476] - Rename ResolveUtil to ResolverUtil (#260) @slawekjaranowski
• [MENFORCER-465] - Remove superfluous blanks in BanDuplicatePomDependencyVersions (#257) @slawekjaranowski

🚨 Removed

• [MENFORCER-435] - Remove not needed maven-dependency-tree and maven-compat (#202) @slawekjaranowski
• remove specific IDE m2e files (#192) @olamy

🚀 New features and improvements

• [MENFORCER-463] - Change success message from executed to passed (#242) @slawekjaranowski
• [MENFORCER-415] - Move error message to MojoException (#239) @slawekjaranowski
• [MENFORCER-460] - Deprecate display-info mojo (#237) @slawekjaranowski
• [MENFORCER-458] - Move Build-in rules to new API (#236) @slawekjaranowski
• [MENFORCER-458] - Move Build-in rules to new API (#233) @slawekjaranowski
• [MENFORCER-458] - Move Require Java, Maven Version to new API (#232) @slawekjaranowski
• [MENFORCER-458] - Move Require Property,Environment to new API (#231) @slawekjaranowski
• [MENFORCER-458] - Move Require*Checksum to new API (#230) @slawekjaranowski
• [MENFORCER-458] - Move RequireFiles* to new API (#228) @slawekjaranowski
• [MENFORCER-458] - Move RequireOS to new API (#227) @slawekjaranowski
• [MENFORCER-456] - New Enforcer API - RuleConfigProvider (#220) @slawekjaranowski
• [MENFORCER-444] - Improve error message for failed version rules (#218) @kwin
• [MENFORCER-455] - New Enforcer API (#216) @slawekjaranowski
• [MENFORCER-445] - Include JAVA_HOME location in the Java rule failure messages (#213) @psiroky
• [MENFORCER-454] - Deprecate 'rules' property and introduce 'enforcer.rules' as a replacement (#211) @psiroky
• [MENFORCER-431] - Introduce option to skip specific rules via custom property (#205) @psiroky
• [MENFORCER-453] - Mange rules configuration by plugin (#207) @slawekjaranowski
• [MENFORCER-435] - Replacing maven-compat and maven-dependency-tree usage with Resolver (#198) @ajarmoniuk
• [MENFORCER-440] - Allow 8 as JDK version for requireJavaVersion (#195) @slawekjaranowski
• [MENFORCER-411] - DependencyConvergence takes include/exclude parameters to filter errors (#136) @fdfea
• [MENFORCER-427] - New rule to ban dynamic versions (#187) @kwin
• [MENFORCER-430] - Allow one of many files in RequireFiles rules to pass (#183) @raupachz
• [MENFORCER-423] - Add rule to enforce an explicit dependency scope (#179) @kwin
• [MENFORCER-422] - Added externalRules rule (#180) @gastaldi
• [MENFORCER-397] - allow no rules (#178) @raupachz
• [MENFORCER-398] - show rules processed (#175) @raupachz
• [MENFORCER-424] - add enforcer rule which bans scope from (#169) @kwin

🐛 Bug Fixes

• [MENFORCER-462] - Execute ReactorModuleConvergence only once (#241) @slawekjaranowski
• [MENFORCER-461] - Fix NPE in RequirePluginVersions (#240) @slawekjaranowski
• [MENFORCER-459] - Avoid NullPointerException where there is no plugins (#193) @turbanoff
• [MENFORCER-434] - Regression bannedDependencies - matching with not existing versions (#223) @slawekjaranowski
• [MENFORCER-378] - Regression for non existing optional dependency (#222) @slawekjaranowski
• [MENFORCER-407] - Regression for dependencyConvergence - transitive provided (#221) @slawekjaranowski

📦 Dependency updates

• [MENFORCER-457] - Bump assertj-core from 3.24.1 to 3.24.2 (#235) @dependabot
• [MENFORCER-443] - Bump junit-bom from 5.9.1 to 5.9.2 (#229) @dependabot
• [MENFORCER-457] - Bump assertj-core from 3.24.0 to 3.24.1 (#226) @dependabot
• [MENFORCER-457] - Bump assertj-core from 3.23.1 to 3.24.0 (#219) @dependabot
• [MENFORCER-442] - Bump mockito.version from 4.10.0 to 4.11.0 (#209) @dependabot
• [MENFORCER-449] - Bump mrm-maven-plugin from 1.4.1 to 1.5.0 (#200) @dependabot
• [MENFORCER-448] - Upgrade maven-parent from 38 to 39 (#201) @psiroky
• [MENFORCER-446] - Bump plexus-utils from 3.4.2 to 3.5.0 (#189) @dependabot
• [MENFORCER-443] - Bump junit-bom from 5.9.0 to 5.9.1 (#186) @dependabot
• [MENFORCER-442] - Bump mockito.version from 4.7.0 to 4.10.0 (#197) @dependabot
• [MENFORCER-441] - Bump maven-common-artifact-filters from 3.2.0 to 3.3.2 (#185) @dependabot
• [MENFORCER-438] - Upgrade maven-plugin parent to 38 - cleanup (#194) @slawekjaranowski
• Bump mrm-maven-plugin from 1.3.0 to 1.4.1 (#168) @dependabot
• Bump maven-plugin-testing-harness from 3.1.0 to 3.3.0 (#164) @dependabot
• Bump mockito.version from 4.6.1 to 4.7.0 (#181) @dependabot
• Bump junit-bom from 5.8.2 to 5.9.0 (#177) @dependabot

📝 Documentation updates

• [MENFORCER-425] - Clarify usage of maven-enforcer-rules (#215) @kwin
• Fix javadoc of "fail" parameter (#166) @kwin
• [MENFORCER-361] - Add link to newly introduced rule to index...

🚀 New features and improvements

• [MENFORCER-420] - cache dependencies across rules (#152) @josephw
• [MENFORCER-409] - Log at ERROR level when is set (#133) @electrum

🐛 Bug Fixes

• [MENFORCER-389] - Allow filtering of parent in requireReleaseDeps (#157) @slawekjaranowski
• [MENFORCER-421] - Use currently build artifacts in IT tests (#159) @slawekjaranowski
• [MENFORCER-402] - fix provided dependencies in RequireUpperBoundDeps (#140) @subes

📦 Dependency updates

• Bump mockito.version from 4.6.0 to 4.6.1 (#161) @dependabot
• Bump assertj-core from 3.23.0 to 3.23.1 (#160) @dependabot
• Bump assertj-core from 3.22.0 to 3.23.0 (#158) @dependabot
• Bump mockito.version from 4.5.1 to 4.6.0 (#156) @dependabot
• [MENFORCER-419] - Upgrade Maven to 3.2.5 (#154) @slawekjaranowski
• [MENFORCER-418] - Upgrade Parent to 36 (#153) @slawekjaranowski
• Bump plexus-utils from 3.4.1 to 3.4.2 (#151) @dependabot
• Bump maven-dependency-tree from 3.1.0 to 3.1.1 (#150) @dependabot
• Bump maven-javadoc-plugin from 3.3.1 to 3.4.0 (#147) @dependabot
• Bump maven-surefire-plugin from 3.0.0-M5 to 3.0.0-M6 (#148) @dependabot
• Bump maven-project-info-reports-plugin from 3.2.2 to 3.3.0 (#149) @dependabot
• Bump mockito.version from 4.4.0 to 4.5.1 (#146) @dependabot
• Bump assertj-core from 3.21.0 to 3.22.0 (#134) @dependabot
• Bump mockito.version from 4.2.0 to 4.4.0 (#142) @dependabot
• Bump maven-jxr-plugin from 3.1.1 to 3.2.0 (#143) @dependabot
• Bump maven-project-info-reports-plugin from 3.1.2 to 3.2.2 (#144) @dependabot
• Bump mrm-maven-plugin from 1.2.0 to 1.3.0 (#129) @dependabot
• Bump mockito.version from 4.1.0 to 4.2.0 (#132) @dependabot
• Bump maven-javadoc-plugin from 3.2.0 to 3.3.1 (#130) @dependabot
• Bump mockito.version from 4.0.0 to 4.1.0 (#127) @dependabot
• Bump junit-jupiter-api from 5.8.1 to 5.8.2 (#128) @dependabot
• Bump mockito-core from 3.12.4 to 4.0.0 (#114) @dependabot
• Bump extra-enforcer-rules from 1.3 to 1.4 (#112) @dependabot
• Bump assertj-core from 3.20.2 to 3.21.0 (#110) @dependabot
• Bump sisu-maven-plugin from 0.3.4 to 0.3.5 (#109) @dependabot
• Bump actions/setup-java from 2.3.0 to 2.3.1 (#111) @dependabot
• Bump mockito-core from 3.12.0 to 3.12.4 (#106) @dependabot
• Bump plexus-utils from 3.3.0 to 3.4.1 (#107) @dependabot
• Bump mockito-core from 3.11.2 to 3.12.0 (#103) @dependabot
• Bump actions/setup-java from 2.1.0 to 2.2.0 (#101) @dependabot

📝 Documentation updates

• (doc) - Require OS web page improvements (#122) @WilliamCollishaw
• (doc) - Require Java Version web page improvements (#120) @WilliamCollishaw
• (doc) - Require No Repositories page improvements (#121) @WilliamCollishaw
• (doc) - Require Fires Size page improvements (#119) @WilliamCollishaw
• (doc) - Reactor Module Convergence web page improvements (#118) @WilliamCollishaw
• (doc) - Ban Distribution Management web page improvements (#115) @WilliamCollishaw
• (doc) - Always Pass web page improvements (#116) @WilliamCollishaw
• (doc) - Built-In Rules web page improvements (#117) @WilliamCollishaw
• Update latest release (#100) @dadoonet

👻 Maintenance

• [MENFORCER-404] - Shared GitHub Actions (#124) @slawekjaranowski

https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12317520&version=12341008

Release notes:

https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12317520&version=12346527